Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/15/2018
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Online Ads vs. Security: An Invisible War

Why visiting one website is like visiting 50, and how you can fight back against malvertisers.

If you've visited a news sites recently, you're probably aware of the war between these sites and ad blockers. It's understandable — these outlets need advertising revenue to make money, so they need their visitors to watch ads.

However, you may be less aware of the invisible war between web complexity and security that's happening because of modern advertising and analytics. Unfortunately, the same mechanisms that allow news sites to quickly add revenue-generating advertisements also lead to horribly complex and potentially insecure Web applications, which criminal "malvertisers" exploit.

To illustrate this complexity-versus-security issue, I visited an average site using one of my favorite security plug-ins: NoScript.

NoScript is a great Firefox browser plug-in that blocks all active scripting such as JavaScript, Java, Flash, ActiveX, etc., on a Web page by default. There are similar extensions, such as ScriptSafe, for other browsers. Doing this helps protect you from many types of web-based attacks, since they usually require scripting to succeed.

Many legitimate sites use scripting for reasonable things such as advertisements, so using these extensions becomes a process of whitelisting the real sites that you want to let run script, while blocking unknown and suspicious domains. Using these plug-ins also shows how many different domains you actually visit when you go to "one" Internet site.

Let's look at an example: CNN.com.

When you first visit CNN.com with a fresh, default installation of NoScript, you don't see much at all because the extension even blocks CNN's scripts. NoScript warns me that it blocked 31 items — a mixture of scripts and fonts.

NoScript's dropdown menu shows all the extra content from other domains that CNN wants to load. I'll begin sparingly, and just allow script and content that comes from CNN's specific domain. This means continuing to ignore script from Chartbeat.com, Optimizely.com, and Sharethrough.com.

I've personally used these plug-ins enough that I recognize those domains and know they're "legitimate." Chartbeat is data visualizing software, Optimizely is a third-party site optimization tool and Sharethrough is advertising software. While I might recognize those domains from experience, how would the average user know this? More importantly, each domain CNN trusts adds more potential attack surface. If one of those third parties is careless, CNN's site and visitors might pay too.

After I trust the CNN.com domain, the site reloads again. This time NoScript allows CNN's scripts to run, and I can start to see some page content. Now NoScript warns that seven more untrusted scripts have tried to run, because the scripts I've allowed from CNN are loading more content from other domains. The image below only represents part of the results, as it scrolls off the page.

This time, I get a little more generous with my trust. I recognize Google, Amazon, Twitter and Bing, so I trust anything with those in the name (even if it isn't the root domain). I figure CNN.io and CNN.net are also part CNN, so I trust those too. Another page reload, and another NoScript result. This time, despite trusting so much more, the site attempts to run 24 newly blocked scripts and loads content from even more domains.

So, I visited one page in my browser — CNN.com — and it loaded content from 47 other domains and ran many scripts from other domains.

In this case, CNN.com isn't compromised, but imagine if CNN did suffer some flaw that allowed attackers to inject code, like a hidden iframe. How would anyone spot one malicious domain, when normal sites typically load so much third-party content already?

Worse yet, what if one of those third parties got compromised? If an advertising network got infected by a criminal that bought ad space for malicious purposes, the hidden iframe might come from one of these other domains CNN is trusting. In fact, malvertising — malicious advertising — campaigns are common nowadays, and often go undetected for long periods of time. A site like CNN makes a great "watering hole" to infect a big pool of victims.

This isn't unique to CNN and I don't mean to pick on it specifically. This issue is that the industry has moved toward accepting complexity as standard practice.

Tools like NoScript let users protect themselves from some of the risks of malicious advertisements, and I suggest everyone use them until the industry simplifies some of these websites or gets smarter about how they deliver targeted ads.

In short, we are at an impasse between ad revenue and security. Sites need to generate revenue, but the complexity from these third-party connections introduces potential insecurities and a wider attack surface. There should be a balance between security and acceptable business risks, but this level of website complexity tips the scales too far away from security.

For more, Corey Nachreiner has a video on the topic, available here

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Check out the security track hereEarly Bird Rates expire Friday March 16. Use Promo Code DR200 & save $200. 

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
macker490
50%
50%
macker490,
User Rank: Ninja
3/21/2018 | 9:24:49 AM
response options
advertisers are no more likely to  go away than politics or flu season.   what is needed is better browser code with  much of the trash material simply re-directed to NUL

try the new reader plug-in on Firefox.   They did a good job with this.   i think it suggests the direction we need to go in browser coding
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
3/23/2018 | 10:32:04 AM
Websites no longer are sites
Thanks for starting the discussion - and I think that's what's needed most. 

A core problem is that the concept of a website has changed so dramatically.  Rarely is - A - website - A - place, or the site owner -THE - provider of code and content; or the sole, or even primary, consumer of data extracted from the visitor.  Don't leave out the parts played by (and motivations of), browser vendors or the web-search providers. 

Together, these factors contribute to a diffusion of responsibility for what happens to a "site" visitor - in terms of security, privacy and experience.  The result is that nobody accepts responsibility.   

Is what we have really what we want?  We'll have to look closely at the interplay of motivations that brought us to this situation; and then look at how we might rework the site-visitor-browser paradigm. 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...