Ad-blocking browser extension actually adds ads, say Imperva researchers
- Reference: 1634184130
- News link: https://www.theregister.co.uk/2021/10/14/ad_blocker_injects_bad_ads/
- Source link:
A [1]post from Imperva staffers Johann Sillam and Ron Masas names an extension called [2]AllBlock as the culprit.
The extension does block ads, they write. But it also runs a background script that injects a snippet of JavaScript code into every new tab that users open.
[3]
That code snippet talks to remote servers and downloads a payload that Imperva claims is connected to operators of an ad-injection scam.
[4]
That scam, Silland and Masas observe, pipes in ads other than those from legitimate sources that would otherwise appear on a web page. Some of those ads include affiliate links – whoever is behind this extension could be skimming commissions from netizens that click on injected ads.
[5]Thousands of internet-connected databases contain high or critical CVEs, says report by cloud security biz
[6]Firefox to adopt Chrome's new approach to extensions – sans the part that threatens ad blockers
[7]Google Chrome's crackdown on ad blockers and browser extensions, Manifest v3, is now available in beta
Google has often said it takes the security of Chrome extensions seriously, and vets them to stop all sorts of naughtiness. It looks like those processes have not worked brilliantly on this occasion – even though this scheme has the potential to rob Google of revenue. Opera's fateful decision to offer compatibility with Chrome extensions means it gets smeared by association.
Imperva has some issues, too. As The Register read its post to compile this story, we noticed that Imperva.com offers to install software called "Cyber Security Leader". The company’s site also includes a Chatbot that creates notifications in a Chrome tab.
It's not just bad actors that mess with browsers. ®
Get our [8]Tech Resources
[1] https://www.imperva.com/blog/the-ad-blocker-that-injects-ads/
[2] https://chrome.google.com/webstore/detail/allblock/nfofcmcpljmjdningbllljenopcmdhjf?hl=en
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YWf-7YvjiDIhydvhPyuWNQAAAIQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWf-7YvjiDIhydvhPyuWNQAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/09/14/imperva_12k_database_vuln_report/
[6] https://www.theregister.com/2021/05/28/mozilla_chrome_mozilla/
[7] https://www.theregister.com/2020/12/10/googles_browser_extension_platform_rewrite/
[8] https://whitepapers.theregister.com/
No Safari is based on WebKit not chrome.
I sit corrected - thanks! have one of those -->
(or maybe a coffee... I'll get me one as well).
I sort of ignore all things Apple, maybe that's why I messed that up. Sure, looks shiny but I struggle with IOs (don't find it intuitive - at all), and the UI of MacOS (whatever the correct name is) is... not really to my taste (which is why I find Win11 horriffic, it's even worse). The only good thing about MacOS is that it is BSD based, but then there are strange things like when the UI messes up the cases in file names (strange, BSD is after all case sensitive, Mac seems to try and hide it from the user). Plays all sorts of havoc with git.
Learned something new today, can stop working now (yeah, I wish).
Chromium is a fork of WebKit, WebKit is a fork of khtml.
Meanwhile, at Google towers...
...they're wondering why they didn't think of this themselves.
Re: Meanwhile, at Google towers...
Err... They don't need to? Their clients already pay them a truckload to do much the same thing but on the server, which is more reliable anyway.
What are your Browser concerns.
My highest priority is to minimise intrusions into my chosen website whilst viewing.
The "shields up" sytem offered by Brave Browser (and proprietary search engine) accomplishes this task to my perfection
I am much more concerned about the ease of reviewing websites than I am about anything else.
Brave - Shields Up - status on Google.com
13-150 items blocked - more items blocked each time page is re-opened
- Tracker and Ads Blocker
- Connections upgraded to https
- Scripts blocked
- Cross-site cookies blocked
- Fingerprinting blocked
Deleted Chrome some weeks ago. Latest versions are resource hungry and intrusive.
A long time ago, I was a tech guru for Price Waterhouse and introduced private Text based Search engine capabilities years before Google existed.
TFTFY
Opera's fateful decision to offer compatibility with Chrome extensions abandon its own browser enginge in favour of Chromeium, alienating many long-term users and supporters in that process, means it gets smeared by association.
Bitter? Me?
Well, they broke Opera for me earlier than that, much loved features were gone in an earlier version already. So changing their engine to Chrome was more of a "meh" moment for me.
What browser engines still exist for the desktop? Well, top of my head, Chrome (blink?), whatver Firefox is based on, and Safari (only Mac - no, wait, that's Chrome as well, isn't it?). There's Palemoon and Waterfox and other forks using the old Firefox, and whatever Konqueror uses (yeah...). Oh, and Lynx. Hmmm. So basically we have two (major, mainstream) broser families left: Firefox and everything else. Pity.