Endpoint

3/15/2018
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

Online Ads vs. Security: An Invisible War

Why visiting one website is like visiting 50, and how you can fight back against malvertisers.

If you've visited a news sites recently, you're probably aware of the war between these sites and ad blockers. It's understandable — these outlets need advertising revenue to make money, so they need their visitors to watch ads.

Example of a site that explains its position on displaying ads.
Source: Corey Nachreiner
Source: Corey Nachreiner

However, you may be less aware of the invisible war between web complexity and security that's happening because of modern advertising and analytics. Unfortunately, the same mechanisms that allow news sites to quickly add revenue-generating advertisements also lead to horribly complex and potentially insecure Web applications, which criminal "malvertisers" exploit.

To illustrate this complexity-versus-security issue, I visited an average site using one of my favorite security plug-ins: NoScript.

NoScript is a great Firefox browser plug-in that blocks all active scripting such as JavaScript, Java, Flash, ActiveX, etc., on a Web page by default. There are similar extensions, such as ScriptSafe, for other browsers. Doing this helps protect you from many types of web-based attacks, since they usually require scripting to succeed.

Many legitimate sites use scripting for reasonable things such as advertisements, so using these extensions becomes a process of whitelisting the real sites that you want to let run script, while blocking unknown and suspicious domains. Using these plug-ins also shows how many different domains you actually visit when you go to "one" Internet site.

Let's look at an example: CNN.com.

When you first visit CNN.com with a fresh, default installation of NoScript, you don't see much at all because the extension even blocks CNN's scripts. NoScript warns me that it blocked 31 items — a mixture of scripts and fonts.

Visiting CNN with NoScript's default lack of trust.
Source: Corey Nachreiner
Source: Corey Nachreiner

NoScript's dropdown menu shows all the extra content from other domains that CNN wants to load. I'll begin sparingly, and just allow script and content that comes from CNN's specific domain. This means continuing to ignore script from Chartbeat.com, Optimizely.com, and Sharethrough.com.

Content blocked from first CNN visit.
Source: Corey Nachreiner
Source: Corey Nachreiner

I've personally used these plug-ins enough that I recognize those domains and know they're "legitimate." Chartbeat is data visualizing software, Optimizely is a third-party site optimization tool and Sharethrough is advertising software. While I might recognize those domains from experience, how would the average user know this? More importantly, each domain CNN trusts adds more potential attack surface. If one of those third parties is careless, CNN's site and visitors might pay too.

After I trust the CNN.com domain, the site reloads again. This time NoScript allows CNN's scripts to run, and I can start to see some page content. Now NoScript warns that seven more untrusted scripts have tried to run, because the scripts I've allowed from CNN are loading more content from other domains. The image below only represents part of the results, as it scrolls off the page.

Partial NoScript results after allowing only CNN.com.
Source: Corey Nachreiner
Source: Corey Nachreiner

This time, I get a little more generous with my trust. I recognize Google, Amazon, Twitter and Bing, so I trust anything with those in the name (even if it isn't the root domain). I figure CNN.io and CNN.net are also part CNN, so I trust those too. Another page reload, and another NoScript result. This time, despite trusting so much more, the site attempts to run 24 newly blocked scripts and loads content from even more domains.

Third NoScript result after trusting more liberally.
Source: Corey Nachreiner
Source: Corey Nachreiner

By now, you see the trend. CNN's page is loading a ton of scripted content from other third-party domains, which in turn loads more content from other third- parties. In the end, I eventually "trust" every single thing CNN wants me to and get this final list of all the domains CNN.com loads.

Source: Corey Nachreiner
Source: Corey Nachreiner

So, I visited one page in my browser — CNN.com — and it loaded content from 47 other domains and ran many scripts from other domains.

In this case, CNN.com isn't compromised, but imagine if CNN did suffer some flaw that allowed attackers to inject code, like a hidden iframe. How would anyone spot one malicious domain, when normal sites typically load so much third-party content already?

Worse yet, what if one of those third parties got compromised? If an advertising network got infected by a criminal that bought ad space for malicious purposes, the hidden iframe might come from one of these other domains CNN is trusting. In fact, malvertising — malicious advertising — campaigns are common nowadays, and often go undetected for long periods of time. A site like CNN makes a great "watering hole" to infect a big pool of victims.

This isn't unique to CNN and I don't mean to pick on it specifically. This issue is that the industry has moved toward accepting complexity as standard practice.

Tools like NoScript let users protect themselves from some of the risks of malicious advertisements, and I suggest everyone use them until the industry simplifies some of these websites or gets smarter about how they deliver targeted ads.

In short, we are at an impasse between ad revenue and security. Sites need to generate revenue, but the complexity from these third-party connections introduces potential insecurities and a wider attack surface. There should be a balance between security and acceptable business risks, but this level of website complexity tips the scales too far away from security.

For more, Corey Nachreiner has a video on the topic, available here

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Check out the security track hereEarly Bird Rates expire Friday March 16. Use Promo Code DR200 & save $200. 

Corey Nachreiner regularly contributes to security publications and speaks internationally at leading industry trade shows like RSA. He has written thousands of security alerts and educational articles and is the primary contributor to the WatchGuard Security Center blog, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
3/23/2018 | 10:32:04 AM
Websites no longer are sites
Thanks for starting the discussion - and I think that's what's needed most. 

A core problem is that the concept of a website has changed so dramatically.  Rarely is - A - website - A - place, or the site owner -THE - provider of code and content; or the sole, or even primary, consumer of data extracted from the visitor.  Don't leave out the parts played by (and motivations of), browser vendors or the web-search providers. 

Together, these factors contribute to a diffusion of responsibility for what happens to a "site" visitor - in terms of security, privacy and experience.  The result is that nobody accepts responsibility.   

Is what we have really what we want?  We'll have to look closely at the interplay of motivations that brought us to this situation; and then look at how we might rework the site-visitor-browser paradigm. 
macker490
50%
50%
macker490,
User Rank: Ninja
3/21/2018 | 9:24:49 AM
response options
advertisers are no more likely to  go away than politics or flu season.   what is needed is better browser code with  much of the trash material simply re-directed to NUL

try the new reader plug-in on Firefox.   They did a good job with this.   i think it suggests the direction we need to go in browser coding
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
The Case for a Human Security Officer
Ira Winkler, CISSP, President, Secure Mentem,  12/5/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8651
PUBLISHED: 2018-12-12
A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV server, aka "Microsoft Dynamics NAV Cross Site Scripting Vulnerability." This affects Microsoft Dynamics NAV.
CVE-2018-8652
PUBLISHED: 2018-12-12
A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Scripting Vulnerability." This affects Windows Azure Pack Rollup 13.1.
CVE-2018-8617
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8618
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8...
CVE-2018-8619
PUBLISHED: 2018-12-12
A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions, aka "Internet Explorer Remote Code Execution Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Exp...