News: 1634184130

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Ad-blocking browser extension actually adds ads, say Imperva researchers

(2021/10/14)


Security vendor Imperva’s research labs have found a browser extension that claims to block ads, but actually injects them into Chrome or Opera.

A [1]post from Imperva staffers Johann Sillam and Ron Masas names an extension called [2]AllBlock as the culprit.

The extension does block ads, they write. But it also runs a background script that injects a snippet of JavaScript code into every new tab that users open.

[3]

That code snippet talks to remote servers and downloads a payload that Imperva claims is connected to operators of an ad-injection scam.

[4]

That scam, Silland and Masas observe, pipes in ads other than those from legitimate sources that would otherwise appear on a web page. Some of those ads include affiliate links – whoever is behind this extension could be skimming commissions from netizens that click on injected ads.

[5]Thousands of internet-connected databases contain high or critical CVEs, says report by cloud security biz

[6]Firefox to adopt Chrome's new approach to extensions – sans the part that threatens ad blockers

[7]Google Chrome's crackdown on ad blockers and browser extensions, Manifest v3, is now available in beta

Google has often said it takes the security of Chrome extensions seriously, and vets them to stop all sorts of naughtiness. It looks like those processes have not worked brilliantly on this occasion – even though this scheme has the potential to rob Google of revenue. Opera's fateful decision to offer compatibility with Chrome extensions means it gets smeared by association.

Imperva has some issues, too. As The Register read its post to compile this story, we noticed that Imperva.com offers to install software called "Cyber Security Leader". The company’s site also includes a Chatbot that creates notifications in a Chrome tab.

It's not just bad actors that mess with browsers. ®

Get our [8]Tech Resources



[1] https://www.imperva.com/blog/the-ad-blocker-that-injects-ads/

[2] https://chrome.google.com/webstore/detail/allblock/nfofcmcpljmjdningbllljenopcmdhjf?hl=en

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YWf-7YvjiDIhydvhPyuWNQAAAIQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YWf-7YvjiDIhydvhPyuWNQAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2021/09/14/imperva_12k_database_vuln_report/

[6] https://www.theregister.com/2021/05/28/mozilla_chrome_mozilla/

[7] https://www.theregister.com/2020/12/10/googles_browser_extension_platform_rewrite/

[8] https://whitepapers.theregister.com/



TFTFY

Joe W

Opera's fateful decision to offer compatibility with Chrome extensions abandon its own browser enginge in favour of Chromeium, alienating many long-term users and supporters in that process, means it gets smeared by association.

Bitter? Me?

Well, they broke Opera for me earlier than that, much loved features were gone in an earlier version already. So changing their engine to Chrome was more of a "meh" moment for me.

What browser engines still exist for the desktop? Well, top of my head, Chrome (blink?), whatver Firefox is based on, and Safari (only Mac - no, wait, that's Chrome as well, isn't it?). There's Palemoon and Waterfox and other forks using the old Firefox, and whatever Konqueror uses (yeah...). Oh, and Lynx. Hmmm. So basically we have two (major, mainstream) broser families left: Firefox and everything else. Pity.

Giles C

No Safari is based on WebKit not chrome.

Joe W

I sit corrected - thanks! have one of those -->

(or maybe a coffee... I'll get me one as well).

I sort of ignore all things Apple, maybe that's why I messed that up. Sure, looks shiny but I struggle with IOs (don't find it intuitive - at all), and the UI of MacOS (whatever the correct name is) is... not really to my taste (which is why I find Win11 horriffic, it's even worse). The only good thing about MacOS is that it is BSD based, but then there are strange things like when the UI messes up the cases in file names (strange, BSD is after all case sensitive, Mac seems to try and hide it from the user). Plays all sorts of havoc with git.

Learned something new today, can stop working now (yeah, I wish).

katrinab

Chromium is a fork of WebKit, WebKit is a fork of khtml.

Meanwhile, at Google towers...

Anonymous Coward

...they're wondering why they didn't think of this themselves.

Re: Meanwhile, at Google towers...

veti

Err... They don't need to? Their clients already pay them a truckload to do much the same thing but on the server, which is more reliable anyway.

RPrior

What are your Browser concerns.

My highest priority is to minimise intrusions into my chosen website whilst viewing.

The "shields up" sytem offered by Brave Browser (and proprietary search engine) accomplishes this task to my perfection

I am much more concerned about the ease of reviewing websites than I am about anything else.

Brave - Shields Up - status on Google.com

13-150 items blocked - more items blocked each time page is re-opened

- Tracker and Ads Blocker

- Connections upgraded to https

- Scripts blocked

- Cross-site cookies blocked

- Fingerprinting blocked

Deleted Chrome some weeks ago. Latest versions are resource hungry and intrusive.

A long time ago, I was a tech guru for Price Waterhouse and introduced private Text based Search engine capabilities years before Google existed.

Two wrongs are only the beginning.
-- Kohn