4 ms·

Why the hell are YouTube ads allowed to run 3rd party javascript, and since when?? That's the biggest question not answered by Google. Why wasn't there a big o

Why the hell are YouTube ads allowed to run 3rd party javascript, and since when?? That's the biggest question not answered by Google. Why wasn't there a big outcry when this became possible? They can do all sorts of shit, not just mine crypto. This used to be the single biggest thing not to do. The possibility of running 3rd party Javascript in Google's ad networks used to be one of the biggest nightmare scenarios if it got exploited, but the article (or the Google rep) doesn't mention anything about an exploit, it's as if 3rd party javascript running on their ad network is expected behaviour, just the fact that it's running a crypto miner isn't?! There's no way in hell I am ever going to not block Google's ads after this. "Youtubers" and "Content Creators" can cry all they want over whitelisting their channel or site in particular because of all the hard work etc, but not if they want me to run a hostile ad network's code.

deleted 9y ago
[deleted]
stinky613 9y ago
Google has served malicious ads at least as far back as last spring: https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_fullscreen_scam_sites_have_started/ https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_full... https://news.ycombinator.com/item?id=14140756 https://news.ycombinator.com/item?id=14140756
- tripzilch 9y ago
  Cool, thanks :) But I'm actually even more interested since when Google started allowing 3rd party javascript, because the moment when it first got exploited maliciously was just a matter of time. I mean I seriously want to read Google's announcement of this "feature", because I'm honestly scratching my head "wtf were they thinking??". Just so I got this right: You can buy a particular type of ads on Google's ad-platform, that will appear on sites and things depending on your target criteria. AFAIK you used to be able control these aspects of the ad: The text shown if it's a text ad, a picture if it's a banner ad, where the ad should link to, and probably a few cosmetic details. Any tracking cookies and analysis would be done either by generic Google Ads javascript (the results of which you can query in your Ads dashboard/control panel) and by whatever additional tracking javascript you set up yourself on the destination site the ad links to. But apparently, at some point, advertisers got the ability to run their own (3rd party) javascript that will get executed on any site that displays your ad. I'm assuming they use a clever subdomain/iframe trick so that the security context of the JS is just that one domain and doesn't UXSS the world. And sure let's assume this is perfectly watertight. If it wasn't we would be talking about worse stuff than crypto-miners. Then still this script is apparently not prohibited from doing whatever calculations (for mining or whatever), accessing whichever browser fingerprinting variables, mouse tracking and whatnot, you can load and execute remote scripts based on this fingerprinting and easily sidestep any of Google's scrutiny whether your script is up to no good. Not that they do this "because it doesn't scale", but it would be useless any way. And then, this script is able to ex-filtrate all this tracking or mining data. I'm aware that disallowing these abilities strictly and securely is just not really possible in JS, there's too many strange ways to access objects and functions, weird tricks, etc. Did I get this right so far? Because I'm really a bit with my jaw on the floor, how the hell did they approve this and not realize it's a landmine? I'm nearly certain that it must be possible to do other nasty tricks besides consuming 80% CPU for inefficient crypto-mining. If it's that many people (by now let's call them zombie nodes or a botnet, which is what Google Ads apparently gives you) all running your code, you can also use them to DDoS a site. But if you're just a dick, you can also attack the people themselves. Most browsers have the cross-domain security down tight, but nearly all of them have multiple "vulnerabilities" that DoS the browser itself, make it unresponsive, make it crash (yeah multiple tabs, even if they have their own threads) or even make the whole system (yeah outside the browser) unstable, unresponsive or crashy. Maybe not your tweaked/bolted down Linux system, but the average user's mildly clogged up Win10, easy. Can these scripts also track and log keypresses or is that somehow separated because of cross-domain / iframe protection? (it's been a while since I got real deep into JS security) Because that would be a vulnerability. So. Many. Possibilities. For. Fuckery.

deleted 9y ago

[deleted]

stinky613 9y ago

Google has served malicious ads at least as far back as last spring: https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_fullscreen_scam_sites_have_started/ https://www.reddit.com/r/sysadmin/comments/6rm5ig/alert_full... https://news.ycombinator.com/item?id=14140756 https://news.ycombinator.com/item?id=14140756

tripzilch 9y ago
Cool, thanks :) But I'm actually even more interested since when Google started allowing 3rd party javascript, because the moment when it first got exploited maliciously was just a matter of time. I mean I seriously want to read Google's announcement of this "feature", because I'm honestly scratching my head "wtf were they thinking??". Just so I got this right: You can buy a particular type of ads on Google's ad-platform, that will appear on sites and things depending on your target criteria. AFAIK you used to be able control these aspects of the ad: The text shown if it's a text ad, a picture if it's a banner ad, where the ad should link to, and probably a few cosmetic details. Any tracking cookies and analysis would be done either by generic Google Ads javascript (the results of which you can query in your Ads dashboard/control panel) and by whatever additional tracking javascript you set up yourself on the destination site the ad links to. But apparently, at some point, advertisers got the ability to run their own (3rd party) javascript that will get executed on any site that displays your ad. I'm assuming they use a clever subdomain/iframe trick so that the security context of the JS is just that one domain and doesn't UXSS the world. And sure let's assume this is perfectly watertight. If it wasn't we would be talking about worse stuff than crypto-miners. Then still this script is apparently not prohibited from doing whatever calculations (for mining or whatever), accessing whichever browser fingerprinting variables, mouse tracking and whatnot, you can load and execute remote scripts based on this fingerprinting and easily sidestep any of Google's scrutiny whether your script is up to no good. Not that they do this "because it doesn't scale", but it would be useless any way. And then, this script is able to ex-filtrate all this tracking or mining data. I'm aware that disallowing these abilities strictly and securely is just not really possible in JS, there's too many strange ways to access objects and functions, weird tricks, etc. Did I get this right so far? Because I'm really a bit with my jaw on the floor, how the hell did they approve this and not realize it's a landmine? I'm nearly certain that it must be possible to do other nasty tricks besides consuming 80% CPU for inefficient crypto-mining. If it's that many people (by now let's call them zombie nodes or a botnet, which is what Google Ads apparently gives you) all running your code, you can also use them to DDoS a site. But if you're just a dick, you can also attack the people themselves. Most browsers have the cross-domain security down tight, but nearly all of them have multiple "vulnerabilities" that DoS the browser itself, make it unresponsive, make it crash (yeah multiple tabs, even if they have their own threads) or even make the whole system (yeah outside the browser) unstable, unresponsive or crashy. Maybe not your tweaked/bolted down Linux system, but the average user's mildly clogged up Win10, easy. Can these scripts also track and log keypresses or is that somehow separated because of cross-domain / iframe protection? (it's been a while since I got real deep into JS security) Because that would be a vulnerability. So. Many. Possibilities. For. Fuckery.