Hacker News Reader

Do you know if any ad networks actually manage to do this?

This strikes me as an extremely hard problem. ActionScript supports an eval() function, which should make static analysis almost impossible - how can you tell if someone is compiling together an evil string (that calls functions you have banned) and then passing that string to eval()?

View on HN

We (ClarityAd) do this for major ad platforms. We use a mix of static and dynamic analysis to assess risk. We've been able to detect and stop major exploit kit campaigns over the last few months. Ads have specific expected behaviors and their SWFs are not supposed to generate code dynamically.

Reply on news.ycombinator.com