5 ms·
Banner ads on CNN.com contain keyloggers
- notadoc 8y agoHere's what is actually being run http://dmauro.github.io/Keypress/ http://dmauro.github.io/Keypress/
- cbcoutinho 8y agoWhy aren't the code snippets in a monospace font? Is there readability ux that thinks this is a good idea?
- wild_preference 8y agoThey are on my screen.
- nsuser3 8y agoThey are in monospace?
- eat_veggies 8y agothey look monospace to me https://i.imgur.com/K5L7xit.png https://i.imgur.com/K5L7xit.png
- 52-6F-62 8y agoSo basically, it's just an event-capturing interface to what you can do natively in the browser already. It doesn't necessarily mean anything is being logged. The code using the library would need to be inspected—whatever callbacks are being fired, etc.
- Mister_Snuggles 8y agoThings like this make me happy that uMatrix exists.
- chaosfox 8y agoindeed ! keypress.js is blocked on the easyprivacy list as well.
- sbinthree 8y agoHow likely is this to be due to accessibility (ie. keyboard-only users) vs. keylogging?
- ruskerdax 8y agoDoesn't seem likely that an advertisement would need to embed that kind of functionality.
- deleted 8y ago[deleted]
- Someone1234 8y agoWhat kind of functionality? This is just a generic library for more easily managing keyboard input, JavaScript itself supports the same but in a more clunky way.
- tjoff 8y agoHow can an add increase accessibility by listening to the keyboard?
- sbinthree 8y agoKeyboard shortcuts instead of onclick handlers. Unless someone is using Vimium there is no way to use a keyboard to navigate the web without explicitly defined keypress handlers.
- tjoff 8y agoHow do you envision this to work in practice? Do I need to read a manual for the ad? Also, the ones that actually are dependant on the keyboard will already use Vimium or something else.
- reilly3000 8y agoWhat could an advertiser good to track with key logging? Password to their... CNN account??
- mipmap04 8y agoA password to an individual's CNN account could easily be their same login to their bank or other more important account.
- giancarlostoro 8y agoPeople can buy ads and place their own JS in them I'm guessing... This might go beyond just CNN.
- notadoc 8y agoMy guess would be to see what people are typing but not submitting, along with what they're searching for, commenting, etc.
- dredmorbius 8y agoCNN staff and contributors could be the target.
- wanderfowl 8y agoDearest Ad Industry, This is why we run ad blockers. Since you won't regulate your industry, we're fixing the problem for you. Love, The Rest of the World.
- Yizahi 8y agoPS: and please burn in hell, asap. Sincerely, Concerned users of the Internet.
- reilly3000 8y agotakers of the internet?
- Crontab 8y agoSites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.
- deleted 8y ago[deleted]
- DmenshunlAnlsis 8y agoChange or not, I think the trend is not to trust ads anymore. I question whether or not it’s feasible in the long term to sustain a model based on tracking people, selling their data, and calling that “advertising.” Oh and if you want to see what CNN is crapping out without the cruft, lite.cnn.io works well.
- stochastic_monk 8y agoSurveillance is not advertising.
- DannyB2 8y agoI can hear them responding with something like: Surveillance is helpful information gathering and customer profiling in order to understand customer needs better. This enables us to put more relevant ads in front of your eyes. It also helps us to understand when is most convenient to sneak in the middle of the night and harvest your and your family's vital organs, as permitted by the service agreement you signed.
- SpaceGorilla 8y agoRight? Imagine IRL advertising that would break into your house and put up advertising posters or plant listening devices.
- smudgymcscmudge 8y agoI don’t think I would like that at all.
- lifeformed 8y agoThe point stands, but that's not really a keylogger. It's a library to manage keyboard inputs. Of course, it could also send all key info somewhere externally too.
- wanderfowl 8y agoBut in what universe would an individual ad need that? This seems like precisely the sort of thing that a third party ad would be prevented from doing.
- ErikHuisman 8y agoKeypress.js doesn't really help creating a keylogger. It does make creating interactive ads easier though.
- isostatic 8y agoThe 90s called and wants "punch the monkey" back
- mmcwilliams 8y agoIt appears to be getting the keypress.js library from ssl.cdn.turner.com. Not clear if the data is being exfiltrated, though, just by looking at that tweet.
- trash_panda 8y agoExactly it is incorrect to jump to the conlusion that they are using a keylogger. I mean, they're loading a JS library that allows to handle keypress events; but if you talk about a keylogger everyone assumes that they're stealing your keystrokes. What needs to be done is to navigate the site and typing a given char sequence on every page while logging the HTTP traffic, then do a search for that sequence to see if it appears in any request. That's the basic thing you could do to actually verify if there is a keylogger.
- roscoebeezie 8y agoI’ve noticed CNN has had a crap ton of redirect ads recently...
- reilly3000 8y agoThey come in waves and go away when ad exchanges figure out how to block them. It isn't usually tied to a single publisher, as they are bought and sold across ad exchanges that reach most of the ad funded web. They are extremely difficult for even manual reviewers to spot and reproduce, so the whole industry works to stop them together. Then new ones pop up.
- snissn 8y agoI'm skeptical that this is a) from a banner ad and not from operation of the site b) a full blown keylogger and not a library included that is used for something like a photo gallery (that may have ads in it)
- jpalomaki 8y agoAlso, the file is served from turner.com domain, which is the company who owns CNN.
- nvr219 8y agoThis is getting upvoted without getting the context.
- ryanlol 8y ago>ssl.cdn.turner.com Obviously bullshit. That's CNNs CDN, not a "banner ad". This guy did not put in the least bit of effort to verify his claims. The script is included in https://edition.cnn.com/.a/2.103.4/js/cnn-header-second.min.js https://edition.cnn.com/.a/2.103.4/js/cnn-header-second.min....
- neetdavid 8y agoIt appears to be used to set up multi-key hotkeys for debugging. Pressing 'd o h' on the page requests some adfuel console resources.
- cirenehc 8y agoScripts from the ad should be iframed no? Doesn't make sense that an ad could run arbitrary JS within the same browsing context as the host.
- tialaramex 8y agoIt doesn't make any sense, but it's very popular. To be fair, when they're desperate real world newspapers are like this too. A flush successful newspaper will make a deal of its editorial independence and insist you write "Advertising Feature" in big letters at the top of your full page ad, use a completely different typeface and give your company's name, but when money is tight the guy selling those adverts is under pressure to compromise. What if it says "Sponsored content" rather than "Advertising Feature"? And rather than big letters at the top, how about small disclosure text at the bottom? The typeface could be a very good clone of your normal editorial typeface, and still count as "different" right? And lets have a byline which says "Our staff", that's vague, and the poor reader might think it means it was written by journalists, but it doesn't strictly _say_ that, it just says "Staff" which could be anybody... This is how internationally famous British newspapers end up running content literally written in Beijing or Moscow to let everybody know how free and wonderful those countries are, using weasel words like "in co-operation with". And if the _actual_ news is a bit awkward? Well, you wouldn't want that lucrative sponsored content deal to lapse would you? Maybe a brief mention on page 14 is enough, even if those newspapers which still have a backbone ran it on their front page.
- DannyB2 8y agoIt's not CNN. It's ads. Advertising has ruined every medium it has ever touched. It will ruin the web. It is only a matter of time. It did not destroy ancient network television overnight. It did not destroy cable tv overnight. The last time I saw cable tv a few years back, it had become so bad that after a long run of ads, they would then put bugs and walk on people right over the content of the show you were watching. Sometimes obscuring important content within that show.
- imglorp 8y agoWhich is why NF is so successful and cable is bleeding from the arteries. Consumers want to choose their device, on their schedule, without tampering with the content, and they want good and timely selection of content. They will pay well for this.
- Proven 8y agoFirst fake news, now fake ads...
- thaumaturgy 8y agoLots of speculation here, not much analysis, even from lazy gits like me. Chrome web inspector kindly gives the "Initiator" for every request. In this case it's cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it. The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at https://pastebin.com/EwgPAM6T https://pastebin.com/EwgPAM6T It's a bit obfuscated/minified, and they don't seem to have a non-minified version available, so it's not clear exactly what functionality this is enabling. Either way, not really a keylogger if it's not capturing all keystrokes and shipping them off somewhere.
- corny 8y agoFunctionality is to enable an "AdFuel Creative Review" form when typing "d o h" anywhere on the page. Try it. Then click the blue icon in the lower right.
- reilly3000 8y agoThe tool is for reviewing bad ads and ad stack QA.
- thrownaway954 8y agoas someone who claims they are a programmer and researcher... you would think they would have done some more research on this and also have common sense to know that this isn't a keylogger.
- mabufo 8y agocross domain script blocking should be enforceable in all browsers
- climber604 8y agoThis is a prime example of how people so easily accept a headline shared on some news authority to be truth. Even the bright minds at hacker news are duped - just look at all the discussion happening here with the assumption the headline is correct. The guy who tweeted this jumped to a conclusion, naively shared his discovery, then let it perpetuate leaving numerous victims of an erroneously altered world-view.
- NotQuantum 8y agoI seriously think people shouldn't be able to comment / see comments on HN unless they've at least clicked on the darn link. I took one look at the "keylogger" source code and recognized it.
- LinuxBender 8y agoI would suggest their "lite" [1] version. It is compatible with addons like NoScript, uMatrix, uBlock, Canvas Fingerprint Defender, CSS Exfil Protection, Privacy Settings and Self Destructing Cookies. I am using FF 52 ESR. Some of these addons may not work in 58+. They could improve their HTTP header settings a bit. [2] [1] - https://lite.cnn.io/ https://lite.cnn.io/ [2] - https://securityheaders.com/?q=https%3A%2F%2Fcnn.com%2F&followRedirects=on https://securityheaders.com/?q=https%3A%2F%2Fcnn.com%2F&foll...
- stickfigure 8y agoCNN, like the vast majority of news sites, is best viewed with javascript disabled. Pages load 10X faster, scrolling is not jumpy, the CPU doesn't go crazy, and text reads just as well. It is hands down a much improved user experience.
- dahart 8y agoIframed banner ads can’t log keystrokes outside their frame, browsers don’t allow that. And no site in their right mind would include ads that aren’t iframed. A keylogger would be possible if there was some kind of zero day exploit, but this isn’t that, it sound like the tweeter didn’t do their due diligence. I’m curious how someone gets as far as looking through the minified JavaScript without knowing the browser doesn’t allow that, obviously(?), otherwise all your passwords and information would have been compromised long ago.
- snopes_ads 8y agopress shift-control-z on cnn.com and you will get what this supposed keylogger is (hint - its not a keylogger or comgin from an ad) but merely a cnn internal tool..