15 ms·

Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

175 points by alexcasalboni 12y ago

Mikeb85 12y ago
And this is why open source, combined with trusted repos is the way to go. Granted, I do have a few closed source apps (Steam, games, Chrome and Opera contain open source bits but are also closed source), but those are apps I mostly 'trust' (I don't trust them 100%, but then again I'm also not pouring through the Linux kernel code). Best way to avoid scams is common sense (if something looks dodgy, it probably is).
jacquesm 12y ago
You can't trust anybody except for open source repositories. The easiest way to get such trash on your computer is installing software from a commercial vendor. Oracle is one major source of headache, if you aren't careful you'll find your 'java' install also gives you a severe case of malware/crapware. There are whole companies dedicated to this concept of piggy-backing junk.
- sp332 12y ago
  At least you can get some projects crap-free from https://ninite.com/ https://ninite.com/ The notable exception is Flash. The only place you can get up-to-date, crap-free versions of Flash is this URL: https://www.adobe.com/products/flashplayer/distribution3.html https://www.adobe.com/products/flashplayer/distribution3.htm... and scroll down, don't use the big "Download Adobe Flash Player" button on the right.
- Lawtonfogle 12y ago
  These companies are exploiting trust for the sake of making money. We all lose when the trust is destroyed just for a few to make few extra dollars. Privatized profits, socialized losses.
- joosters 12y ago
  You can't trust anybody except for open source repositories. Like Sourceforge? http://blog.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ http://blog.gluster.org/2013/08/how-far-the-once-mighty-sour...
  - jacquesm 12y ago
    Ah yes sourceforge. How far the mighty have fallen.
    - DannyBee 12y ago
      Sourceforge was doing this on like day 3, so i'm not sure they fell that far?
      - jacquesm 12y ago
        They were pretty good for years, I'm not sure where you got your 'day 3' reference from but I was an early sourceforge user and they were pretty much like github today in terms of reputation. Then times got tough and sourceforge sold to new owners and that's when the trouble started.
      - dec0dedab0de 12y ago
        There was a time where I would tell friends, family, and clients that the top sourceforge projects were the only safe things to download on the internet.
  - keithpeter 12y ago
    I read the gp comment as something like a distribution repository. Apt-get or perhaps like brew on Mac OS and so on. Checksummed binaries and a single source for each machine.
- bradleyland 12y ago
  > You can't trust anybody except for open source repositories. Meanwhile, in the real world, Sourceforge injects adware in to downloads for open source projects. Trust is more subtle than open source/closed source.
  - icebraining 12y ago
    Well, that depends if you read that has a "repository of open source software" or a "repository that is open source". Sourceforge doesn't qualify as the latter.
  - unstabilo 12y ago
    He didn't say all open source is trustworthy, only that closed source is not. And Sourceforge, the repository itself is not open source.
  - dragonwriter 12y ago
    "You can't trust anybody outside of group X" does not imply "You can trust everybody inside of group X".
    - cowls 12y ago
      True, but then that is not what he said, you conveniently reworded it ;)
      - dragonwriter 12y ago
        > True, but then that is not what he said, you conveniently reworded it ;) I reworded it for generality, but specifically, "You can't trust anybody except open source repositories" does not imply "You can trust all open source repositories" in exactly the same way as, in more general terms, "You can't trust anybody outside of group X" does not imply "You can trust everybody inside of group X".
- sheetjs 12y ago
  > There are whole companies dedicated to this concept of piggy-backing junk. ... including a YC company called InstallMonetizer: https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711
  - jacquesm 12y ago
    Fortunately they have 'watsi' too. Downvoters are invited to explain what's wrong with this comment, I see installmonetizer as one of the low points in the history of YC and watsi as the high point, possibly the high point in VC investing in the last decade or more.
    - pavel_lishin 12y ago
      Spending your weekends volunteering at a soup kitchen doesn't give you the right to throw litter onto the highway. Just because YC has watsi doesn't mean they shouldn't have to explain why they're affiliated with InstallMonetizer, and justify their decision.
      - jacquesm 12y ago
        I agree with that in principle, but: YC invests in companies at an absolutely enormous rate, they have relatively few 'rotten apples' when you take into account that they encourage companies to pivot post investment and that they couldn't change what a company actually does even if they wanted to (they own a very small minority of the stock after all). If I were in YC/PGs shoes I would have dropped installmonetizer the second I found out what they did but then again, I don't run the most successful start-up accelerator on the planet for a good reason. In fact, I wouldn't have invested in them in the first place. But on the whole if you select for hackers driven to make money at any cost you can expect to get a rotten apple every now and then. Whether or not YC should have dropped installmonetizer once it became clear what they were up to (if that wasn't clear from the application alone) is something everybody has to decide for themselves, for me it is clear that they should have. Also, to their credit I haven't seen them invest in anything as shady as installmonetizer after that point so maybe some lessons were learned.
- pannallas 12y ago
  You can't trust open source repos either; you can only verify them. And is anyone really reading all of the code they run before they run it? With all of its third-party dependencies? I don't think open source repositories are safer because they're open source, but precisely because there is no commercial benefit to shoveling BS into them. In fact, with the bigger commercial open source software, you often do see crap you don't want being included as a means to funnel users into commercial channels.
  - jacquesm 12y ago
    Yes, that's an excellent point, I highly doubt anybody verifies what they install end-to-end. We all put a lot of trust in reputations and a couple of checksums.
    - TeMPOraL 12y ago
      Trust is fundamental to society, having a civilization is impossible without it. We shouldn't expect people to verify everything all the time.
  - seanwilson 12y ago
    You also need to verify that the binary you run is the same source code and be able to identify malware in source code that may be very well hidden. This isn't remotely practical and for even simple software. The only practical solution I can see is proper sandboxing of applications so you don't need to trust them in the first place.
    - jacquesm 12y ago
      That's probably where we're headed. Hypervisors running single-application kernels talking via message passing over some networking protocol to display servers and other virtualized hardware.
      - TeMPOraL 12y ago
        Am I the only one who thinks this reality sucks? Everything locked down, no way to tweak or repurpose any of your software. I know, there are bad actors out there, etc. but shouldn't there be a limit for destroying utility of things in the name of security?
- jfuhrman 12y ago
  Open source isn't some magical protection. Even with being a much smaller target, there have been malware on Linux repos. Example on Gentoo(ignore the over the top headline): http://www.zdnet.com/article/linux-infection-proves-windows-malware-monopoly-is-over-gentoo-ships-backdoor-updated/ http://www.zdnet.com/article/linux-infection-proves-windows-... Not to mention that the repos themselves have been having security issues over the years.
  - Sir_Cmpwn 12y ago
    Gentoo is hardly a server-ready operating system. Find similar stories on Debian or CentOS instead?
  - makomk 12y ago
    Gentoo systems refused to accept the backdoored source code because the SHA1 hash no longer matched - that's how the backdoor was discovered in the first place.
- Sir_Cmpwn 12y ago
  The Linux model: you install software from repositories curated by people you trust - distribution maintainers. No viruses, no bundled adware, just simple no-bullshit software repositories. I have a hard time understanding why techies continue to put up with Windows and OSX.
  - code_duck 12y ago
    Agreed, every time I clean or set up a Windows computer for someone I marvel at how poor the entire process is, and how little it has changed in the past 15 years. OSX still has very little adware attached to downloads, in my experience - plus there's the Mac App Store. It's pretty much just Windows users who endure that.
    - maccard 12y ago
      Setting up a windows 8 pc is wonderfully simple. Theres an option to reset to defaults, and the default driver discovery is quite good. Windows 8 has picked up display drivers, wifi drivers and pretty much everything else that I care about in every laptop and desktop pc I've tried. I haven't tried Linux recently (about two years ago) but when I did I had major headaches with a Broadcom wireless driver, and a Bluetooth chip, that both worked flawlessly on windows 8. Installing "common" software is a doddle too, wth Ninite. You get Firefox, vlc, Dropbox, spotify, Skype (now in windows updates though) notepad++, up to date Java and .net run times, pdf reader etc etc. I set up the installer once about 3 years ago and the same one still works, with a one click update.
      - sjolsen 12y ago
        >I haven't tried Linux recently (about two years ago) but when I did I had major headaches with a Broadcom wireless driver, and a Bluetooth chip, that both worked flawlessly on windows 8. As someone who has used Debian almost exclusively for a few years now, I've got to admit that Windows 8 really does handle drivers nicely. Linux systems are generally pretty good about drivers these days, at least if you allow proprietary drivers, but nothing beats total out-of-the-box automation.
  - 12y ago
- ksk 12y ago
  >You can't trust anybody except for open source repositories. That is patently false. Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service. On the other hand, companies that give away stuff for "free" have to find unique ways to pay the bills (be it hosting fees, or hardware costs, or developer time, etc). In recent years the most common way is to create some way to essentially trick people into clicking ads. Open Source repositories have not found any long term sustainable method to get compensated for their hosting fees or hardware costs. At the moment, they are run on donations - mostly from commercial vendors, universities and the like. At some point in the future, lets say if 500 million desktop users all start using those repositories, there will come a time when that cost is going to stick out on a balance sheet. I hope that they figure out a way to get paid for their efforts by then.
  - jacquesm 12y ago
    > Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service. Lenovo (and lots of other hardware manufacturers) are proof positive that this is absolutely not the case. There isn't a windows machine bought over the years by my extended family that did not have a whole pile of junk on it right from day one including ad injectors such as described in the article. Whether or not open source is 'viable' for large numbers of users is no longer a question that needs settling. For bandwidth we have torrents if need be.
    - ksk 12y ago
      My computer didn't come with any junk on it. Even otherwise, pointing out what some companies do in ONE market means nothing. That is why I used the word usually. I guess it is no longer expected to read what someone says before responding. Good job on that.
      - cazum 12y ago
        As long as you say "usually", nobody can ever disagree with you!
krschultz 12y ago
I wonder how this compares to the % of users that have ad blockers installed. Ad injectors might be a bigger hit on their revenue than ad blockers.
compbio 12y ago
Original article: http://googleonlinesecurity.blogspot.nl/2015/03/out-with-unwanted-ad-injectors.html http://googleonlinesecurity.blogspot.nl/2015/03/out-with-unw...
- mckoss 12y ago
  Looks like techcrunch is running an unwanted article injector :-)
anon1385 12y ago
Well maybe they should stop allowing download sites that offer ad infected downloads to buy the top spots on the google search results page? https://i.imgur.com/Ote9c2k.png https://i.imgur.com/Ote9c2k.png Adwords is probably one of the main infection vectors for malware these days. Previous rant: https://news.ycombinator.com/item?id=8879229 https://news.ycombinator.com/item?id=8879229
- rogerbinns 12y ago
  I have a google alert for one of my open source projects (APSW) and every day almost they email me one or two sites where it has popped up. Virtually every one has a bizarre name, and on going to the site it is content obviously generated using Markov chains from other sites and incomprehensible to humans. Of course there is no way to tell Google that these aren't real sites (I tried) and distinguishing real text from Markov chains using a computer is hard. I keep wondering what it will take for them to figure out bad content, both for the computer (javascript etc) and for people (english etc).
- chimeracoder 12y ago
  This, right here, is why I have no qualms installing Adblock Edge and insisting that my parents (and anyone else who isn't very tech-savvy) do the same. It's not about not wanting to support independent bloggers. It's about making sure that unsuspecting users don't accidentally download malware when they're doing something mundane like downloading their web browser. In the age of the web, Adblock is the new anti-virus.
  - brador 12y ago
    It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks).
    - TeMPOraL 12y ago
      > It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Same here. I couldn't be bothered to install AdBlock for many years, but the mandatory before-video ads were the straw that broke the camel's back for me. > Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks). I've lost track of who is trying to scam who. The users are collateral damage anyway.
ocdtrekkie 12y ago
Maybe if Google AdWords wasn't a malware delivery tool...
acomjean 12y ago
Do these injectors work with https (ssl) sites? Where in the web page fetch/render process does this occur?
- ceejayoz 12y ago
  They're often browser toolbars, which'll work fine on SSL sites.
- rebelde 12y ago
  That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now". 5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.
  - jacquesm 12y ago
    HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.
    - vbcr 12y ago
      Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?
      - jacquesm 12y ago
        Not all HTTPS connections are to your bank. You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews. Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.
Someone1234 12y ago
If you turn on CSP reporting for your web-site you'll see a LOT of reports about attempted script injection into your site. When you research it you'll find that these come from malware/extensions which are pushing ad content and other nonsense.
- AgentME 12y ago
  Similarly, if you have a site set up to make an ajax connection back to your server whenever an uncaught javascript exception happens (protip: if you do this, make sure to throttle it, or else if you push a bad update that makes users' browsers get stuck in a loop throwing errors, they will all try their damnedest to DDOS you!), then it's very easy for most of the reported errors to not actually originate from your site's own scripts but be from browsers broken by adware. I've been very surprised that I haven't seen more talk about this until now. I remember trying to track down a bug a few users reported, and I finally discovered that the users all had a specific piece of malware that replaced the javascript setTimeout function with a version that only took two arguments, which caused my code to break in frustratingly subtle and mystifying ways.
  - sandinmyjoints 12y ago
    I also have wondered why this isn't talked about more often. We see an unbelievable amount of garbage from catching uncaught client-side errors.
tinco 12y ago
"It’s also worth noting that ad networks often also don’t know that their ads are being used in this way." So, ad networks don't know about a source that hits them with the 5% of the total throughput of Google's sites? Yeah right.
- Eridrus 12y ago
  There's some nuance here. The ad network whose script/iframe is directly injected onto the top frame can know fairly easily, since they know which accounts should be linked to which domains, however when these inevitably get resold, these subsequent ad networks have a much tougher time. What ends up happening is that the first thing that gets injected is someone totally shady ad network that doesn't care, who will then resell it to someone slightly less shady, who will bundle it with a pile of other traffic, etc, etc, until it's been laundered enough times that it's hard to separate this out.
gadders 12y ago
Browsing sites on my Android phone is the worst. I frequently get re-directed right off the page to either Google Play to install some dodgy app, or some site that tries to download the APK directly.
- code_duck 12y ago
  This happens a lot on iOS too - even some respectable sites have ads that open the App Store without any user intervention. I'm not sure why Apple allows this.
  - MBCook 12y ago
    They stopped it with iOS 8, but after a few weeks someone had found a way around it and the problem was back. It doesn't effect me much, which must say something about the sites I read. But it is obnoxious as hell.
    - code_duck 12y ago
      I've had it happen even on imgur and seemingly respectable news sites. I would expect to get an "Open the App Store?" dialog, but I suppose people find ways to circumvent that.
code_duck 12y ago
Given the number of insanely infested windows machines I've fixed for friends and relatives, I'm surprised it's so few. On the other hand, I suppose most of those people use Bing on IE since it's never occurred to change the default, as they probably don't distinguish between Google, Yahoo and Bing anyhow.
AYBABTME 12y ago
I guess it balances out those with ad blockers.
fsaintjacques 12y ago
Here's an example of said extension. https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf If you want to test the effect of it, copy/paste 'console.js' content in Chrome's console, I recommend to go into incognito mode: https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf#file-console-js https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf#f...
eevilspock 12y ago
> “Unwanted ad injectors aren’t part of a healthy ads ecosystem,” Google Safe Browsing engineer Nav Jagpal writes in today’s announcement. “They’re part of an environment where bad practices hurt users, advertisers and publishers alike.” Healthy ads ecosystem? WFT? The internet is inundated with garbage because of the perverse incentives wrought by ad-based revenue models, not to mention the other costs of advertising: https://news.ycombinator.com/item?id=8585237 https://news.ycombinator.com/item?id=8585237. Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites which would, if Google and others didn't make it so easy to get ad revenue, be forced to do what you're supposed to do in a healthy free-market ecosystem: make products good enough that people are willing to pay for them.
- __david__ 12y ago
  > Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites… The difference is that those websites willing allow ads of a specific type to be injected into themselves. The browser toolbars inject ads into everything, which is annoying (and breaks sites due to poorly coded injection). I'm with you though—ads of any type are pretty annoying. But that's what adblock is for. :-)
josefresco 12y ago
I wonder if the users who have 2 or more ad-injectors installed did not get "re-infected" but rather the first infection opened the door to more? Or maybe it's a specific vulnerability that is being exploited by multiple spyware vendors?
usaphp 12y ago
Can you recommend me what can be done on a Mac to remove such as injectors?
orf 12y ago
That's funny as it is mostly Chrome extensions that inject adverts from what I have seen. I wondered why Ghostery was blocking 20 trackers on YouTube - it was all the random extensions that require full access to everything.
hellbanner 12y ago
I googled for "Open Office download" on a family's computer and went with the first download -- download.com or cnet, I think. It downloaded very fast and I thought "well, maybe it's just an initializer that torrents the rest". NOPE. Within 30 seconds of the installer, it prompted to install an ad-bar in the browser. I quickly closed and researched for the official site. It was scary, being a technical professional, and executing adware(malware?) installer while trying to install an open-source alternative to the most popular word-processor for a less-than-savvy family member. It was the top result on Google at the time.
- wampus 12y ago
  A nice benefit of using DuckDuckGo is the distinctive way it flags an official site.
  - deleted 12y ago
    [deleted]
- declan 12y ago
  CNET.com and Download.com are both part of CBS Interactive (CNET Networks was a publicly traded company and was bought by CBS in 2008). I worked at CBS Interactive when the Download.com installer/adware controversy erupted: http://insecure.org/news/download-com-fiasco.html http://insecure.org/news/download-com-fiasco.html As you might expect, it was controversial inside the company as well. I guess things haven't changed after I left.
- aerique 12y ago
  I go to Wikipedia nowadays to find a project's official URL. Not foolproof but better than Google.
- dublinben 12y ago
  This is fundamentally Microsoft's fault. The shareware culture of Windows is insanely insecure these days. Any sane operating system should have a packet manager, with all the software you could want included, and nothing you don't.
csears 12y ago
"When it comes to malware, ad injectors may seem relatively benevolent at first." Did they mean 'relatively benign'?
gress 12y ago
Google should stop running its server side Ad-Injectors before they complain about the client side ones.
__david__ 12y ago
I believe this. We've recently been tracking down bugs coming from users of a web site a friend and I run. We couldn't figure out what was going on until we realized that some injected code was stomping on our site's code and breaking everything. Grrr. So now we have to decide if we want to change all our code to be way more defensive (or offensive) so that we work in the face of hostile injected code. Or perhaps we just live with 5% of our users not working.
code_duck 12y ago
Ad injection can cause other problems, too, especially when combined with people whose understanding of technology is lacking. A few years back I got a job to do a wordpress site for a client. However, I wasn't dealing directly with the client, I signed on through a friend who was a fellow staff member of a forum I frequented. He agreed to create their site despite the fact that he was almost entirely technologically illiterate. His skills were at the 'barely read email' and 'be puzzled by OSX window decorations' sort of level. So, I agreed to do the job. After working on the site for a couple of weeks, one day I received a call from him. He was quite upset as he was seeing porn ads and random nonsense characters on the blog. I investigated and found no trace of ads or foreign code, using several devices and several separate Internet connections. However he could see the ads on multiple devices in his house. Attempts to get him to try another Internet connection like his phone service were unsuccessful. I was pretty sure there was nothing wrong with the site, which was hosted on my VPS along with a couple of other sites that had no sign of issues. However he grew progressively more worried that the client would see these ads on the page, which was live for some reason. I even engaged the help of 20 or so people from the forum to check and they all agreed that no porn ads were visible to them. However this just upset my friend more as he felt embarrassed, but still convinced there was a problem. I suspected he had a virus on the systems at his house (all Apple...) or his router. It ended up with me being banned from his forum and being forced to quit the job... Before finally someone reset his router and the porn ads disappeared. So, content appearing from unknown sources has definitely caused me problems in the past.
soggypopsicle 12y ago
I am one of these spammers. I had a chrome extension and was approached by revjet.io about adding injected ads. The ads typically overwrite the sites normal ads. I see it as stealing the ad revenue from the content creator(which is often Google), which is the same as using adblock. (the extension mentioned that ads were being used and you could also disable them)
johnward 12y ago
There is a while industry of Pay Per View (PPV) ad networks that basically operate this way. A few that come to mind: Trafficvance, LeadImpact, Media Traffic and DirectCPV. I don't know where Trafficvance gets their traffic but it seems to be pop-over ads probably from some installed software. DirectCPV seems to be interstitial ads that the sites actually choose to use (think big news sites with an ad before you read the article). Most of them seem to be spyware/crapware driven. Those are the only two I've worked with in the past so I can't speak on the others.
chatmasta 12y ago
An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response. Obviously this is harmful to users because the implication is that the technique also requires SSL stripping, or trusting invalid root certificates like we saw with Superfish. It's also harmful to advertisers and ad networks because it pollutes tracking data and makes it hard to determine click fraud. But let's not kid ourselves. Google does not care about the user. They simply have no need for ad injectors because they already have far superior methods of tracking us and invasively advertising to us (reading our email, watching our GPS location, knowing when we are home, what videos we watch, etc.) To google this is just a nuisance and they get some free PR for standing up to it along with a respected academic institution. Yay, google! Protector of users! But wait. Isn't this exactly what Verizon, ATT, and Comcast are all doing? Verizon was modifying HTTP headers during the summer. ATT charges users not to inject tracking into packets. Comcast injects HTML into xfinitiwifi connections. How is this any different? Sure, tracking headers do not manifest themselves in annoying pop up ads, but they are still messing with user requests and have almost as many security implications. If Google is going to take a stand against ad injectors, they need to take a stand against all packet injection. These scammy popups are just the bottom of the totem pole. If they could get away with what the big telecoms are doing, they would obvioisly do that instead.
- comex 12y ago
  Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?
  - jacquesm 12y ago
    - ssl stripping - browser extensions
  - chatmasta 12y ago
alpeb 12y ago
In the case of chrome extensions and apps, Google was working on an ad solution a couple of years ago but didn't end up releasing anything. In light of no viable monetization solution for this kind of software it's natural devs have to resort to this kind of practices.
ChuckMcM 12y ago
These guys are pretty annoying. And it ads an "untrusted" advertising stream to the page, a channel which has been the source of malware infections in the past. I'm really curious how this all turns out. I can't imagine the deteriorating system lasting another 5 or 10 years. So what happens after? Clearly advertising has _some_ value, I loved BYTE magazine as much for the ads as I did for the articles, and there are under served retailers (a lot of Business to Business stuff) as the trade magazines take hits. So how do people discover this stuff? How do they find those opportunities when Internet ads are dead? Or do we get to a more reasonable advertising load? Something without flash/js jiggling around and trying to get your cursor. How will sites let users know they don't allow "invasive" ads? How will users respond? For me at least I think it is the difference between Web 2 and Web 3.
- jacquesm 12y ago
  How did you discover websites before advertising took over the web? I don't remember having any trouble discovering new stuff, rather the opposite, word of mouth and following links gave an endless stream of new and interesting stuff. This site alone generates more info in that bracket than I can keep up with (even though I really try to).
  - ChuckMcM 12y ago
    GNN ? :-) Generally discovery of web sites wasn't nearly as difficult as discovering new products. Its the flip of that problem that is hard. Which is BYTE would sell advertising to companies that wanted to reach people building/using/programming microcomputers like me. But these days people consume their information from a thousand sources, whether it is a mention here, or an article on reddit, or Ars. So how does the advertiser in the 21st century "reach" the people likely to be interested in new offerings about their particular experitise? And especially how do they do that when the existing mechanism, site advertising networks, has been burned to the ground by abusive ad networks? Do they hire consultants to find and make agreements with the 10 sites they want to "sponsor" for the roll out of Product X ? I don't worry about finding content, but I do wonder how folks who have something cool will reach me.
MBCook 12y ago
> Google and the Berkeley researchers found that ad injectors are now available on all major platforms and browsers. Bull. iOS is a HUGE chunk of web browsing and its immune from this stuff unless you jailbreak or are conned into installing a root cert and VPN. You can't just download an app from the store or visit a site and find it installed like you can on a desktop.
kkamperschroer 12y ago
I'm a Chrome extension author and I've been contacted at least a half-dozen times by shady companies that want me to add some "totally unobtrusive" ad-injection javascript into my extension. I've been told I could make $0.50/user based in the US per month. That would be a nice raise, for sure, but I'm not the type of person willing to sell out my users to make a little extra dough. Plus I am a user of my own extension, and I don't want ad-injection. And how long could one possibly retain users once you start injecting ads? Probably a steady decline until your left with the users that don't know where the ads are coming from. Selfish plug to my extension here: https://chrome.google.com/webstore/detail/musicality-music-player/fjiolbglibkahkipcdgeepdfdgfkdbee https://chrome.google.com/webstore/detail/musicality-music-p...
- timedump 12y ago
  I know this isn't the place or time, but I got your extension and I would like to request that the archive.org music player be added to it. I do not know how to contact you through your site or send a pm through here or github.
  - kkamperschroer 12y ago
    Thanks. I'll add it to my backlog!
pdkl95 12y ago
How is this not simple vandalism? Throw the people responsible in jail. If they are outside the country, freeze their american bank accounts <i>and</i> the bank accounts of any business that advertises with these injected ads. Precedent: we already have laws that, for better or worse, require hardware stores to perform age checks when someone buy spray paint. This isn't primarily a software problem. This is a problem because nobody is enforcing vandalism laws which encourages the adoption of "vandalism as a business model".
jfroma 12y ago
I see ad injectors installed on all my friends and family computers. I think people has developed some kind of ad-blindness. I remember a friend using facebook and some crazy and animated ads were taking 80% of his screen, I asked him "doesn't this bother you?" , he says "meh".

175 points by alexcasalboni 12y ago

And this is why open source, combined with trusted repos is the way to go. Granted, I do have a few closed source apps (Steam, games, Chrome and Opera contain open source bits but are also closed source), but those are apps I mostly 'trust' (I don't trust them 100%, but then again I'm also not pouring through the Linux kernel code). Best way to avoid scams is common sense (if something looks dodgy, it probably is).

jacquesm 12y ago

You can't trust anybody except for open source repositories. The easiest way to get such trash on your computer is installing software from a commercial vendor. Oracle is one major source of headache, if you aren't careful you'll find your 'java' install also gives you a severe case of malware/crapware. There are whole companies dedicated to this concept of piggy-backing junk.

sp332 12y ago
At least you can get some projects crap-free from https://ninite.com/ https://ninite.com/ The notable exception is Flash. The only place you can get up-to-date, crap-free versions of Flash is this URL: https://www.adobe.com/products/flashplayer/distribution3.html https://www.adobe.com/products/flashplayer/distribution3.htm... and scroll down, don't use the big "Download Adobe Flash Player" button on the right.
Lawtonfogle 12y ago
These companies are exploiting trust for the sake of making money. We all lose when the trust is destroyed just for a few to make few extra dollars. Privatized profits, socialized losses.
joosters 12y ago
You can't trust anybody except for open source repositories. Like Sourceforge? http://blog.gluster.org/2013/08/how-far-the-once-mighty-sourceforge-has-fallen/ http://blog.gluster.org/2013/08/how-far-the-once-mighty-sour...
- jacquesm 12y ago
  Ah yes sourceforge. How far the mighty have fallen.
  - DannyBee 12y ago
    Sourceforge was doing this on like day 3, so i'm not sure they fell that far?
    - jacquesm 12y ago
      They were pretty good for years, I'm not sure where you got your 'day 3' reference from but I was an early sourceforge user and they were pretty much like github today in terms of reputation. Then times got tough and sourceforge sold to new owners and that's when the trouble started.
    - dec0dedab0de 12y ago
      There was a time where I would tell friends, family, and clients that the top sourceforge projects were the only safe things to download on the internet.
- keithpeter 12y ago
  I read the gp comment as something like a distribution repository. Apt-get or perhaps like brew on Mac OS and so on. Checksummed binaries and a single source for each machine.
bradleyland 12y ago
> You can't trust anybody except for open source repositories. Meanwhile, in the real world, Sourceforge injects adware in to downloads for open source projects. Trust is more subtle than open source/closed source.
- icebraining 12y ago
  Well, that depends if you read that has a "repository of open source software" or a "repository that is open source". Sourceforge doesn't qualify as the latter.
- unstabilo 12y ago
  He didn't say all open source is trustworthy, only that closed source is not. And Sourceforge, the repository itself is not open source.
- dragonwriter 12y ago
  "You can't trust anybody outside of group X" does not imply "You can trust everybody inside of group X".
  - cowls 12y ago
    True, but then that is not what he said, you conveniently reworded it ;)
    - dragonwriter 12y ago
      > True, but then that is not what he said, you conveniently reworded it ;) I reworded it for generality, but specifically, "You can't trust anybody except open source repositories" does not imply "You can trust all open source repositories" in exactly the same way as, in more general terms, "You can't trust anybody outside of group X" does not imply "You can trust everybody inside of group X".
sheetjs 12y ago
> There are whole companies dedicated to this concept of piggy-backing junk. ... including a YC company called InstallMonetizer: https://news.ycombinator.com/item?id=5092711 https://news.ycombinator.com/item?id=5092711
- jacquesm 12y ago
  Fortunately they have 'watsi' too. Downvoters are invited to explain what's wrong with this comment, I see installmonetizer as one of the low points in the history of YC and watsi as the high point, possibly the high point in VC investing in the last decade or more.
  - pavel_lishin 12y ago
    Spending your weekends volunteering at a soup kitchen doesn't give you the right to throw litter onto the highway. Just because YC has watsi doesn't mean they shouldn't have to explain why they're affiliated with InstallMonetizer, and justify their decision.
    - jacquesm 12y ago
      I agree with that in principle, but: YC invests in companies at an absolutely enormous rate, they have relatively few 'rotten apples' when you take into account that they encourage companies to pivot post investment and that they couldn't change what a company actually does even if they wanted to (they own a very small minority of the stock after all). If I were in YC/PGs shoes I would have dropped installmonetizer the second I found out what they did but then again, I don't run the most successful start-up accelerator on the planet for a good reason. In fact, I wouldn't have invested in them in the first place. But on the whole if you select for hackers driven to make money at any cost you can expect to get a rotten apple every now and then. Whether or not YC should have dropped installmonetizer once it became clear what they were up to (if that wasn't clear from the application alone) is something everybody has to decide for themselves, for me it is clear that they should have. Also, to their credit I haven't seen them invest in anything as shady as installmonetizer after that point so maybe some lessons were learned.
pannallas 12y ago
You can't trust open source repos either; you can only verify them. And is anyone really reading all of the code they run before they run it? With all of its third-party dependencies? I don't think open source repositories are safer because they're open source, but precisely because there is no commercial benefit to shoveling BS into them. In fact, with the bigger commercial open source software, you often do see crap you don't want being included as a means to funnel users into commercial channels.
- jacquesm 12y ago
  Yes, that's an excellent point, I highly doubt anybody verifies what they install end-to-end. We all put a lot of trust in reputations and a couple of checksums.
  - TeMPOraL 12y ago
    Trust is fundamental to society, having a civilization is impossible without it. We shouldn't expect people to verify everything all the time.
- seanwilson 12y ago
  You also need to verify that the binary you run is the same source code and be able to identify malware in source code that may be very well hidden. This isn't remotely practical and for even simple software. The only practical solution I can see is proper sandboxing of applications so you don't need to trust them in the first place.
  - jacquesm 12y ago
    That's probably where we're headed. Hypervisors running single-application kernels talking via message passing over some networking protocol to display servers and other virtualized hardware.
    - TeMPOraL 12y ago
      Am I the only one who thinks this reality sucks? Everything locked down, no way to tweak or repurpose any of your software. I know, there are bad actors out there, etc. but shouldn't there be a limit for destroying utility of things in the name of security?
jfuhrman 12y ago
Open source isn't some magical protection. Even with being a much smaller target, there have been malware on Linux repos. Example on Gentoo(ignore the over the top headline): http://www.zdnet.com/article/linux-infection-proves-windows-malware-monopoly-is-over-gentoo-ships-backdoor-updated/ http://www.zdnet.com/article/linux-infection-proves-windows-... Not to mention that the repos themselves have been having security issues over the years.
- Sir_Cmpwn 12y ago
  Gentoo is hardly a server-ready operating system. Find similar stories on Debian or CentOS instead?
- makomk 12y ago
  Gentoo systems refused to accept the backdoored source code because the SHA1 hash no longer matched - that's how the backdoor was discovered in the first place.
Sir_Cmpwn 12y ago
The Linux model: you install software from repositories curated by people you trust - distribution maintainers. No viruses, no bundled adware, just simple no-bullshit software repositories. I have a hard time understanding why techies continue to put up with Windows and OSX.
- code_duck 12y ago
  Agreed, every time I clean or set up a Windows computer for someone I marvel at how poor the entire process is, and how little it has changed in the past 15 years. OSX still has very little adware attached to downloads, in my experience - plus there's the Mac App Store. It's pretty much just Windows users who endure that.
  - maccard 12y ago
    Setting up a windows 8 pc is wonderfully simple. Theres an option to reset to defaults, and the default driver discovery is quite good. Windows 8 has picked up display drivers, wifi drivers and pretty much everything else that I care about in every laptop and desktop pc I've tried. I haven't tried Linux recently (about two years ago) but when I did I had major headaches with a Broadcom wireless driver, and a Bluetooth chip, that both worked flawlessly on windows 8. Installing "common" software is a doddle too, wth Ninite. You get Firefox, vlc, Dropbox, spotify, Skype (now in windows updates though) notepad++, up to date Java and .net run times, pdf reader etc etc. I set up the installer once about 3 years ago and the same one still works, with a one click update.
    - sjolsen 12y ago
      >I haven't tried Linux recently (about two years ago) but when I did I had major headaches with a Broadcom wireless driver, and a Bluetooth chip, that both worked flawlessly on windows 8. As someone who has used Debian almost exclusively for a few years now, I've got to admit that Windows 8 really does handle drivers nicely. Linux systems are generally pretty good about drivers these days, at least if you allow proprietary drivers, but nothing beats total out-of-the-box automation.
- 12y ago
ksk 12y ago
>You can't trust anybody except for open source repositories. That is patently false. Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service. On the other hand, companies that give away stuff for "free" have to find unique ways to pay the bills (be it hosting fees, or hardware costs, or developer time, etc). In recent years the most common way is to create some way to essentially trick people into clicking ads. Open Source repositories have not found any long term sustainable method to get compensated for their hosting fees or hardware costs. At the moment, they are run on donations - mostly from commercial vendors, universities and the like. At some point in the future, lets say if 500 million desktop users all start using those repositories, there will come a time when that cost is going to stick out on a balance sheet. I hope that they figure out a way to get paid for their efforts by then.
- jacquesm 12y ago
  > Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service. Lenovo (and lots of other hardware manufacturers) are proof positive that this is absolutely not the case. There isn't a windows machine bought over the years by my extended family that did not have a whole pile of junk on it right from day one including ad injectors such as described in the article. Whether or not open source is 'viable' for large numbers of users is no longer a question that needs settling. For bandwidth we have torrents if need be.
  - ksk 12y ago
    My computer didn't come with any junk on it. Even otherwise, pointing out what some companies do in ONE market means nothing. That is why I used the word usually. I guess it is no longer expected to read what someone says before responding. Good job on that.
    - cazum 12y ago
      As long as you say "usually", nobody can ever disagree with you!

krschultz 12y ago

I wonder how this compares to the % of users that have ad blockers installed. Ad injectors might be a bigger hit on their revenue than ad blockers.

compbio 12y ago

Original article: http://googleonlinesecurity.blogspot.nl/2015/03/out-with-unwanted-ad-injectors.html http://googleonlinesecurity.blogspot.nl/2015/03/out-with-unw...

mckoss 12y ago
Looks like techcrunch is running an unwanted article injector :-)

anon1385 12y ago

Well maybe they should stop allowing download sites that offer ad infected downloads to buy the top spots on the google search results page? https://i.imgur.com/Ote9c2k.png https://i.imgur.com/Ote9c2k.png Adwords is probably one of the main infection vectors for malware these days. Previous rant: https://news.ycombinator.com/item?id=8879229 https://news.ycombinator.com/item?id=8879229

rogerbinns 12y ago
I have a google alert for one of my open source projects (APSW) and every day almost they email me one or two sites where it has popped up. Virtually every one has a bizarre name, and on going to the site it is content obviously generated using Markov chains from other sites and incomprehensible to humans. Of course there is no way to tell Google that these aren't real sites (I tried) and distinguishing real text from Markov chains using a computer is hard. I keep wondering what it will take for them to figure out bad content, both for the computer (javascript etc) and for people (english etc).
chimeracoder 12y ago
This, right here, is why I have no qualms installing Adblock Edge and insisting that my parents (and anyone else who isn't very tech-savvy) do the same. It's not about not wanting to support independent bloggers. It's about making sure that unsuspecting users don't accidentally download malware when they're doing something mundane like downloading their web browser. In the age of the web, Adblock is the new anti-virus.
- brador 12y ago
  It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks).
  - TeMPOraL 12y ago
    > It's the 30 second youtube ads that finally got me to install adblock again after 3 years without. Same here. I couldn't be bothered to install AdBlock for many years, but the mandatory before-video ads were the straw that broke the camel's back for me. > Also the javascript late load "oops click" tricks they're pulling to scam advertisers now (google search, youtube, bing search - all use late load javascript to get misclicks). I've lost track of who is trying to scam who. The users are collateral damage anyway.

ocdtrekkie 12y ago

Maybe if Google AdWords wasn't a malware delivery tool...

acomjean 12y ago

Do these injectors work with https (ssl) sites? Where in the web page fetch/render process does this occur?

ceejayoz 12y ago
They're often browser toolbars, which'll work fine on SSL sites.
rebelde 12y ago
That HTTPS supposedly keeps out ads like this was one of Google's selling points for suggesting HTTPS to publishers. I was expecting this article to end with "and that is why all sites should be running HTTPS now". 5% is a lot. If HTTPS reduces this number to 1%, it might be worth the change.
- jacquesm 12y ago
  HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.
  - vbcr 12y ago
    Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?
    - jacquesm 12y ago
      Not all HTTPS connections are to your bank. You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews. Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.

Someone1234 12y ago

If you turn on CSP reporting for your web-site you'll see a LOT of reports about attempted script injection into your site. When you research it you'll find that these come from malware/extensions which are pushing ad content and other nonsense.

AgentME 12y ago
Similarly, if you have a site set up to make an ajax connection back to your server whenever an uncaught javascript exception happens (protip: if you do this, make sure to throttle it, or else if you push a bad update that makes users' browsers get stuck in a loop throwing errors, they will all try their damnedest to DDOS you!), then it's very easy for most of the reported errors to not actually originate from your site's own scripts but be from browsers broken by adware. I've been very surprised that I haven't seen more talk about this until now. I remember trying to track down a bug a few users reported, and I finally discovered that the users all had a specific piece of malware that replaced the javascript setTimeout function with a version that only took two arguments, which caused my code to break in frustratingly subtle and mystifying ways.
- sandinmyjoints 12y ago
  I also have wondered why this isn't talked about more often. We see an unbelievable amount of garbage from catching uncaught client-side errors.

tinco 12y ago

"It’s also worth noting that ad networks often also don’t know that their ads are being used in this way." So, ad networks don't know about a source that hits them with the 5% of the total throughput of Google's sites? Yeah right.

Eridrus 12y ago
There's some nuance here. The ad network whose script/iframe is directly injected onto the top frame can know fairly easily, since they know which accounts should be linked to which domains, however when these inevitably get resold, these subsequent ad networks have a much tougher time. What ends up happening is that the first thing that gets injected is someone totally shady ad network that doesn't care, who will then resell it to someone slightly less shady, who will bundle it with a pile of other traffic, etc, etc, until it's been laundered enough times that it's hard to separate this out.

gadders 12y ago

Browsing sites on my Android phone is the worst. I frequently get re-directed right off the page to either Google Play to install some dodgy app, or some site that tries to download the APK directly.

code_duck 12y ago
This happens a lot on iOS too - even some respectable sites have ads that open the App Store without any user intervention. I'm not sure why Apple allows this.
- MBCook 12y ago
  They stopped it with iOS 8, but after a few weeks someone had found a way around it and the problem was back. It doesn't effect me much, which must say something about the sites I read. But it is obnoxious as hell.
  - code_duck 12y ago
    I've had it happen even on imgur and seemingly respectable news sites. I would expect to get an "Open the App Store?" dialog, but I suppose people find ways to circumvent that.

code_duck 12y ago

Given the number of insanely infested windows machines I've fixed for friends and relatives, I'm surprised it's so few. On the other hand, I suppose most of those people use Bing on IE since it's never occurred to change the default, as they probably don't distinguish between Google, Yahoo and Bing anyhow.

AYBABTME 12y ago

I guess it balances out those with ad blockers.

fsaintjacques 12y ago

Here's an example of said extension. https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf If you want to test the effect of it, copy/paste 'console.js' content in Chrome's console, I recommend to go into incognito mode: https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf#file-console-js https://gist.github.com/fsaintjacques/e53eadd8b260a4105bbf#f...

eevilspock 12y ago

> “Unwanted ad injectors aren’t part of a healthy ads ecosystem,” Google Safe Browsing engineer Nav Jagpal writes in today’s announcement. “They’re part of an environment where bad practices hurt users, advertisers and publishers alike.” Healthy ads ecosystem? WFT? The internet is inundated with garbage because of the perverse incentives wrought by ad-based revenue models, not to mention the other costs of advertising: https://news.ycombinator.com/item?id=8585237 https://news.ycombinator.com/item?id=8585237. Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites which would, if Google and others didn't make it so easy to get ad revenue, be forced to do what you're supposed to do in a healthy free-market ecosystem: make products good enough that people are willing to pay for them.

__david__ 12y ago
> Google is to me and to a growing number of people an "unwanted ad injector" built into a vast number of web-sites… The difference is that those websites willing allow ads of a specific type to be injected into themselves. The browser toolbars inject ads into everything, which is annoying (and breaks sites due to poorly coded injection). I'm with you though—ads of any type are pretty annoying. But that's what adblock is for. :-)

josefresco 12y ago

I wonder if the users who have 2 or more ad-injectors installed did not get "re-infected" but rather the first infection opened the door to more? Or maybe it's a specific vulnerability that is being exploited by multiple spyware vendors?

usaphp 12y ago

Can you recommend me what can be done on a Mac to remove such as injectors?

orf 12y ago

That's funny as it is mostly Chrome extensions that inject adverts from what I have seen. I wondered why Ghostery was blocking 20 trackers on YouTube - it was all the random extensions that require full access to everything.

hellbanner 12y ago

I googled for "Open Office download" on a family's computer and went with the first download -- download.com or cnet, I think. It downloaded very fast and I thought "well, maybe it's just an initializer that torrents the rest". NOPE. Within 30 seconds of the installer, it prompted to install an ad-bar in the browser. I quickly closed and researched for the official site. It was scary, being a technical professional, and executing adware(malware?) installer while trying to install an open-source alternative to the most popular word-processor for a less-than-savvy family member. It was the top result on Google at the time.

wampus 12y ago
A nice benefit of using DuckDuckGo is the distinctive way it flags an official site.
- deleted 12y ago
  [deleted]
declan 12y ago
CNET.com and Download.com are both part of CBS Interactive (CNET Networks was a publicly traded company and was bought by CBS in 2008). I worked at CBS Interactive when the Download.com installer/adware controversy erupted: http://insecure.org/news/download-com-fiasco.html http://insecure.org/news/download-com-fiasco.html As you might expect, it was controversial inside the company as well. I guess things haven't changed after I left.
aerique 12y ago
I go to Wikipedia nowadays to find a project's official URL. Not foolproof but better than Google.
dublinben 12y ago
This is fundamentally Microsoft's fault. The shareware culture of Windows is insanely insecure these days. Any sane operating system should have a packet manager, with all the software you could want included, and nothing you don't.

csears 12y ago

"When it comes to malware, ad injectors may seem relatively benevolent at first." Did they mean 'relatively benign'?

gress 12y ago

Google should stop running its server side Ad-Injectors before they complain about the client side ones.

__david__ 12y ago

I believe this. We've recently been tracking down bugs coming from users of a web site a friend and I run. We couldn't figure out what was going on until we realized that some injected code was stomping on our site's code and breaking everything. Grrr. So now we have to decide if we want to change all our code to be way more defensive (or offensive) so that we work in the face of hostile injected code. Or perhaps we just live with 5% of our users not working.

code_duck 12y ago

Ad injection can cause other problems, too, especially when combined with people whose understanding of technology is lacking. A few years back I got a job to do a wordpress site for a client. However, I wasn't dealing directly with the client, I signed on through a friend who was a fellow staff member of a forum I frequented. He agreed to create their site despite the fact that he was almost entirely technologically illiterate. His skills were at the 'barely read email' and 'be puzzled by OSX window decorations' sort of level. So, I agreed to do the job. After working on the site for a couple of weeks, one day I received a call from him. He was quite upset as he was seeing porn ads and random nonsense characters on the blog. I investigated and found no trace of ads or foreign code, using several devices and several separate Internet connections. However he could see the ads on multiple devices in his house. Attempts to get him to try another Internet connection like his phone service were unsuccessful. I was pretty sure there was nothing wrong with the site, which was hosted on my VPS along with a couple of other sites that had no sign of issues. However he grew progressively more worried that the client would see these ads on the page, which was live for some reason. I even engaged the help of 20 or so people from the forum to check and they all agreed that no porn ads were visible to them. However this just upset my friend more as he felt embarrassed, but still convinced there was a problem. I suspected he had a virus on the systems at his house (all Apple...) or his router. It ended up with me being banned from his forum and being forced to quit the job... Before finally someone reset his router and the porn ads disappeared. So, content appearing from unknown sources has definitely caused me problems in the past.

soggypopsicle 12y ago

I am one of these spammers. I had a chrome extension and was approached by revjet.io about adding injected ads. The ads typically overwrite the sites normal ads. I see it as stealing the ad revenue from the content creator(which is often Google), which is the same as using adblock. (the extension mentioned that ads were being used and you could also disable them)

johnward 12y ago

There is a while industry of Pay Per View (PPV) ad networks that basically operate this way. A few that come to mind: Trafficvance, LeadImpact, Media Traffic and DirectCPV. I don't know where Trafficvance gets their traffic but it seems to be pop-over ads probably from some installed software. DirectCPV seems to be interstitial ads that the sites actually choose to use (think big news sites with an ad before you read the article). Most of them seem to be spyware/crapware driven. Those are the only two I've worked with in the past so I can't speak on the others.

chatmasta 12y ago

An ad injector by definition is a proxy that sits somewhere between the user's initial request and the end web server. It could be a local program, a browser extension, a remote proxy, or any proxy on the route of request to response. If it has access to data in transit, it can modify it. Often it doesn't even need access to the data because it can just append a block of javascript to an incoming HTTP response. Obviously this is harmful to users because the implication is that the technique also requires SSL stripping, or trusting invalid root certificates like we saw with Superfish. It's also harmful to advertisers and ad networks because it pollutes tracking data and makes it hard to determine click fraud. But let's not kid ourselves. Google does not care about the user. They simply have no need for ad injectors because they already have far superior methods of tracking us and invasively advertising to us (reading our email, watching our GPS location, knowing when we are home, what videos we watch, etc.) To google this is just a nuisance and they get some free PR for standing up to it along with a respected academic institution. Yay, google! Protector of users! But wait. Isn't this exactly what Verizon, ATT, and Comcast are all doing? Verizon was modifying HTTP headers during the summer. ATT charges users not to inject tracking into packets. Comcast injects HTML into xfinitiwifi connections. How is this any different? Sure, tracking headers do not manifest themselves in annoying pop up ads, but they are still messing with user requests and have almost as many security implications. If Google is going to take a stand against ad injectors, they need to take a stand against all packet injection. These scammy popups are just the bottom of the totem pole. If they could get away with what the big telecoms are doing, they would obvioisly do that instead.

comex 12y ago
Google has mostly transitioned to HTTPS which makes network packet injection/sniffing useless on their sites. Since it's no longer their problem, why do they need to take a stand?
- jacquesm 12y ago
  - ssl stripping - browser extensions
- chatmasta 12y ago

alpeb 12y ago

In the case of chrome extensions and apps, Google was working on an ad solution a couple of years ago but didn't end up releasing anything. In light of no viable monetization solution for this kind of software it's natural devs have to resort to this kind of practices.

ChuckMcM 12y ago

These guys are pretty annoying. And it ads an "untrusted" advertising stream to the page, a channel which has been the source of malware infections in the past. I'm really curious how this all turns out. I can't imagine the deteriorating system lasting another 5 or 10 years. So what happens after? Clearly advertising has _some_ value, I loved BYTE magazine as much for the ads as I did for the articles, and there are under served retailers (a lot of Business to Business stuff) as the trade magazines take hits. So how do people discover this stuff? How do they find those opportunities when Internet ads are dead? Or do we get to a more reasonable advertising load? Something without flash/js jiggling around and trying to get your cursor. How will sites let users know they don't allow "invasive" ads? How will users respond? For me at least I think it is the difference between Web 2 and Web 3.

jacquesm 12y ago
How did you discover websites before advertising took over the web? I don't remember having any trouble discovering new stuff, rather the opposite, word of mouth and following links gave an endless stream of new and interesting stuff. This site alone generates more info in that bracket than I can keep up with (even though I really try to).
- ChuckMcM 12y ago
  GNN ? :-) Generally discovery of web sites wasn't nearly as difficult as discovering new products. Its the flip of that problem that is hard. Which is BYTE would sell advertising to companies that wanted to reach people building/using/programming microcomputers like me. But these days people consume their information from a thousand sources, whether it is a mention here, or an article on reddit, or Ars. So how does the advertiser in the 21st century "reach" the people likely to be interested in new offerings about their particular experitise? And especially how do they do that when the existing mechanism, site advertising networks, has been burned to the ground by abusive ad networks? Do they hire consultants to find and make agreements with the 10 sites they want to "sponsor" for the roll out of Product X ? I don't worry about finding content, but I do wonder how folks who have something cool will reach me.

MBCook 12y ago

> Google and the Berkeley researchers found that ad injectors are now available on all major platforms and browsers. Bull. iOS is a HUGE chunk of web browsing and its immune from this stuff unless you jailbreak or are conned into installing a root cert and VPN. You can't just download an app from the store or visit a site and find it installed like you can on a desktop.

kkamperschroer 12y ago

I'm a Chrome extension author and I've been contacted at least a half-dozen times by shady companies that want me to add some "totally unobtrusive" ad-injection javascript into my extension. I've been told I could make $0.50/user based in the US per month. That would be a nice raise, for sure, but I'm not the type of person willing to sell out my users to make a little extra dough. Plus I am a user of my own extension, and I don't want ad-injection. And how long could one possibly retain users once you start injecting ads? Probably a steady decline until your left with the users that don't know where the ads are coming from. Selfish plug to my extension here: https://chrome.google.com/webstore/detail/musicality-music-player/fjiolbglibkahkipcdgeepdfdgfkdbee https://chrome.google.com/webstore/detail/musicality-music-p...

timedump 12y ago
I know this isn't the place or time, but I got your extension and I would like to request that the archive.org music player be added to it. I do not know how to contact you through your site or send a pm through here or github.
- kkamperschroer 12y ago
  Thanks. I'll add it to my backlog!

pdkl95 12y ago

How is this not simple vandalism? Throw the people responsible in jail. If they are outside the country, freeze their american bank accounts <i>and</i> the bank accounts of any business that advertises with these injected ads. Precedent: we already have laws that, for better or worse, require hardware stores to perform age checks when someone buy spray paint. This isn't primarily a software problem. This is a problem because nobody is enforcing vandalism laws which encourages the adoption of "vandalism as a business model".

jfroma 12y ago

I see ad injectors installed on all my friends and family computers. I think people has developed some kind of ad-blindness. I remember a friend using facebook and some crazy and animated ads were taking 80% of his screen, I asked him "doesn't this bother you?" , he says "meh".