Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

http://techcrunch.com/2015/03/31/google-says-5-of-web-browsers-have-ad-injectors-installed/?ncid=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=FaceBook#3Kwfc0:bu8K

by alexcasalboni • 11 years ago

175 153 11 years ago

techcrunch.com

jacquesm18• 11 years ago

You can't trust anybody except for open source repositories.

The easiest way to get such trash on your computer is installing software from a commercial vendor. Oracle is one major source of headache, if you aren't careful you'll find your 'java' install also gives you a severe case of malware/crapware.

There are whole companies dedicated to this concept of piggy-backing junk.

sp332• 11 years ago

At least you can get some projects crap-free from https://ninite.com/ The notable exception is Flash. The only place you can get up-to-date, crap-free versions of Flash is this URL: https://www.adobe.com/products/flashplayer/distribution3.htm... and scroll down, don't use the big "Download Adobe Flash Player" button on the right.

Lawtonfogle• 11 years ago

These companies are exploiting trust for the sake of making money. We all lose when the trust is destroyed just for a few to make few extra dollars. Privatized profits, socialized losses.

joosters• 11 years ago

You can't trust anybody except for open source repositories.

Like Sourceforge? http://blog.gluster.org/2013/08/how-far-the-once-mighty-sour...

jacquesm18• 11 years ago

Ah yes sourceforge. How far the mighty have fallen.

keithpeter• 11 years ago

I read the gp comment as something like a distribution repository. Apt-get or perhaps like brew on Mac OS and so on. Checksummed binaries and a single source for each machine.

bradleyland• 11 years ago

You can't trust anybody except for open source repositories.

Meanwhile, in the real world, Sourceforge injects adware in to downloads for open source projects. Trust is more subtle than open source/closed source.

icebraining• 11 years ago

Well, that depends if you read that has a "repository of open source software" or a "repository that is open source". Sourceforge doesn't qualify as the latter.

unstabilo• 11 years ago

He didn't say all open source is trustworthy, only that closed source is not. And Sourceforge, the repository itself is not open source.

dragonwriter2• 11 years ago

"You can't trust anybody outside of group X" does not imply "You can trust everybody inside of group X".

sheetjs• 11 years ago

There are whole companies dedicated to this concept of piggy-backing junk.

... including a YC company called InstallMonetizer: https://news.ycombinator.com/item?id=5092711

jacquesm18• 11 years ago

Fortunately they have 'watsi' too.

Downvoters are invited to explain what's wrong with this comment, I see installmonetizer as one of the low points in the history of YC and watsi as the high point, possibly the high point in VC investing in the last decade or more.

pannallas• 11 years ago

You can't trust open source repos either; you can only verify them.

And is anyone really reading all of the code they run before they run it? With all of its third-party dependencies?

I don't think open source repositories are safer because they're open source, but precisely because there is no commercial benefit to shoveling BS into them. In fact, with the bigger commercial open source software, you often do see crap you don't want being included as a means to funnel users into commercial channels.

jacquesm18• 11 years ago

Yes, that's an excellent point, I highly doubt anybody verifies what they install end-to-end. We all put a lot of trust in reputations and a couple of checksums.

seanwilson• 11 years ago

You also need to verify that the binary you run is the same source code and be able to identify malware in source code that may be very well hidden. This isn't remotely practical and for even simple software.

The only practical solution I can see is proper sandboxing of applications so you don't need to trust them in the first place.

aw3c2• 11 years ago

Actually, I do trust them and I do not verify them. So far I have had only good experiences.

tristor• 11 years ago

I haven't done this in most cases, but for some systems this is a practical action to take (embedded system, minimal software, security sensitive). The reality is any modern OS + apps for "basic" functions is far too complex and has too many SLOC in too many disparate languages for any one person to be able to reliably verify it all. Knowing that the very simple basic functionality of all the code you plan to run on an embedded device is secure though is still an achievable objective.

jfuhrman2• 11 years ago

Open source isn't some magical protection. Even with being a much smaller target, there have been malware on Linux repos.

Example on Gentoo(ignore the over the top headline):

http://www.zdnet.com/article/linux-infection-proves-windows-...

Not to mention that the repos themselves have been having security issues over the years.

Sir_Cmpwn2• 11 years ago

Gentoo is hardly a server-ready operating system. Find similar stories on Debian or CentOS instead?

makomk• 11 years ago

Gentoo systems refused to accept the backdoored source code because the SHA1 hash no longer matched - that's how the backdoor was discovered in the first place.

Sir_Cmpwn2• 11 years ago

The Linux model: you install software from repositories curated by people you trust - distribution maintainers. No viruses, no bundled adware, just simple no-bullshit software repositories. I have a hard time understanding why techies continue to put up with Windows and OSX.

code_duck6• 11 years ago

Agreed, every time I clean or set up a Windows computer for someone I marvel at how poor the entire process is, and how little it has changed in the past 15 years.

OSX still has very little adware attached to downloads, in my experience - plus there's the Mac App Store. It's pretty much just Windows users who endure that.

jsolson• 11 years ago

Perhaps because in OS X I (mostly -- about on par with Linux) install software from repositories curated by people that I trust (Apple, Homebrew), and then I don't have to put up with Linux.

Ded7xSEoPKYNsDd• 11 years ago

The most popular Linux distribution for end-users (Ubuntu) comes pre-installed with adware. To be fair, they ask you nicely whether to enable it nowadays, which makes it a few magnitudes better than most Windows adware. But it's sadly still enough to refute "no bundled adware".

ksk3• 11 years ago

You can't trust anybody except for open source repositories.

That is patently false.

Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service.

On the other hand, companies that give away stuff for "free" have to find unique ways to pay the bills (be it hosting fees, or hardware costs, or developer time, etc). In recent years the most common way is to create some way to essentially trick people into clicking ads.

Open Source repositories have not found any long term sustainable method to get compensated for their hosting fees or hardware costs. At the moment, they are run on donations - mostly from commercial vendors, universities and the like. At some point in the future, lets say if 500 million desktop users all start using those repositories, there will come a time when that cost is going to stick out on a balance sheet. I hope that they figure out a way to get paid for their efforts by then.

jacquesm18• 11 years ago

Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service.

Lenovo (and lots of other hardware manufacturers) are proof positive that this is absolutely not the case. There isn't a windows machine bought over the years by my extended family that did not have a whole pile of junk on it right from day one including ad injectors such as described in the article.

Whether or not open source is 'viable' for large numbers of users is no longer a question that needs settling. For bandwidth we have torrents if need be.

cazum2• 11 years ago

Open source projects are often developed by volunteers, and hosted by free services like github or bitbucket.

I've actually never seen an an freedom respecting project that included adware, and I can confidently say that the reason for that is that if a team were to do that, somebody would fork the repo and remove the offensive junk. As long as it gets caught, it's a self healing ecosystem. The same cannot be said for non-free software, as the pool of people who could find junk is so much smaller, but also because if junk were to be found by an employee, they'd have very little power to actually do anything about it.

Open source is volunteers, and when its not, they run on donations. When the donations stop, they stop. Some have found clever ways to make money, such as pay4premium or pay4support, but I've never seen ad injectors. Those come from third party distributors who aren't affiliated with the projects and can be avoided.

krschultz• 11 years ago

I wonder how this compares to the % of users that have ad blockers installed. Ad injectors might be a bigger hit on their revenue than ad blockers.

compbio• 11 years ago

Original article: http://googleonlinesecurity.blogspot.nl/2015/03/out-with-unw...

mckoss• 11 years ago

Looks like techcrunch is running an unwanted article injector :-)

anon13853• 11 years ago

Well maybe they should stop allowing download sites that offer ad infected downloads to buy the top spots on the google search results page? https://i.imgur.com/Ote9c2k.png

Adwords is probably one of the main infection vectors for malware these days.

Previous rant: https://news.ycombinator.com/item?id=8879229

chimeracoder• 11 years ago

This, right here, is why I have no qualms installing Adblock Edge and insisting that my parents (and anyone else who isn't very tech-savvy) do the same.

It's not about not wanting to support independent bloggers. It's about making sure that unsuspecting users don't accidentally download malware when they're doing something mundane like downloading their web browser.

In the age of the web, Adblock is the new anti-virus.

brador2• 11 years ago

It's the 30 second youtube ads that finally got me to install adblock again after 3 years without.

Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks).

fragsworth• 11 years ago

It's definitely the people who are least inclined to install an ad blocker that could use it most.

On the other hand, it takes a long time, but they do learn to be more cynical about the Internet if they're exposed to its raw state.

ocdtrekkie3• 11 years ago

Absolutely. Though they're apparently changing their policy sometime this month to require ads advertising downloads be that apps' "primary download source".

anon13853• 11 years ago

That's good to hear. As you can see if you follow the links above I've been ranting about this for a long time.

Do you have a source for that information?

ceejayoz2• 11 years ago

Your rant is outdated. This is what "download firefox" looks like now:

http://i.imgur.com/dG7wONC.png

anon13853• 11 years ago

You can't take a single search as evidence that things have changed. Ads won't always show for the search terms for various reasons (geography, language, platform, lack of ad budget etc).

jacquesm18• 11 years ago

For you.

It looks more like the OP's version to me, including 'softonic' as the third linked one. The top two are mozilla's (and I use an ad blocker so I don't see the ad).

On Chrome the first 6 links are mozilla's then the 'download sites' start.

ics• 11 years ago

With uMatrix in Chrome I see "firefox.safe-downloading.com/‎" as the top result, with the Mozilla Foundation banner below it.

jfuhrman2• 11 years ago

There are still lot of Google ads on download sites that are extremely misleading and look like download buttons. http://blog.malwarebytes.org/wp-content/uploads/2012/10/Ad8....

As I wrote in another comment, even YCombinator invested in a bundleware company and PG defended it, so I guess the problem is deep rooted.

https://news.ycombinator.com/item?id=9283176

greggman• 11 years ago

I just tried it. 2nd and 3rd links install ad injectors

http://imgur.com/AChAmGp

JohnTHaller• 11 years ago

My 2nd link on google when searching for "firefox" is an ad-injected installer on firefox.safe-downloading.com (appreciate the irony of the domain name).

rogerbinns• 11 years ago

I have a google alert for one of my open source projects (APSW) and every day almost they email me one or two sites where it has popped up. Virtually every one has a bizarre name, and on going to the site it is content obviously generated using Markov chains from other sites and incomprehensible to humans.

Of course there is no way to tell Google that these aren't real sites (I tried) and distinguishing real text from Markov chains using a computer is hard.

I keep wondering what it will take for them to figure out bad content, both for the computer (javascript etc) and for people (english etc).

gergo_v• 11 years ago

They've apparently updated their adwords policy regarding this. Now it's a matter of enforcement:

http://ipensatori.com/2015/03/20/google-update-to-software-d...

josefresco2• 11 years ago

To be fair, while the sites in your screenshot are listed in Google's index, they aren't the top results for "download firefox". There are 4 official Mozilla links before the crap links not to mention a special Google feature box (or whatever they call it) at the top with a direct link to Mozilla.

NelsonMinar• 11 years ago

Adwords has had a policy against ads for malware for many years now. (I helped develop an earlier version of that policy.) But it's not entirely effective. Unreviewed ads, poorly reviewed ads, and ads for sites that just barely skirt the boundaries of being malware are all regular problems. For some historical perspective, here's a 2007 article: http://www.infoworld.com/article/2663560/application-develop...

sukilot• 11 years ago

The reality is that there is virtually 0 market for user-friendly PPC ads on browsing sessions noncommercial intent. Therefore scammers (users have a wider definition than Google) will always win the auctions.

mbrubeck• 11 years ago

As recently as a year ago, even "google chrome" turned up an adware ad as the first "result" in a Google search:

https://twitter.com/mbrubeck/status/459715935272566784

johnward2• 11 years ago

Usually those kind of ads get shot down just on trademark. At least that's been my experience. I could never bid a term like that in adwords.

ocdtrekkie3• 11 years ago

Maybe if Google AdWords wasn't a malware delivery tool...

acomjean• 11 years ago

Do these injectors work with https (ssl) sites?

Where in the web page fetch/render process does this occur?

ceejayoz2• 11 years ago

They're often browser toolbars, which'll work fine on SSL sites.

rebelde• 11 years ago

That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now".

5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.

jacquesm18• 11 years ago

HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.

nickhalfasleep• 11 years ago

Most extensions and toolbars have access to the DOM via browser javascript methods (Safari, Chrome, Firefox), or C++ Browser Helper Objects (BHO's) in IE, so they can inject and redirect content if the user installs it.

charonn0• 11 years ago

Not unless they do something incredibly stupid like install a certificate authority and hijack every SSL session. [1]

[1] http://en.wikipedia.org/wiki/Superfish#Lenovo_security_incid...

Someone1234• 11 years ago

If you turn on CSP reporting for your web-site you'll see a LOT of reports about attempted script injection into your site. When you research it you'll find that these come from malware/extensions which are pushing ad content and other nonsense.

AgentME• 11 years ago

Similarly, if you have a site set up to make an ajax connection back to your server whenever an uncaught javascript exception happens (protip: if you do this, make sure to throttle it, or else if you push a bad update that makes users' browsers get stuck in a loop throwing errors, they will all try their damnedest to DDOS you!), then it's very easy for most of the reported errors to not actually originate from your site's own scripts but be from browsers broken by adware. I've been very surprised that I haven't seen more talk about this until now.

I remember trying to track down a bug a few users reported, and I finally discovered that the users all had a specific piece of malware that replaced the javascript setTimeout function with a version that only took two arguments, which caused my code to break in frustratingly subtle and mystifying ways.

sandinmyjoints• 11 years ago

I also have wondered why this isn't talked about more often. We see an unbelievable amount of garbage from catching uncaught client-side errors.

tinco• 11 years ago

    "It’s also worth noting that ad networks often also don’t know that their ads are being used in this way."

So, ad networks don't know about a source that hits them with the 5% of the total throughput of Google's sites? Yeah right.

Eridrus• 11 years ago

There's some nuance here.

The ad network whose script/iframe is directly injected onto the top frame can know fairly easily, since they know which accounts should be linked to which domains, however when these inevitably get resold, these subsequent ad networks have a much tougher time.

What ends up happening is that the first thing that gets injected is someone totally shady ad network that doesn't care, who will then resell it to someone slightly less shady, who will bundle it with a pile of other traffic, etc, etc, until it's been laundered enough times that it's hard to separate this out.

gadders• 11 years ago

Browsing sites on my Android phone is the worst. I frequently get re-directed right off the page to either Google Play to install some dodgy app, or some site that tries to download the APK directly.

code_duck6• 11 years ago

This happens a lot on iOS too - even some respectable sites have ads that open the App Store without any user intervention. I'm not sure why Apple allows this.

MBCook2• 11 years ago

They stopped it with iOS 8, but after a few weeks someone had found a way around it and the problem was back.

It doesn't effect me much, which must say something about the sites I read. But it is obnoxious as hell.

code_duck6• 11 years ago

Given the number of insanely infested windows machines I've fixed for friends and relatives, I'm surprised it's so few. On the other hand, I suppose most of those people use Bing on IE since it's never occurred to change the default, as they probably don't distinguish between Google, Yahoo and Bing anyhow.

Mikeb85• 11 years ago

And this is why open source, combined with trusted repos is the way to go. Granted, I do have a few closed source apps (Steam, games, Chrome and Opera contain open source bits but are also closed source), but those are apps I mostly 'trust' (I don't trust them 100%, but then again I'm also not pouring through the Linux kernel code).

Best way to avoid scams is common sense (if something looks dodgy, it probably is).

AYBABTME• 11 years ago

I guess it balances out those with ad blockers.

fsaintjacques• 11 years ago

Here's an example of said extension.

https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf

If you want to test the effect of it, copy/paste 'console.js' content in Chrome's console, I recommend to go into incognito mode:

https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf#f...

eevilspock• 11 years ago

“Unwanted ad injectors aren’t part of a healthy ads ecosystem,” Google Safe Browsing engineer Nav Jagpal writes in today’s announcement. “They’re part of an environment where bad practices hurt users, advertisers and publishers alike.”

Healthy ads ecosystem? WFT? The internet is inundated with garbage because of the perverse incentives wrought by ad-based revenue models, not to mention the other costs of advertising: https://news.ycombinator.com/item?id=8585237.

Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites which would, if Google and others didn't make it so easy to get ad revenue, be forced to do what you're supposed to do in a healthy free-market ecosystem: make products good enough that people are willing to pay for them.

__david__2• 11 years ago

Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites…

The difference is that those websites willing allow ads of a specific type to be injected into themselves. The browser toolbars inject ads into everything, which is annoying (and breaks sites due to poorly coded injection).

I'm with you though—ads of any type are pretty annoying. But that's what adblock is for. :-)

josefresco2• 11 years ago

I wonder if the users who have 2 or more ad-injectors installed did not get "re-infected" but rather the first infection opened the door to more? Or maybe it's a specific vulnerability that is being exploited by multiple spyware vendors?

usaphp• 11 years ago

Can you recommend me what can be done on a Mac to remove such as injectors?

orf• 11 years ago

That's funny as it is mostly Chrome extensions that inject adverts from what I have seen. I wondered why Ghostery was blocking 20 trackers on YouTube - it was all the random extensions that require full access to everything.

hellbanner• 11 years ago

I googled for "Open Office download" on a family's computer and went with the first download -- download.com or cnet, I think.

It downloaded very fast and I thought "well, maybe it's just an initializer that torrents the rest". NOPE. Within 30 seconds of the installer, it prompted to install an ad-bar in the browser. I quickly closed and researched for the official site.

It was scary, being a technical professional, and executing adware(malware?) installer while trying to install an open-source alternative to the most popular word-processor for a less-than-savvy family member.

It was the top result on Google at the time.

wampus• 11 years ago

A nice benefit of using DuckDuckGo is the distinctive way it flags an official site.

declan• 11 years ago

CNET.com and Download.com are both part of CBS Interactive (CNET Networks was a publicly traded company and was bought by CBS in 2008).

I worked at CBS Interactive when the Download.com installer/adware controversy erupted: http://insecure.org/news/download-com-fiasco.html

As you might expect, it was controversial inside the company as well. I guess things haven't changed after I left.

aerique• 11 years ago

I go to Wikipedia nowadays to find a project's official URL. Not foolproof but better than Google.

dublinben• 11 years ago

This is fundamentally Microsoft's fault. The shareware culture of Windows is insanely insecure these days. Any sane operating system should have a packet manager, with all the software you could want included, and nothing you don't.

tobias3• 11 years ago

With Microsoft having that large a share of the PC market this would result in anti-trust lawsuits.

I think this issue must be solved on a regulatory level, i.e. Google (and Bing!) should be punished for providing malware links (and the actual providers of course).

MartinCron• 11 years ago

This is one of the reasons why I love using Chocolatey. Downloading and running an installer from an arbitrary site feels both quaint and dangerous.

freehunter• 11 years ago

Yeah it's Microsoft's fault for allowing third-party applications be be installed on their OS. You'd never see OSX or Linux letting people install software without going through a walled garden.

ams6110• 11 years ago

I never download from 3rd party sites like cnet. Just take the extra few seconds to identify the official site and go there.

TazeTSchnitzel• 11 years ago

Off-topic, but: these days you should probably use LibreOffice, since most developers jumped ship to the fork and it's seen considerable improvements OpenOffice.org hasn't.

mreiland• 11 years ago

same thing with firefox. I made that mistake once because I never expected a malware download link to be higher in google's rankings than mozilla.org.

I was shocked, and to this day I find that utterly ridiculous.

gress• 11 years ago

Google should stop running its server side Ad-Injectors before they complain about the client side ones.

__david__2• 11 years ago

I believe this. We've recently been tracking down bugs coming from users of a web site a friend and I run. We couldn't figure out what was going on until we realized that some injected code was stomping on our site's code and breaking everything. Grrr. So now we have to decide if we want to change all our code to be way more defensive (or offensive) so that we work in the face of hostile injected code. Or perhaps we just live with 5% of our users not working.

code_duck6• 11 years ago

Ad injection can cause other problems, too, especially when combined with people whose understanding of technology is lacking.

A few years back I got a job to do a wordpress site for a client. However, I wasn't dealing directly with the client, I signed on through a friend who was a fellow staff member of a forum I frequented. He agreed to create their site despite the fact that he was almost entirely technologically illiterate. His skills were at the 'barely read email' and 'be puzzled by OSX window decorations' sort of level. So, I agreed to do the job.

After working on the site for a couple of weeks, one day I received a call from him. He was quite upset as he was seeing porn ads and random nonsense characters on the blog. I investigated and found no trace of ads or foreign code, using several devices and several separate Internet connections. However he could see the ads on multiple devices in his house. Attempts to get him to try another Internet connection like his phone service were unsuccessful. I was pretty sure there was nothing wrong with the site, which was hosted on my VPS along with a couple of other sites that had no sign of issues. However he grew progressively more worried that the client would see these ads on the page, which was live for some reason. I even engaged the help of 20 or so people from the forum to check and they all agreed that no porn ads were visible to them. However this just upset my friend more as he felt embarrassed, but still convinced there was a problem. I suspected he had a virus on the systems at his house (all Apple...) or his router. It ended up with me being banned from his forum and being forced to quit the job... Before finally someone reset his router and the porn ads disappeared.

So, content appearing from unknown sources has definitely caused me problems in the past.

soggypopsicle• 11 years ago

I am one of these spammers. I had a chrome extension and was approached by revjet.io about adding injected ads. The ads typically overwrite the sites normal ads.

I see it as stealing the ad revenue from the content creator(which is often Google), which is the same as using adblock.

(the extension mentioned that ads were being used and you could also disable them)

johnward2• 11 years ago

There is a while industry of Pay Per View (PPV) ad networks that basically operate this way. A few that come to mind: Trafficvance, LeadImpact, Media Traffic and DirectCPV.

I don't know where Trafficvance gets their traffic but it seems to be pop-over ads probably from some installed software. DirectCPV seems to be interstitial ads that the sites actually choose to use (think big news sites with an ad before you read the article). Most of them seem to be spyware/crapware driven. Those are the only two I've worked with in the past so I can't speak on the others.

chatmasta4• 11 years ago

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response.

Obviously this is harmful to users because the implication is that the technique also requires SSL stripping, or trusting invalid root certificates like we saw with Superfish. It's also harmful to advertisers and ad networks because it pollutes tracking data and makes it hard to determine click fraud.

But let's not kid ourselves. Google does not care about the user. They simply have no need for ad injectors because they already have far superior methods of tracking us and invasively advertising to us (reading our email, watching our GPS location, knowing when we are home, what videos we watch, etc.) To google this is just a nuisance and they get some free PR for standing up to it along with a respected academic institution. Yay, google! Protector of users!

But wait. Isn't this exactly what Verizon, ATT, and Comcast are all doing? Verizon was modifying HTTP headers during the summer. ATT charges users not to inject tracking into packets. Comcast injects HTML into xfinitiwifi connections. How is this any different? Sure, tracking headers do not manifest themselves in annoying pop up ads, but they are still messing with user requests and have almost as many security implications.

If Google is going to take a stand against ad injectors, they need to take a stand against all packet injection. These scammy popups are just the bottom of the totem pole. If they could get away with what the big telecoms are doing, they would obvioisly do that instead.

comex• 11 years ago

Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?

jacquesm18• 11 years ago

- ssl stripping

- browser extensions

chatmasta4• 11 years ago

If Verizon owns your phone (literally, in the case of their edge program), all they need to do to inject tracking into HTTP packets is install a trusted root cert for themselves on your phone. One might argue that's not even wrong for them to do.

Also, Verizon and ISP's in general don't need access to unencrypted HTTPS data to track you. HTTP is an application layer protocol (top of OSI model), but your ISP can track you all the way down to the physical layer (bottom of OSI model). They still have all the metadata of your packets, even if they don't have the unencrypted content of them, because they literally own the wires/spectrum that your device used to send data. That means they can see when you use the Internet, what IP addresses you go to, how much content you send to each, etc etc. I don't think I need to explain to HN how much you can extract from metadata.

My point is that Verizon is not playing the game of injecting the actual ads you see. They inject tracking codes, or track you in other ways, but they still sell that data to the same advertisers who benefit from ad injectors. (Because ultimately, an ad is an ad, no matter how it got in your computer, and if you click it, the advertiser stands to benefit.)

Google should take a stand because the problem of ad injection is a symptom of the bigger problem, which is messing with user traffic in general.

Perhaps the solution is breaking up control of the OSI model. The companies running your cable should not be the same ones servicing you in the application layer.

alpeb• 11 years ago

In the case of chrome extensions and apps, Google was working on an ad solution a couple of years ago but didn't end up releasing anything. In light of no viable monetization solution for this kind of software it's natural devs have to resort to this kind of practices.

csears• 11 years ago

"When it comes to malware, ad injectors may seem relatively benevolent at first."

Did they mean 'relatively benign'?

ChuckMcM2• 11 years ago

These guys are pretty annoying. And it ads an "untrusted" advertising stream to the page, a channel which has been the source of malware infections in the past.

I'm really curious how this all turns out. I can't imagine the deteriorating system lasting another 5 or 10 years. So what happens after? Clearly advertising has _some_ value, I loved BYTE magazine as much for the ads as I did for the articles, and there are under served retailers (a lot of Business to Business stuff) as the trade magazines take hits. So how do people discover this stuff? How do they find those opportunities when Internet ads are dead?

Or do we get to a more reasonable advertising load? Something without flash/js jiggling around and trying to get your cursor. How will sites let users know they don't allow "invasive" ads? How will users respond? For me at least I think it is the difference between Web 2 and Web 3.

jacquesm18• 11 years ago

How did you discover websites before advertising took over the web?

I don't remember having any trouble discovering new stuff, rather the opposite, word of mouth and following links gave an endless stream of new and interesting stuff.

This site alone generates more info in that bracket than I can keep up with (even though I really try to).

ChuckMcM2• 11 years ago

GNN ? :-) Generally discovery of web sites wasn't nearly as difficult as discovering new products. Its the flip of that problem that is hard. Which is BYTE would sell advertising to companies that wanted to reach people building/using/programming microcomputers like me. But these days people consume their information from a thousand sources, whether it is a mention here, or an article on reddit, or Ars. So how does the advertiser in the 21st century "reach" the people likely to be interested in new offerings about their particular experitise? And especially how do they do that when the existing mechanism, site advertising networks, has been burned to the ground by abusive ad networks? Do they hire consultants to find and make agreements with the 10 sites they want to "sponsor" for the roll out of Product X ?

I don't worry about finding content, but I do wonder how folks who have something cool will reach me.

MBCook2• 11 years ago

Google and the Berkeley researchers found that ad injectors are now available on all major platforms and browsers.

Bull. iOS is a HUGE chunk of web browsing and its immune from this stuff unless you jailbreak or are conned into installing a root cert and VPN.

You can't just download an app from the store or visit a site and find it installed like you can on a desktop.

kkamperschroer2• 11 years ago

I'm a Chrome extension author and I've been contacted at least a half-dozen times by shady companies that want me to add some "totally unobtrusive" ad-injection javascript into my extension.

I've been told I could make $0.50/user based in the US per month. That would be a nice raise, for sure, but I'm not the type of person willing to sell out my users to make a little extra dough. Plus I am a user of my own extension, and I don't want ad-injection. And how long could one possibly retain users once you start injecting ads? Probably a steady decline until your left with the users that don't know where the ads are coming from.

Selfish plug to my extension here: https://chrome.google.com/webstore/detail/musicality-music-p...

timedump• 11 years ago

I know this isn't the place or time, but I got your extension and I would like to request that the archive.org music player be added to it. I do not know how to contact you through your site or send a pm through here or github.

kkamperschroer2• 11 years ago

Thanks. I'll add it to my backlog!

pdkl95• 11 years ago

How is this not simple vandalism? Throw the people responsible in jail.

If they are outside the country, freeze their american bank accounts <i>and</i> the bank accounts of any business that advertises with these injected ads. Precedent: we already have laws that, for better or worse, require hardware stores to perform age checks when someone buy spray paint.

This isn't primarily a software problem. This is a problem because nobody is enforcing vandalism laws which encourages the adoption of "vandalism as a business model".

jfroma• 11 years ago

I see ad injectors installed on all my friends and family computers.

I think people has developed some kind of ad-blindness.

I remember a friend using facebook and some crazy and animated ads were taking 80% of his screen, I asked him "doesn't this bother you?" , he says "meh".

Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

Related Stories