7 ms·

A dark adtech empire fed by fake CAPTCHAs

235 points by todsacerdoti 1y ago

preinheimer 1y ago
I think the “prove you’re human by hitting the button” attack is pretty clever. With the range of different ways captchas are presented today I can see it getting a good % of folks.
- a2128 1y ago
  It's our own fault for making the internet such a confusing Kafkaesque maze. Click this button, click that button, sign in to confirm you're not a bot, select the traffic signs, select the items that a rat would not eat, solve this maze to prove you're a human, type out the numbers hidden in these demonic noises, provide your phone number to prove you're real, compute proof-of-work, download this browser if you're having issues... The line between fraudster and modern tech company is honestly not clear anymore and especially not for people who don't care much about tech and just want to access something
  - pixl97 1y ago
    Evolution is messy and guided by random occurrences. Early in the internet days I had ran an open SMTP server for a few years before it was used as a spam relay. The web browser didn't have a security model. Online shopping was going up to a site, writing what you wanted on paper, then mailing off a money order. Then both fraud and useful things like actual online shopping started happening while the size of the web exploded. Masses of people with no technical capability were getting online. And that's before we got to the age of social media and massive data collection. Simply put we didn't make the 'web' part of the internet, some people tossed it out as a child and it's been a tooth and nail fight for survival ever since, patching itself up one vuln at a time.
    - permo-w 1y ago
      never mind the fact that half these captchas are just excuses for orgs to sneakily extract some reinforcement learning data from you. last time I tried to sign into my microsoft account it made me do 6 captchas. SIX. not six like I failed 1 captcha six times, six like each captcha was iteratively marked i/6
      - pixl97 1y ago
        Most of the time you get captcha failures like that it's because you're also doing things that are good for your security like blocking all kinds of 3rd party bullshit. I've had to do things like turn off adblock on a page to get past the captcha before turning it back on.
        permo-w 1y ago
        it wasn't a failure, but I do see what you're saying
  - Mtinie 1y ago
    …but don’t click this button.
  - tsunamifury 1y ago
    [flagged]
    - pwdisswordfishz 1y ago
      Yes, you can. You would be wrong, though.
      - tsunamifury 1y ago
        [flagged]
    - dspillett 1y ago
      Nope. We can blame companies for deliberately implementing the requirements in the most inconvenient (and usually actually non-compliant) way possible, to make it an unpleasant process to disagree, and all too easy to accidentally agree, to being stalked by hundreds of "partners".
    - lionkor 1y ago
      Malicious compliance is usually intentional, yk?
    - yard2010 1y ago
      You can blame anyone, really, but try to think about it this way: when a 5-years old child drives a car into a wall, you don't blame him, you blame the responsible adult in the passenger sit that says: "it's fine, go ahead, drive this car".
    - sensanaty 1y ago
      Or we can blame the literal scammers and other degenerates that lead businesses and have forced jurisdictions like the EU to implement these? We've JUST unearthed yet another scandal from Meta, where they've been, surprise surprise, spying on people on Android. Cambridge Analytica, Yemen and countless other examples, all from this 1 company. And we're blaming the EU for trying to do anything against them, and not scumbags like Zuckerberg?
  - miki123211 1y ago
    It's not just the captchas either, the "this GPS app needs access to your location" or "this photo taking app wants access to your camera" style pop-ups don't help either. If you learn once that clicking "deny" in a notification pop-up means your phone doesn't ring when your grandson calls you on Whats App, you won't be clicking "Deny" in those pop ups any more. I genuinely don't know how to solve that problem, and I definitely see non-technical family members struggle with it.
    - Sophira 1y ago
      The silly thing is, it was known before all these permission pop-ups were created that users will simply press "Yes", "OK", "Allow", "Agree", etc., on every dialogue they see simply in order to get rid of it. Many people -maybe even most people? - just see them as needlessly getting in the way of where they actually want to be. So, given that we knew that, why the hell did we create more?
      - const_cast 1y ago
        Because there’s no good alternatives IMO. Auto-deny leads to a lot of unexpected and broken behavior, and most users aren’t going to know where to go to enable that type of stuff. But auto-enable is even worse: because malicious actors can get permissions they shouldn’t. In fact, even with mainstream applications, most of the permissions they ask for they don’t need to operate - they’re just used for tracking and data exfiltration. So ask every time has been the solution and it works okay. iOS actually does a good job with this. For suspicious permissions, such as accurate location data all the time, it periodically re-prompts. It’s annoying, but it can catch a lot of suspect behavior. There’s shockingly little apps that need your exact location when the app isn’t open.
LegionMammal978 1y ago
> According to Qurium, TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling "push notifications," a cross-platform browser standard that allows websites to show pop-up messages which appear outside of the browser. An elderly relative of mine was hit by this a couple years back: his computer's desktop was constantly being spammed with messages on startup, and there was no simple way to turn them all off. It turned out that they were all notifications from web workers that he'd inadvertently allowed at some point prior. (I set his browser to auto-deny notifications so it wouldn't happen again.)
- creeble 1y ago
  Elderly neighbor for me. Quite insipid; it took me a few minutes to realize that they were browser-based when I first got to the computer.
- KevinGlass 1y ago
  I honestly think desktop notifications in their current form are one of the worst features of the modern web. Sure it's nice to get an email alert but on my experience there's probably a thousand confused old people getting spammed for each person that intentionally enabled it. What's worse is they look like native OS alerts (on Windows) so when one says "SECURYIRT ALERT!! CALL NOW" it's that much more effective at getting people on the phone with scammers.
  - cortesoft 1y ago
    So many sites ask for permission to send notifications that have zero reason to do so. Why would I want push notifications from a shopping or news site?
    - tim-- 1y ago
      Honestly, push notifications from a news site arguably is one of the few sites that I see having a reason to send push notifications. Communication platforms; messaging apps (Slack, Discord etc); email sites (gmail and co.) also make sense. Financial platforms (banks, Stripe etc) Once you start getting out of these two categories, then yeah, it gets silly. No way should an airline website even be allowed to ask to send push notifications. Google does have a way for Chrome users to not show the notification window (https://yespo.io/blog/google-chrome-will-now-block-abusive-browser-notifications https://yespo.io/blog/google-chrome-will-now-block-abusive-b...) by default (https://support.google.com/webtools/answer/9799829?hl=en https://support.google.com/webtools/answer/9799829?hl=en) but I really wish that this was flipped, so that Google would first need to approve sites to use notifications, similar to the Public Suffix List.
username223 1y ago
> TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling “push notifications,” Why is it even possible for hostile code (i.e. JavaScript) to send OS-level notifications? If clicking a link runs untrusted code with layers of legal insulation, that code should run in a very limited sandbox. It's crazy that we're turning the "Open Web" into an ever-expanding attack surface.
- hakfoo 1y ago
  Because people turned browsers into an app platform and users wanted their webmail and chat services to have the same first-class features native clients had.
  - deleted 1y ago
    [deleted]
  - username223 1y ago
    Who wanted their web browser to let hostile programs send notifications and access battery levels, unused fonts, etc.? Ad companies run the web standards bodies, so "people" (i.e. you and me) have to deal with this.
    - Xevion 1y ago
      In all fairness, some of these things you've mentioned could be useful. If your battery is low, reprioritize the webapp's functions, lower requests, disable anything not necessary in the moment. Notifications are just another convenient thing that me and you use every day. Perhaps these things should be disabled by default, or requested upon being needed, but that's not really your argument it would seem.
      - account42 1y ago
        > In all fairness, some of these things you've mentioned could be useful. If your battery is low, reprioritize the webapp's functions, lower requests, disable anything not necessary in the moment. This kind of automated perfomance tuning is almost always more annoying than useful. > Notifications are just another convenient thing that me and you use every day. Who is "me and you"?
justusthane 1y ago
> Doppelganger campaigns use specialized links that bounce the visitor’s browser through a long series of domains before the fake news content is served What’s the purpose of being bounced across several different domains before arriving at the destination? I’ve noticed this behavior when accidentally clicking on sketchy ads, but never stopped to think about it.
- Mtinie 1y ago
  Multiple impressions per interstitial domain, I imagine.
- out-of-ideas 1y ago
  reminds me of how okta and similar handle logging in. feels like 10thousand redirects later.. training users that behavior is okay
  - Xevion 1y ago
    I despise how my university's login system just redirects several times (sometimes getting stuck, reloading and redirecting multiples times, and then occasionally shitting me out on the logged out screen, wondering WTF happened). I cannot fathom how their IT staff allows things to be that way. One redirect ideally. Two max. Three, and I'm assuming you don't know what you're doing, at all.
    - imp0cat 1y ago
      If only it were that simple. You can thank Apple, Google and their war on cookies for that.
    - immibis 1y ago
      One reason is to set session ID cookies on several different domains.
    - mschuster91 1y ago
      The problem with university login systems - at least here in Germany/Europe - is this global federation system that's also backing EduRoam. Authentication flows there are insanely complex, not to mention dealing with known quirks of some university's implementation...
breslie7 1y ago
[flagged]
breslie7 1y ago
[flagged]
breslie7 1y ago
[flagged]
breslie7 1y ago
[flagged]
breslie7 1y ago
[flagged]
tempodox 1y ago
It never ceases to amaze me how creativity gets ramped up to 11 when it comes to graft, theft and scam.
palmfacehn 1y ago
A clever social engineering approach, but Kreb's trite alarmism overshadows the novelty.
wwn_se 1y ago
Great article but the fix is Adblock! Enable adblock everywhere for your family and friends at risk. Even if an ad sometimes slips through they since its out of the ordinary they are way less likely to click. https://firstpartyornoparty.org/ https://firstpartyornoparty.org/
- deleted 1y ago
  [deleted]
- lionkor 1y ago
  Okay, my family has iPads. What should they use? Brave? lol
  - v5v3 1y ago
    Nextdns/similar. Vpn with ad blocking built in
  - nake89 1y ago
    Yes
  - brettermeier 1y ago
    Tablets not from Apple. That's your fault if you use that shit and can't block ads or install whatever you want.
    - carlosjobim 1y ago
      It's easy for a non technological person to block ads and malicious domains on the system level on all Apple devices.
    - lionkor 1y ago
      They already have an iPhone, a Mac, a MacBook, which tablet would you recommend that integrates just as well? My point is that this is not a realistic option for a lot of people. Adblockers only work for people who have previously valued their freedom.
  - 1y ago
b0a04gl 1y ago
[dead]
thyristan 1y ago
This is, at least for browser notifications, just yet another result of generally atrocious browser UI decisions. There are tons of permissions a site may or may not request, all of them configured and requested in different ways. Sometimes it is a full page overlay, like when you get a certificate error. Sometimes it is a separate popup window, like when you allow using a client certificate. Sometimes it is a whole-width bar below the address bar, like when a page requests becoming your mailto:-scheme-handler. Sometimes it is a smaller popover dangling from the address bar or some icon there, like for camera or location. Sometimes I can allow/deny, sometimes I can allow or just close that tab. Sometimes I can remember the setting, sometimes it is auto-remembered. As soon as the initial setting has been configured, removing or reconfiguring it happens in totally different and unobvious places again. And then, If I allowed something and there is e.g. a notification from a website, the browser hides the fact that this is a browser-based notification, there are no embedded "STFU, never show again" buttons or anything. There also is no simple place to just look at all the permissions some website might have. There also isn't a place for many permissions, where you can get a list of websites that have e.g. camera permissions. It is all just very opaque, non-obvious, historically grown inconsistent spaghetti. What needs to happen is a consistent permission request and change flow for everything a website wants to do. Not only with "allow forever/deny forever", but also with "allow/deny once", "allow/deny for session", "allow/deny for timeframe". And with an "allow to ask again after timeframe/never/..." selection. Not with popups or bars, but with a whole-page overlay like HTTPS does. Why whole-page? Because then clickjacking won't work, there is more space to put an explanation and options, and pages need to interrupt flow so this will hopefully be used sparingly.
tehwebguy 1y ago
Once again grateful that at least one mobile platform doesn’t allow browser push notifications.
HocusLocus 1y ago
I've followed Krebs for years and appreciate this specific warning. I changed my dad's default Windows colors so when he was presented with fake system dialogues floating on web pages he'd spot them as different right away. But the "click allow to prove you're a human" might have caught him. Captcha-annoyed people are slightly easier to fool sometimes. Push wasn't a big thing then or I would have disabled it. Dad was one of those late computer adopters who had to be instructed carefully about things pretending to be other things and and nested windows. I remember when pages spawning new windows (then grabbing focus to hide them) was a thing. Then older folks about to go to bed closing their browsers and greeting the hidden windows like a continuation of their browsing experience. Russia has evolved along with us on the Internet and I'd remind Mr. Krebs paraphrasing Freud, sometimes a Russian oligarch is just a Russian oligarch. It's possible that the Kremlin has hired these companies like everyone else, and a lot of shady people want to penetrate EU DNS defenses. Fake camping sites with AI content whether its disinformation or deception or hallucination with no human proofreading, is a looming problem. Keep an eye on the prize, preventing old people from getting scammed. People need more education in general to spot nefarious content, no matter who the state actor is. We don't want a repeat of the Alfa-Bank scam 'October Surprise' either. It relied on the gullibility of the Internet surfing public but DNS administrators should have seen through it and asked more questions.
- trissi1996 1y ago
  Wtf are "EU DNS defenses"? Never heard about that.
BMaronge 1y ago
The article is a bit vague on some points, for example: the links bounce the visitor through a series of domain names... why exactly? What do the scammers gain by redirecting the visitor multiple times instead of just once? It is not explained.
- coldpie 1y ago
  KrebsOnSecurity is a really weird website. I feel like I should be the perfect audience for it, as a software engineer who is very interested in security and reverse engineering, but every time I try to read their articles it just comes across as paragraphs and paragraphs of overwrought fluff with zero actual content. I guess their audience is someone with less technical knowledge who is impressed by empty phrases like "startling discovery" and "online hucksters and website hackers" and "resilient and incestuous". And that's all just in the first paragraph here. Get to the point, man.
  - arresin 1y ago
    Huh that’s weird I feel the exact same way and should also be the natural audience. Every time I read an article though I feel like my eyes go cross eyed. It’s like you said, the words are there they should make sense, but I find my attention wandering. It’s like they are written by a very very early LLM.
  - cpburns2009 1y ago
    I stopped reading his website after he started spreading disinformation about Ubiquiti.
- hnburnsy 1y ago
  >The article is a bit vague on some points Yeah, it even starts with... "a disinformation network that promotes pro-Russian narratives and infiltrates Europe’s media landscape by pushing fake news through a network of cloned website" But doesn't give any examples of this happening and goes off on tangents like Switzerland, Dating sites, traffic monetization, and Breaking Bad
StuntPope 1y ago
[flagged]
PaulHoule 1y ago
Kinda wish the web had an ability to defend itself. Put CAPTCHAs on your site: zero traffic. EU adds those cookie banners to everything: EU should have been disconnected from the internet.
- lcnPylGDnU4H9OF 1y ago
  > EU adds those cookie banners to everything EU required website operators to disclose certain uses of cookies and many of them chose the most obnoxious way possible. Perhaps more agreeable: every website that uses those banners should be disconnected from the internet.
  - PaulHoule 1y ago
    They coulda said "Respect DNT or go to jail" but instead they broke the ultimate window. For years I advocated, mostly successfully, to keep pop-ups, pop-unders, pop-ins and other abuse like that out of sites I worked on. Then the EU pulls this magic trick that transforms them into something required, and then "wholesome" so after that the dam breaks and it is common for a blog today to pop up three banners that want your email address, for pop-up ads to cover other pop-up ads, etc. When your government is unresponsive like that the only choice is exit, no wonder the EU is overrun by populists that want out. If they don't want Frexit and Sprexit and Grexit they'd better think twice when they make another thoughtless law with terrible consequences.
    - Ylpertnodi 1y ago
      >They coulda said "Respect DNT or go to jail" but instead they broke the ultimate window. You know EU law only applies in the EU? And blockers exist? I always howl with laughter when some bumhole USA newspaper presents me with a cookie banner that got through. Then i change vpn-server, read what i want, and get on with my tawdry existence.
    - lcnPylGDnU4H9OF 1y ago
      > and then "wholesome" What is this referring to? > thoughtless law with terrible consequences Fair enough, I guess. If I understand the point, the EU should not have presumed so much that the law would change behavior for the better. The obvious result is that behavior changed for the worse. For what it's worth, I still personally prefer speaking against those who made their behavior worse to comply with the law when it's so obvious what the lawmakers' intention was; the EU actually had user-friendly intentions and the cookie banners' implementations are the result of user-hostility.
psychoslave 1y ago
>While TDSs are commonly used by legitimate advertising networks to manage traffic from disparate sources and to track who or what is behind each click, VexTrio’s TDS largely manages web traffic from victims of phishing, malware, and social engineering scams. Legal sysops is still sysops. Certainly every actor out there putting in place individual level mass surveillance and influence consider themselves very legitimate.
deleted 1y ago
[deleted]

235 points by todsacerdoti 1y ago

I think the “prove you’re human by hitting the button” attack is pretty clever. With the range of different ways captchas are presented today I can see it getting a good % of folks.

a2128 1y ago
It's our own fault for making the internet such a confusing Kafkaesque maze. Click this button, click that button, sign in to confirm you're not a bot, select the traffic signs, select the items that a rat would not eat, solve this maze to prove you're a human, type out the numbers hidden in these demonic noises, provide your phone number to prove you're real, compute proof-of-work, download this browser if you're having issues... The line between fraudster and modern tech company is honestly not clear anymore and especially not for people who don't care much about tech and just want to access something
- pixl97 1y ago
  Evolution is messy and guided by random occurrences. Early in the internet days I had ran an open SMTP server for a few years before it was used as a spam relay. The web browser didn't have a security model. Online shopping was going up to a site, writing what you wanted on paper, then mailing off a money order. Then both fraud and useful things like actual online shopping started happening while the size of the web exploded. Masses of people with no technical capability were getting online. And that's before we got to the age of social media and massive data collection. Simply put we didn't make the 'web' part of the internet, some people tossed it out as a child and it's been a tooth and nail fight for survival ever since, patching itself up one vuln at a time.
  - permo-w 1y ago
    never mind the fact that half these captchas are just excuses for orgs to sneakily extract some reinforcement learning data from you. last time I tried to sign into my microsoft account it made me do 6 captchas. SIX. not six like I failed 1 captcha six times, six like each captcha was iteratively marked i/6
    - pixl97 1y ago
      Most of the time you get captcha failures like that it's because you're also doing things that are good for your security like blocking all kinds of 3rd party bullshit. I've had to do things like turn off adblock on a page to get past the captcha before turning it back on.
      - permo-w 1y ago
        it wasn't a failure, but I do see what you're saying
- Mtinie 1y ago
  …but don’t click this button.
- tsunamifury 1y ago
  [flagged]
  - pwdisswordfishz 1y ago
    Yes, you can. You would be wrong, though.
    - tsunamifury 1y ago
      [flagged]
  - dspillett 1y ago
    Nope. We can blame companies for deliberately implementing the requirements in the most inconvenient (and usually actually non-compliant) way possible, to make it an unpleasant process to disagree, and all too easy to accidentally agree, to being stalked by hundreds of "partners".
  - lionkor 1y ago
    Malicious compliance is usually intentional, yk?
  - yard2010 1y ago
    You can blame anyone, really, but try to think about it this way: when a 5-years old child drives a car into a wall, you don't blame him, you blame the responsible adult in the passenger sit that says: "it's fine, go ahead, drive this car".
  - sensanaty 1y ago
    Or we can blame the literal scammers and other degenerates that lead businesses and have forced jurisdictions like the EU to implement these? We've JUST unearthed yet another scandal from Meta, where they've been, surprise surprise, spying on people on Android. Cambridge Analytica, Yemen and countless other examples, all from this 1 company. And we're blaming the EU for trying to do anything against them, and not scumbags like Zuckerberg?
- miki123211 1y ago
  It's not just the captchas either, the "this GPS app needs access to your location" or "this photo taking app wants access to your camera" style pop-ups don't help either. If you learn once that clicking "deny" in a notification pop-up means your phone doesn't ring when your grandson calls you on Whats App, you won't be clicking "Deny" in those pop ups any more. I genuinely don't know how to solve that problem, and I definitely see non-technical family members struggle with it.
  - Sophira 1y ago
    The silly thing is, it was known before all these permission pop-ups were created that users will simply press "Yes", "OK", "Allow", "Agree", etc., on every dialogue they see simply in order to get rid of it. Many people -maybe even most people? - just see them as needlessly getting in the way of where they actually want to be. So, given that we knew that, why the hell did we create more?
    - const_cast 1y ago
      Because there’s no good alternatives IMO. Auto-deny leads to a lot of unexpected and broken behavior, and most users aren’t going to know where to go to enable that type of stuff. But auto-enable is even worse: because malicious actors can get permissions they shouldn’t. In fact, even with mainstream applications, most of the permissions they ask for they don’t need to operate - they’re just used for tracking and data exfiltration. So ask every time has been the solution and it works okay. iOS actually does a good job with this. For suspicious permissions, such as accurate location data all the time, it periodically re-prompts. It’s annoying, but it can catch a lot of suspect behavior. There’s shockingly little apps that need your exact location when the app isn’t open.

LegionMammal978 1y ago

> According to Qurium, TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling "push notifications," a cross-platform browser standard that allows websites to show pop-up messages which appear outside of the browser. An elderly relative of mine was hit by this a couple years back: his computer's desktop was constantly being spammed with messages on startup, and there was no simple way to turn them all off. It turned out that they were all notifications from web workers that he'd inadvertently allowed at some point prior. (I set his browser to auto-deny notifications so it wouldn't happen again.)

creeble 1y ago
Elderly neighbor for me. Quite insipid; it took me a few minutes to realize that they were browser-based when I first got to the computer.
KevinGlass 1y ago
I honestly think desktop notifications in their current form are one of the worst features of the modern web. Sure it's nice to get an email alert but on my experience there's probably a thousand confused old people getting spammed for each person that intentionally enabled it. What's worse is they look like native OS alerts (on Windows) so when one says "SECURYIRT ALERT!! CALL NOW" it's that much more effective at getting people on the phone with scammers.
- cortesoft 1y ago
  So many sites ask for permission to send notifications that have zero reason to do so. Why would I want push notifications from a shopping or news site?
  - tim-- 1y ago
    Honestly, push notifications from a news site arguably is one of the few sites that I see having a reason to send push notifications. Communication platforms; messaging apps (Slack, Discord etc); email sites (gmail and co.) also make sense. Financial platforms (banks, Stripe etc) Once you start getting out of these two categories, then yeah, it gets silly. No way should an airline website even be allowed to ask to send push notifications. Google does have a way for Chrome users to not show the notification window (https://yespo.io/blog/google-chrome-will-now-block-abusive-browser-notifications https://yespo.io/blog/google-chrome-will-now-block-abusive-b...) by default (https://support.google.com/webtools/answer/9799829?hl=en https://support.google.com/webtools/answer/9799829?hl=en) but I really wish that this was flipped, so that Google would first need to approve sites to use notifications, similar to the Public Suffix List.

username223 1y ago

> TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling “push notifications,” Why is it even possible for hostile code (i.e. JavaScript) to send OS-level notifications? If clicking a link runs untrusted code with layers of legal insulation, that code should run in a very limited sandbox. It's crazy that we're turning the "Open Web" into an ever-expanding attack surface.

hakfoo 1y ago
Because people turned browsers into an app platform and users wanted their webmail and chat services to have the same first-class features native clients had.
- deleted 1y ago
  [deleted]
- username223 1y ago
  Who wanted their web browser to let hostile programs send notifications and access battery levels, unused fonts, etc.? Ad companies run the web standards bodies, so "people" (i.e. you and me) have to deal with this.
  - Xevion 1y ago
    In all fairness, some of these things you've mentioned could be useful. If your battery is low, reprioritize the webapp's functions, lower requests, disable anything not necessary in the moment. Notifications are just another convenient thing that me and you use every day. Perhaps these things should be disabled by default, or requested upon being needed, but that's not really your argument it would seem.
    - account42 1y ago
      > In all fairness, some of these things you've mentioned could be useful. If your battery is low, reprioritize the webapp's functions, lower requests, disable anything not necessary in the moment. This kind of automated perfomance tuning is almost always more annoying than useful. > Notifications are just another convenient thing that me and you use every day. Who is "me and you"?

justusthane 1y ago

> Doppelganger campaigns use specialized links that bounce the visitor’s browser through a long series of domains before the fake news content is served What’s the purpose of being bounced across several different domains before arriving at the destination? I’ve noticed this behavior when accidentally clicking on sketchy ads, but never stopped to think about it.

Mtinie 1y ago
Multiple impressions per interstitial domain, I imagine.
out-of-ideas 1y ago
reminds me of how okta and similar handle logging in. feels like 10thousand redirects later.. training users that behavior is okay
- Xevion 1y ago
  I despise how my university's login system just redirects several times (sometimes getting stuck, reloading and redirecting multiples times, and then occasionally shitting me out on the logged out screen, wondering WTF happened). I cannot fathom how their IT staff allows things to be that way. One redirect ideally. Two max. Three, and I'm assuming you don't know what you're doing, at all.
  - imp0cat 1y ago
    If only it were that simple. You can thank Apple, Google and their war on cookies for that.
  - immibis 1y ago
    One reason is to set session ID cookies on several different domains.
  - mschuster91 1y ago
    The problem with university login systems - at least here in Germany/Europe - is this global federation system that's also backing EduRoam. Authentication flows there are insanely complex, not to mention dealing with known quirks of some university's implementation...

breslie7 1y ago

[flagged]

breslie7 1y ago

[flagged]

breslie7 1y ago

[flagged]

breslie7 1y ago

[flagged]

breslie7 1y ago

[flagged]

tempodox 1y ago

It never ceases to amaze me how creativity gets ramped up to 11 when it comes to graft, theft and scam.

palmfacehn 1y ago

A clever social engineering approach, but Kreb's trite alarmism overshadows the novelty.

wwn_se 1y ago

Great article but the fix is Adblock! Enable adblock everywhere for your family and friends at risk. Even if an ad sometimes slips through they since its out of the ordinary they are way less likely to click. https://firstpartyornoparty.org/ https://firstpartyornoparty.org/

deleted 1y ago
[deleted]
lionkor 1y ago
Okay, my family has iPads. What should they use? Brave? lol
- v5v3 1y ago
  Nextdns/similar. Vpn with ad blocking built in
- nake89 1y ago
  Yes
- brettermeier 1y ago
  Tablets not from Apple. That's your fault if you use that shit and can't block ads or install whatever you want.
  - carlosjobim 1y ago
    It's easy for a non technological person to block ads and malicious domains on the system level on all Apple devices.
  - lionkor 1y ago
    They already have an iPhone, a Mac, a MacBook, which tablet would you recommend that integrates just as well? My point is that this is not a realistic option for a lot of people. Adblockers only work for people who have previously valued their freedom.
- 1y ago

b0a04gl 1y ago

[dead]

thyristan 1y ago

This is, at least for browser notifications, just yet another result of generally atrocious browser UI decisions. There are tons of permissions a site may or may not request, all of them configured and requested in different ways. Sometimes it is a full page overlay, like when you get a certificate error. Sometimes it is a separate popup window, like when you allow using a client certificate. Sometimes it is a whole-width bar below the address bar, like when a page requests becoming your mailto:-scheme-handler. Sometimes it is a smaller popover dangling from the address bar or some icon there, like for camera or location. Sometimes I can allow/deny, sometimes I can allow or just close that tab. Sometimes I can remember the setting, sometimes it is auto-remembered. As soon as the initial setting has been configured, removing or reconfiguring it happens in totally different and unobvious places again. And then, If I allowed something and there is e.g. a notification from a website, the browser hides the fact that this is a browser-based notification, there are no embedded "STFU, never show again" buttons or anything. There also is no simple place to just look at all the permissions some website might have. There also isn't a place for many permissions, where you can get a list of websites that have e.g. camera permissions. It is all just very opaque, non-obvious, historically grown inconsistent spaghetti. What needs to happen is a consistent permission request and change flow for everything a website wants to do. Not only with "allow forever/deny forever", but also with "allow/deny once", "allow/deny for session", "allow/deny for timeframe". And with an "allow to ask again after timeframe/never/..." selection. Not with popups or bars, but with a whole-page overlay like HTTPS does. Why whole-page? Because then clickjacking won't work, there is more space to put an explanation and options, and pages need to interrupt flow so this will hopefully be used sparingly.

tehwebguy 1y ago

Once again grateful that at least one mobile platform doesn’t allow browser push notifications.

HocusLocus 1y ago

I've followed Krebs for years and appreciate this specific warning. I changed my dad's default Windows colors so when he was presented with fake system dialogues floating on web pages he'd spot them as different right away. But the "click allow to prove you're a human" might have caught him. Captcha-annoyed people are slightly easier to fool sometimes. Push wasn't a big thing then or I would have disabled it. Dad was one of those late computer adopters who had to be instructed carefully about things pretending to be other things and and nested windows. I remember when pages spawning new windows (then grabbing focus to hide them) was a thing. Then older folks about to go to bed closing their browsers and greeting the hidden windows like a continuation of their browsing experience. Russia has evolved along with us on the Internet and I'd remind Mr. Krebs paraphrasing Freud, sometimes a Russian oligarch is just a Russian oligarch. It's possible that the Kremlin has hired these companies like everyone else, and a lot of shady people want to penetrate EU DNS defenses. Fake camping sites with AI content whether its disinformation or deception or hallucination with no human proofreading, is a looming problem. Keep an eye on the prize, preventing old people from getting scammed. People need more education in general to spot nefarious content, no matter who the state actor is. We don't want a repeat of the Alfa-Bank scam 'October Surprise' either. It relied on the gullibility of the Internet surfing public but DNS administrators should have seen through it and asked more questions.

trissi1996 1y ago
Wtf are "EU DNS defenses"? Never heard about that.

BMaronge 1y ago

The article is a bit vague on some points, for example: the links bounce the visitor through a series of domain names... why exactly? What do the scammers gain by redirecting the visitor multiple times instead of just once? It is not explained.

coldpie 1y ago
KrebsOnSecurity is a really weird website. I feel like I should be the perfect audience for it, as a software engineer who is very interested in security and reverse engineering, but every time I try to read their articles it just comes across as paragraphs and paragraphs of overwrought fluff with zero actual content. I guess their audience is someone with less technical knowledge who is impressed by empty phrases like "startling discovery" and "online hucksters and website hackers" and "resilient and incestuous". And that's all just in the first paragraph here. Get to the point, man.
- arresin 1y ago
  Huh that’s weird I feel the exact same way and should also be the natural audience. Every time I read an article though I feel like my eyes go cross eyed. It’s like you said, the words are there they should make sense, but I find my attention wandering. It’s like they are written by a very very early LLM.
- cpburns2009 1y ago
  I stopped reading his website after he started spreading disinformation about Ubiquiti.
hnburnsy 1y ago
>The article is a bit vague on some points Yeah, it even starts with... "a disinformation network that promotes pro-Russian narratives and infiltrates Europe’s media landscape by pushing fake news through a network of cloned website" But doesn't give any examples of this happening and goes off on tangents like Switzerland, Dating sites, traffic monetization, and Breaking Bad

StuntPope 1y ago

[flagged]

PaulHoule 1y ago

Kinda wish the web had an ability to defend itself. Put CAPTCHAs on your site: zero traffic. EU adds those cookie banners to everything: EU should have been disconnected from the internet.

lcnPylGDnU4H9OF 1y ago
> EU adds those cookie banners to everything EU required website operators to disclose certain uses of cookies and many of them chose the most obnoxious way possible. Perhaps more agreeable: every website that uses those banners should be disconnected from the internet.
- PaulHoule 1y ago
  They coulda said "Respect DNT or go to jail" but instead they broke the ultimate window. For years I advocated, mostly successfully, to keep pop-ups, pop-unders, pop-ins and other abuse like that out of sites I worked on. Then the EU pulls this magic trick that transforms them into something required, and then "wholesome" so after that the dam breaks and it is common for a blog today to pop up three banners that want your email address, for pop-up ads to cover other pop-up ads, etc. When your government is unresponsive like that the only choice is exit, no wonder the EU is overrun by populists that want out. If they don't want Frexit and Sprexit and Grexit they'd better think twice when they make another thoughtless law with terrible consequences.
  - Ylpertnodi 1y ago
    >They coulda said "Respect DNT or go to jail" but instead they broke the ultimate window. You know EU law only applies in the EU? And blockers exist? I always howl with laughter when some bumhole USA newspaper presents me with a cookie banner that got through. Then i change vpn-server, read what i want, and get on with my tawdry existence.
  - lcnPylGDnU4H9OF 1y ago
    > and then "wholesome" What is this referring to? > thoughtless law with terrible consequences Fair enough, I guess. If I understand the point, the EU should not have presumed so much that the law would change behavior for the better. The obvious result is that behavior changed for the worse. For what it's worth, I still personally prefer speaking against those who made their behavior worse to comply with the law when it's so obvious what the lawmakers' intention was; the EU actually had user-friendly intentions and the cookie banners' implementations are the result of user-hostility.

psychoslave 1y ago

>While TDSs are commonly used by legitimate advertising networks to manage traffic from disparate sources and to track who or what is behind each click, VexTrio’s TDS largely manages web traffic from victims of phishing, malware, and social engineering scams. Legal sysops is still sysops. Certainly every actor out there putting in place individual level mass surveillance and influence consider themselves very legitimate.

deleted 1y ago

[deleted]