5 ms·

> This is likely a script that somehow avoided google's malware scanning pipelines. I can't think of a good reason for scripts through google ad syndication to

> This is likely a script that somehow avoided google's malware scanning pipelines. I can't think of a good reason for scripts through google ad syndication to be asking for camera and microphone permissions. I'd assume Google runs these scripts in something like a lab environment to see what's ultimately invoked before deploying them to production? If so, would this be indicative of both a deliberate controls bypass and a ToS violation by the ad network? Sounds like Google Syndication may have taken care of this by enabling Permissions Policies(1) across its domains? I can't tell because the article references Feature Policy (a predecessor to Permissions Policies(2)) "in Safari" even though Feature and Permissions Policies, as best as I understand them, are delivered from the origin for implementation by the browser. So I'm kinda confused. And if they don't implement it, it tells me they're totally fine with this kind of fingerprinting. (1)https://developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Po... (2)https://www.w3.org/TR/permissions-policy-1/ https://www.w3.org/TR/permissions-policy-1/ --- A prior version of this comment suggested Google should add permissions policies. I since edited it to clarify that I'm quite confused over whether it's something Google already implemented or something Safari overlaid on top of Google syndication origins since I can't verify using the origins themselves. The article seems to suggest it's something Safari specific even though the spec for both FP and PP involves receiving a set of permissions from the origin as a header and implementing them in the browser.

soared 5y ago
Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this. See vendors like “the media trust”
- VRay 5y ago
  Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code
  - teej 5y ago
    It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-exploit-kit-hides-malvertising-code-in-image-pixels/ https://www.bleepingcomputer.com/news/security/new-stegano-e...
    - tgsovlerkhgsel 5y ago
      This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.
      - cpeterso 5y ago
        Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.
    - boomlinde 5y ago
      Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other. The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.
      - VRay 5y ago
        haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be
tehlike 5y ago
"In a lab environment" -> Certainly happens, but what if the script targets "specific devices" like "samsung galaxy s10" which google won't be able list exhaustively? What if bad actors figured out a way to identify google's emulators and avoid doing bad stuff in that situation? The part i said "google develops browser solutions to prevent issues like this" is exactly what features policy will end up doing. But google's ad systems and chrome features don't always move at the same speed, but you can be sure that whatever ad malware team is finding will help chrome team to strengthen their defense.
- d0gbread 5y ago
  I thought they meant more like sandbox environment. Why would the API to access those things exist at all?
  - tehlike 5y ago
    Sandbox is provided through things like ContentSecurityPolicy and Feature Policies. See my comment on this.
  - jimbojet 5y ago
    The API exists because zoom.com request microphone and camera through an iframe is a legit use case. As OP said below CSPs exist so that enterprises can lock down those vulnerabilities. But wouldn’t make sense to lock it down for all consumers.
tinus_hn 5y ago
Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments. The script could just detect the test environment and avoid triggering its malicious behavior.
- charcircuit 5y ago
  >Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments. No, it just means that it is impossible to do for every program. Google could just make it reject scripts it is unable to handle.
jimbojet 5y ago
Malicious script can (1) fingerprint and detect lab machines and therefore not do bad thing — this is arbitrarily easy if Google test lab is the first to ever execute their script, (2) over time build a graph of IPs, geos, test machine characteristics that essentially allow them to avoid the world’s entire test lab infrastructure (there’s only a fixed number of test lab providers in the world since it’s so expensive to set up this infrastructure), (3) yes, bypassing testing like this is a violation of ToS, but that is fairly meaningless as entities and IPs are cheap to incorporate, (4) not sure what you’re saying about permission policies across its domains? Google does have such policies unless I’m missing something.

soared 5y ago

Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this. See vendors like “the media trust”

VRay 5y ago
Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code
- teej 5y ago
  It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-exploit-kit-hides-malvertising-code-in-image-pixels/ https://www.bleepingcomputer.com/news/security/new-stegano-e...
  - tgsovlerkhgsel 5y ago
    This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.
    - cpeterso 5y ago
      Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.
  - boomlinde 5y ago
    Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other. The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.
    - VRay 5y ago
      haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be

tehlike 5y ago

"In a lab environment" -> Certainly happens, but what if the script targets "specific devices" like "samsung galaxy s10" which google won't be able list exhaustively? What if bad actors figured out a way to identify google's emulators and avoid doing bad stuff in that situation? The part i said "google develops browser solutions to prevent issues like this" is exactly what features policy will end up doing. But google's ad systems and chrome features don't always move at the same speed, but you can be sure that whatever ad malware team is finding will help chrome team to strengthen their defense.

d0gbread 5y ago
I thought they meant more like sandbox environment. Why would the API to access those things exist at all?
- tehlike 5y ago
  Sandbox is provided through things like ContentSecurityPolicy and Feature Policies. See my comment on this.
- jimbojet 5y ago
  The API exists because zoom.com request microphone and camera through an iframe is a legit use case. As OP said below CSPs exist so that enterprises can lock down those vulnerabilities. But wouldn’t make sense to lock it down for all consumers.

tinus_hn 5y ago

Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments. The script could just detect the test environment and avoid triggering its malicious behavior.

charcircuit 5y ago
>Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments. No, it just means that it is impossible to do for every program. Google could just make it reject scripts it is unable to handle.

jimbojet 5y ago

Malicious script can (1) fingerprint and detect lab machines and therefore not do bad thing — this is arbitrarily easy if Google test lab is the first to ever execute their script, (2) over time build a graph of IPs, geos, test machine characteristics that essentially allow them to avoid the world’s entire test lab infrastructure (there’s only a fixed number of test lab providers in the world since it’s so expensive to set up this infrastructure), (3) yes, bypassing testing like this is a violation of ToS, but that is fairly meaningless as entities and IPs are cheap to incorporate, (4) not sure what you’re saying about permission policies across its domains? Google does have such policies unless I’m missing something.