5 ms·

Reviewers are probably taught what to look out for. In this case, training is the vulnerability.

by zamalek 10y ago

alkonaut 10y ago
You mean people at the ad-networks, reviewing the code that advertisers want to use? Seems like a single occurrence of "eval" should both fail that automatic review AND be blocked by default in all browsers using default security settings. I think this just shows that ad networks shouldn't be using js at all. Just dumb images. (Yes I know, no tracking then which makes it useless yada yada - deal with it)
- zamalek 10y ago
  > Seems like a single occurrence of "eval" should both fail that automatic review You're not wrong, but there are difficult customers with money to consider.
  - alkonaut 10y ago
    > You're not wrong, but there are difficult customers with money to consider. In google's case I can see the conflict - they both make a browser and live off ads. But apart from that minor issue I don't see why browser vendors don't just block "eval()"? (Also, they have started blocking flash, thank god - so maybe this will all be a thing of the past soon)
- bluesign 10y ago
  Not only tracking, also fraud prevention (which they cannot actually 'deal without it')
  - alkonaut 10y ago
    If the ads are dumb enough (i.e. you don't count impressions/clicks/conversions etc) then there is also very little room for fraud. My point is: online ads should become what bus stop ads have always been. You buy a space and display a dumb image. Did it work? You have to do your own A/B testing in half the city. What was it worth? You have to trust those you buy ad space from on how many people read their paper or pass by their bus stop.
- penguat 10y ago
  Who said anything about including the word "eval"? Javascript is really rather bad for allowing surprising things: eval is possible in just 6 innocuous-looking characters - see http://www.jsfuck.com http://www.jsfuck.com
  - alkonaut 10y ago
    Wth is that? How does it work? How does the token become 'eval'? Could this sonehow be blocked in browsers?
    - detaro 10y ago
      Weird type conversion rules in JS, see the examples at the bottom of the page and the linked source.
      - alkonaut 10y ago
        Yeah I saw them but didn't quite understand the ones at the bottom e.g."eval". I get the weird type conversions at the top, not how they magically become function calls at the bottom. Edit: Wikipedia article explains - you can call functions by name with that "filter" thing. This should be pretty easily blockable though - if you block "eval" then just block most of the obscure jsfuck constructs too.
        ninju 10y ago
        the jsfuck.js parses the obfuscated string to generate valid javascript code. One one the patterns that jsfuck.js supports is "run the followin as eval()" https://github.com/aemkei/jsfuck/blob/master/jsfuck.js https://github.com/aemkei/jsfuck/blob/master/jsfuck.js line 282

Reviewers are probably taught what to look out for. In this case, training is the vulnerability.

by zamalek 10y ago

Reviewers are probably taught what to look out for. In this case, training is the vulnerability.

You mean people at the ad-networks, reviewing the code that advertisers want to use? Seems like a single occurrence of "eval" should both fail that automatic review AND be blocked by default in all browsers using default security settings. I think this just shows that ad networks shouldn't be using js at all. Just dumb images. (Yes I know, no tracking then which makes it useless yada yada - deal with it)

zamalek 10y ago
> Seems like a single occurrence of "eval" should both fail that automatic review You're not wrong, but there are difficult customers with money to consider.
- alkonaut 10y ago
  > You're not wrong, but there are difficult customers with money to consider. In google's case I can see the conflict - they both make a browser and live off ads. But apart from that minor issue I don't see why browser vendors don't just block "eval()"? (Also, they have started blocking flash, thank god - so maybe this will all be a thing of the past soon)
bluesign 10y ago
Not only tracking, also fraud prevention (which they cannot actually 'deal without it')
- alkonaut 10y ago
  If the ads are dumb enough (i.e. you don't count impressions/clicks/conversions etc) then there is also very little room for fraud. My point is: online ads should become what bus stop ads have always been. You buy a space and display a dumb image. Did it work? You have to do your own A/B testing in half the city. What was it worth? You have to trust those you buy ad space from on how many people read their paper or pass by their bus stop.
penguat 10y ago
Who said anything about including the word "eval"? Javascript is really rather bad for allowing surprising things: eval is possible in just 6 innocuous-looking characters - see http://www.jsfuck.com http://www.jsfuck.com
- alkonaut 10y ago
  Wth is that? How does it work? How does the token become 'eval'? Could this sonehow be blocked in browsers?
  - detaro 10y ago
    Weird type conversion rules in JS, see the examples at the bottom of the page and the linked source.
    - alkonaut 10y ago
      Yeah I saw them but didn't quite understand the ones at the bottom e.g."eval". I get the weird type conversions at the top, not how they magically become function calls at the bottom. Edit: Wikipedia article explains - you can call functions by name with that "filter" thing. This should be pretty easily blockable though - if you block "eval" then just block most of the obscure jsfuck constructs too.
      - ninju 10y ago
        the jsfuck.js parses the obfuscated string to generate valid javascript code. One one the patterns that jsfuck.js supports is "run the followin as eval()" https://github.com/aemkei/jsfuck/blob/master/jsfuck.js https://github.com/aemkei/jsfuck/blob/master/jsfuck.js line 282