6 ms·
Widespread XSS Vulnerabilities in Ad Network Code
- dexwiz 11y agoIs there anything that could fix this? Off the top of my head, browsers could encode the results of any functions that get the URL. But after encoding/decoding requests/responses and unknown server logic, the encoding may be removed.
- chatmasta 11y agoAd blockers would fix it. Outside of that, ad companies hiring competent devs would fix it. But I suspect they're moving too fast and breaking too many things to worry about trivial matters like XSS scripting vulnerabilities. As a site owner, not embedding third party ads on your site would fix it. Then you only need to worry about your own code.
- mirimir 11y agoAdBlock and NoScript stops http://foo.bar/#1'-alert(1)-'"-alert(1)-" http://foo.bar/#1'-alert(1)-'"-alert(1)-" on every site that I've tested :)
- toast0 11y agoIf you do ad placements with iframes, that can mitigate some vectors, but then it is very hard to have full screen takeovers or many other hideous things that seem to make advertisers happy.
- pki 11y agohtml5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others.
- aikah 11y ago> html5-sandbox or iframe will have you terminated from adsense, at least. don't know about the others. Really? what's the justification for that policy? You'd think ad networks would want ads to be safe for users.
- AkariTakai 11y agoProbably cross-domain abuse. I'd imagine there's a few edge cases that result in behavior Google doesn't want for ads. For example, double serving, accidental clicks, ad obscuring, etc. Their FAQ does mention that they'll grant exceptions though.
- annnnd 11y agoFor a site owner, using properly configured Content Security Policy somewhat mitigates the risk... depends on what you can close down though, some pages have just too many functionalities.
- inian 11y agoWe conducted a similar experiment on the top 1000 websites and found 820 unique DOM-Based XSS vulnerabilities in these sites! You can find out more about our techniques in our paper here http://www.comp.nus.edu.sg/~enricob/2015/fse15-main.pdf http://www.comp.nus.edu.sg/~enricob/2015/fse15-main.pdf
- baby 11y agoSo basically the top 1000 (alexa?) is completely broken and insecure?
- inian 11y agoyup pretty much. We managed to report and fix some bugs though. But it is pretty hard to get the point of contact person for some websites.
- devopsproject 11y agoDo tools like ublock and adblock protect end users?
- rurounijones 11y agoMore requests to more code by more parties inherently increases attack surface area. As a user why should I allow this for something that provides me no value (ads, tracking, js comment systems that I dont care about etc). I can see why some people use noscript religiously and whitelist when needed
- baby 11y agoYup. Too bad using noscript breaks the web though. An Adblocker will do for now...
- mirimir 11y agoNoScript doesn't break the Web. It's usually enough to allow first-party scripts, plus scripts as needed for content.
- baby 11y agoReally? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try.
- aikah 11y ago> Really? I had a feeling everything is javascript heavy these days. Especially with React, angular, backbone, meteor... Maybe I should give it another try. The point is to white list scripting on websites . It allows faster browsing, lessens CPU load and memory consumption and save battery life on mobile and laptop. Most websites do not need javascript to be turned on to be browsed.
- baby 11y agoI just did it. And woosh browsing is fast, I had forgotten that part. But then I remembered why I uninstalled it. On every site I visit I have to go through the list of scripts to allow until I can browse correctly.
- beedogs 11y agoAs if I needed another reason to block javascript and advertising.
- gcb0 11y agowon't affect Yahoo.com, even they show ads from that network, because it is one of the few publishers using http://www.iab.com/guidelines/safeframe/ http://www.iab.com/guidelines/safeframe/
- pdkl95 11y agoDouglas Crockford warned[1] us many years ago that mixing Javascript from multiple sources was fundamentally unsafe. The security model of the Javascript and the DOM was never designed for isolation within a page. If you're including Javascript from a foreign domain in the page, you're giving them access to any data in the page (and allowing stuff like this XSS problem). In most cases, this is irresponsible. [1] https://www.youtube.com/watch?v=qfBL2sc2zUU https://www.youtube.com/watch?v=qfBL2sc2zUU (re: Google Gears stuff in that talk - remember when the talk was given)
- manigandham 11y agoUnfortunately - this is because the ad industry has way too many vendors (almost 0 effort required to get some shady network off the ground trafficking in bad ads) with sloppy code and bad tech. Similar to many other industries that operate without many standards or QA/enforcement.