3 ms·

>I propose heuristically scanning for query and path parameters of ad URLs with high entropy and using those as keys (fingerprints). >https://rr6—sn-uxa0n-t8gz

>I propose heuristically scanning for query and path parameters of ad URLs with high entropy and using those as keys (fingerprints). >https://rr6—sn-uxa0n-t8gz.googlevideo.com/initplayback?source=youtube https://xn--rr6sn-uxa0n-t8gz-vg6i.googlevideo.com/initplayba... &orc=1&oeis=1&c=IOS&oss=1&oda=1&oad=5500&ovd=5500&oaad=11000&oavd=11000 &ocs=700&oputc=1&oses=1&ofpcc=1&osbr=1&osnz=1&msp=1&odeak=1&odepv=1 &osfc=1&id=58cc678216d6aaca&ip=121.35.98.26&initcwndbps=2125000 &mt=1640373902 This is one of the many things that make it _exactly_ like malware. Ads are delivered the same way malicious code or artifacts would be delivered to your device. Weird-ass random subdomains, obfuscated query params -- no legitimate service that works for the user's benefit should behave like this.

thrdbndndn 3y ago
>_exactly_ like malware But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.
- redrove 3y ago
  Which is besides the point and a minor nitpick at best. The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.
  - thrdbndndn 3y ago
    Discovering what exactly? To bad they don't use a subdomain called "adplayback" I guess, but the query parameters are obviously only useful for YouTube internal, not the users. And I won't even call them "obfuscated" -- it's just a batch of switches and plain IP and ID hash.
- BLKNSLVR 3y ago
  But it's googlevideo.com, how could it be a video of some shyster pimping get-rich-quick investment schemes that are convincing enough to appear totally legit to anyone below the half-way point of the bell curve? But it's a google ad, how could it link to a scam that looks exactly like my bank's website?
  - thrdbndndn 3y ago
    We're talking about why this URL does not look like malware. The content of the video itself is irrelevant.
userbinator 3y ago
Back when YouTube wasn't owned by Google, replacing /watch?v=... with /get_video?video_id=... in the URL would immediately give you the video file (in FLV format, of course.)
- redrove 3y ago
  There was also a relatively brief time when YT was owned by google but ads were delivered from a separate (sub)domain so DNS adblocking would work wonders. Those days are gone as the distinction between ads and malware becomes a technicality.
veavo 3y ago
[flagged]
- redrove 3y ago
  Yes, I evidently compared the obfuscation techniques to malicious actors because I know nothing about computers!
deleted 3y ago
[deleted]

thrdbndndn 3y ago

>_exactly_ like malware But it's googlevideo.com. I know this is Google/YouTube's domain so the rest doesn't matter.

redrove 3y ago
Which is besides the point and a minor nitpick at best. The fact of the matter is these techniques are well established black hat ways of preventing the user from discovering what you're doing on their device.
- thrdbndndn 3y ago
  Discovering what exactly? To bad they don't use a subdomain called "adplayback" I guess, but the query parameters are obviously only useful for YouTube internal, not the users. And I won't even call them "obfuscated" -- it's just a batch of switches and plain IP and ID hash.
BLKNSLVR 3y ago
But it's googlevideo.com, how could it be a video of some shyster pimping get-rich-quick investment schemes that are convincing enough to appear totally legit to anyone below the half-way point of the bell curve? But it's a google ad, how could it link to a scam that looks exactly like my bank's website?
- thrdbndndn 3y ago
  We're talking about why this URL does not look like malware. The content of the video itself is irrelevant.

userbinator 3y ago

Back when YouTube wasn't owned by Google, replacing /watch?v=... with /get_video?video_id=... in the URL would immediately give you the video file (in FLV format, of course.)

redrove 3y ago
There was also a relatively brief time when YT was owned by google but ads were delivered from a separate (sub)domain so DNS adblocking would work wonders. Those days are gone as the distinction between ads and malware becomes a technicality.

veavo 3y ago

[flagged]

redrove 3y ago
Yes, I evidently compared the obfuscation techniques to malicious actors because I know nothing about computers!

deleted 3y ago

[deleted]