Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/15/2018
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Online Ads vs. Security: An Invisible War

Why visiting one website is like visiting 50, and how you can fight back against malvertisers.

If you've visited a news sites recently, you're probably aware of the war between these sites and ad blockers. It's understandable — these outlets need advertising revenue to make money, so they need their visitors to watch ads.

However, you may be less aware of the invisible war between web complexity and security that's happening because of modern advertising and analytics. Unfortunately, the same mechanisms that allow news sites to quickly add revenue-generating advertisements also lead to horribly complex and potentially insecure Web applications, which criminal "malvertisers" exploit.

To illustrate this complexity-versus-security issue, I visited an average site using one of my favorite security plug-ins: NoScript.

NoScript is a great Firefox browser plug-in that blocks all active scripting such as JavaScript, Java, Flash, ActiveX, etc., on a Web page by default. There are similar extensions, such as ScriptSafe, for other browsers. Doing this helps protect you from many types of web-based attacks, since they usually require scripting to succeed.

Many legitimate sites use scripting for reasonable things such as advertisements, so using these extensions becomes a process of whitelisting the real sites that you want to let run script, while blocking unknown and suspicious domains. Using these plug-ins also shows how many different domains you actually visit when you go to "one" Internet site.

Let's look at an example: CNN.com.

When you first visit CNN.com with a fresh, default installation of NoScript, you don't see much at all because the extension even blocks CNN's scripts. NoScript warns me that it blocked 31 items — a mixture of scripts and fonts.

NoScript's dropdown menu shows all the extra content from other domains that CNN wants to load. I'll begin sparingly, and just allow script and content that comes from CNN's specific domain. This means continuing to ignore script from Chartbeat.com, Optimizely.com, and Sharethrough.com.

I've personally used these plug-ins enough that I recognize those domains and know they're "legitimate." Chartbeat is data visualizing software, Optimizely is a third-party site optimization tool and Sharethrough is advertising software. While I might recognize those domains from experience, how would the average user know this? More importantly, each domain CNN trusts adds more potential attack surface. If one of those third parties is careless, CNN's site and visitors might pay too.

After I trust the CNN.com domain, the site reloads again. This time NoScript allows CNN's scripts to run, and I can start to see some page content. Now NoScript warns that seven more untrusted scripts have tried to run, because the scripts I've allowed from CNN are loading more content from other domains. The image below only represents part of the results, as it scrolls off the page.

This time, I get a little more generous with my trust. I recognize Google, Amazon, Twitter and Bing, so I trust anything with those in the name (even if it isn't the root domain). I figure CNN.io and CNN.net are also part CNN, so I trust those too. Another page reload, and another NoScript result. This time, despite trusting so much more, the site attempts to run 24 newly blocked scripts and loads content from even more domains.

So, I visited one page in my browser — CNN.com — and it loaded content from 47 other domains and ran many scripts from other domains.

In this case, CNN.com isn't compromised, but imagine if CNN did suffer some flaw that allowed attackers to inject code, like a hidden iframe. How would anyone spot one malicious domain, when normal sites typically load so much third-party content already?

Worse yet, what if one of those third parties got compromised? If an advertising network got infected by a criminal that bought ad space for malicious purposes, the hidden iframe might come from one of these other domains CNN is trusting. In fact, malvertising — malicious advertising — campaigns are common nowadays, and often go undetected for long periods of time. A site like CNN makes a great "watering hole" to infect a big pool of victims.

This isn't unique to CNN and I don't mean to pick on it specifically. This issue is that the industry has moved toward accepting complexity as standard practice.

Tools like NoScript let users protect themselves from some of the risks of malicious advertisements, and I suggest everyone use them until the industry simplifies some of these websites or gets smarter about how they deliver targeted ads.

In short, we are at an impasse between ad revenue and security. Sites need to generate revenue, but the complexity from these third-party connections introduces potential insecurities and a wider attack surface. There should be a balance between security and acceptable business risks, but this level of website complexity tips the scales too far away from security.

For more, Corey Nachreiner has a video on the topic, available here

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Check out the security track hereEarly Bird Rates expire Friday March 16. Use Promo Code DR200 & save $200. 

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
3/23/2018 | 10:32:04 AM
Websites no longer are sites
Thanks for starting the discussion - and I think that's what's needed most. 

A core problem is that the concept of a website has changed so dramatically.  Rarely is - A - website - A - place, or the site owner -THE - provider of code and content; or the sole, or even primary, consumer of data extracted from the visitor.  Don't leave out the parts played by (and motivations of), browser vendors or the web-search providers. 

Together, these factors contribute to a diffusion of responsibility for what happens to a "site" visitor - in terms of security, privacy and experience.  The result is that nobody accepts responsibility.   

Is what we have really what we want?  We'll have to look closely at the interplay of motivations that brought us to this situation; and then look at how we might rework the site-visitor-browser paradigm. 
macker490
50%
50%
macker490,
User Rank: Ninja
3/21/2018 | 9:24:49 AM
response options
advertisers are no more likely to  go away than politics or flu season.   what is needed is better browser code with  much of the trash material simply re-directed to NUL

try the new reader plug-in on Firefox.   They did a good job with this.   i think it suggests the direction we need to go in browser coding
Manchester United Suffers Cyberattack
Dark Reading Staff 11/23/2020
As 'Anywhere Work' Evolves, Security Will Be Key Challenge
Robert Lemos, Contributing Writer,  11/23/2020
Cloud Security Startup Lightspin Emerges From Stealth
Kelly Sheridan, Staff Editor, Dark Reading,  11/24/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-29378
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. It is possible to elevate the privilege of a CLI user (to full administrative access) by using the password [email protected]#y$z%x6x7q8c9z) for the e...
CVE-2020-29379
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D4L V1.01.49 and V1600D-MINI V1.01.48 OLT devices. During the process of updating the firmware, the update script starts a telnetd -l /bin/sh process that does not require authentication for TELNET access.
CVE-2020-29380
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-...
CVE-2020-29381
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600D4L V1.01.49, V1600D-MINI V1.01.48, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. Command injection can occur in "upload tftp syslog" and "upload tftp configuration" in the CLI via a crafted filename...
CVE-2020-29382
PUBLISHED: 2020-11-29
An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57, V1600G1 V2.0.7 and V1.9.7, and V1600G2 V1.1.4 OLT devices. A hardcoded RSA private key (specific to V1600D, V1600G1, and V1600G2) is contained in the firmware images.