Frequent Slashdot contributor Bennett Haselton contributes the following piece on trying to get some measure of satisfaction in the struggle against pop-up adds, writing
“The most annoying thing about some pop-up ads, is that you have no way of knowing which ad-serving network served them or who the responsible parties are. Could we reduce the incidence of illegal or deceptive pop-up ads, by giving users an easier way to trace their origin and figure out where to send complaints? Here’s one way to do it with a simple right-click.”
Read on for the rest.
Occasionally while I’m surfing the web and a pop-up ad opens, my Norton
Anti-Virus will alert me that it blocked an “attack” on my computer,
and then in Norton’s logs of recently blocked attacks, it gives the URL
of the content inside the pop-up ad that was blocked.
Sometimes it indicates whether the “threat” was blocked under the
category “scareware” (an ad that mimics a program scanning your PC for
viruses and then claiming to find “infections,” which you have to remove
by purchasing the advertiser’s software) or “malware” (an advertiser’s
page that tries to infect your computer directly by using JavaScript
tricks to get around the browser’s security features). I’m glad that
Norton blocks the malware attacks, since even though I always have all the
latest security patches installed for Internet Explorer, it’s always possible
that an attacker could be using an exploit that hasn’t been patched yet.
I don’t really care about blocking the “scareware” ads, because I’m not going
to fall for an ad that claims to be scanning my PC for viruses, but most
Norton customers probably appreciate blocking those ads as well.
The problem in both cases is that it’s hard even for an experienced user,
and almost impossible for a novice user, to know where to send a complaint about
the content in a pop-up window. You can usually figure out the URL of the content
in the pop-up window (just right-click the window content and pick “Properties”
in Internet Explorer or “View Page Info” in Firefox), but often the
content itself is being served from an IP address in a jurisdiction like China
or Cyprus where malicious operators are hard to shut down.
What you really want is for them to stop serving their dangerous ads on reputable
websites through the ad network.
You could complain to the owner
of the website that you’re browsing, and say that a pop-up ad window from their site got blocked
by Norton as a “virus,” but if their site rotates ads from different providers,
the site owner would have no way of knowing which advertising network served the
ad. Even if you know the URL of the malicious content that was in the pop-up
window, that’s not enough to tell which advertising network it was served from
(because ad networks typically don’t serve the ads from their own domain; they
just serve a redirect, which causes the browser to load the pop-up ad’s contents from
the advertiser’s domain).
And even if you know which advertiser network served
the ad, and the URL that the malicious pop-up content was served from
(say, http://www.evilsite.cn/popup.html), so you can take your
complaint directly to the advertising network, that may still not be enough information
for them to figure out which of their advertisers served the malicious content and
needs to be booted out of the network. Because all the advertiser network has is a
list of ad pages for their different advertisers (http://www.advertiser-1.com/ad.html,
http://www.adveritser-2.com/ad.html, etc.) — the advertiser buys the right to show ads,
and the ad network displays ads that load content from those ad content pages.
If one of those pages — say, http://www.adveritser-2.com/ad.html — redirects the
user’s browser to http://www.evilsite.cn/popup.html, the advertiser network has no way
of knowing which advertiser is doing that. They would have to go through and check
the ad-serving pages (http://www.advertiser-1.com/ad.html, http://www.adveritser-2.com/ad.html,
and so one one at a time)
for each of their advertisers, to see which of those pages redirect to
http://www.evilsite.cn/popup.html — and by the time they do that, the advertiser might have altered
the page so that it no longer redirects to the malicious content. While it’s pretty
straightforward to figure out what URL the malicious content is being loaded from, it’s
very difficult to figure out the chain of events that redirected you there, and who the
responsible parties are.
So here’s an idea for a simple browser feature that would make it a lot easier to hold
malicious advertisers accountable, and get them kicked out of honest ad-serving networks.
Simply give the user a way to right-click on the top
of a browser window, and pick “View window origin” or something similar. This would
display the sequence of redirects that opened the window, something like this:
Browser was visiting http://www.cnn.com/
http://www.cnn.com/ loaded JavaScript from http://www.advertiser-network.com/ads.js
http://www.advertiser-network.com/ads.js redirected browser to http://www.advertiser-2.com/ad.html
http://www.advertiser-2.com/ad.html redirected browser to http://www.evilsite.cn/popup.html
Then, if the user views an ad that is obviously scareware (or if Norton blocks the contents from
loading and gives that as a reason), then the user can just right-click on the window and see
the list of redirects. The user could then e-mail that to the website owner with a suggestion to do
something about it (“The ad network on your page, has been infiltrated by an advertiser who is
using the ad network to serve malicious content”), or the user could take the complaint to
the advertiser network. The advertiser network would be able to see from the log, exactly which
of their advertisers’ ad.html pages served the malicious content.
(Yes, this comes on the heels of my article arguing that we should allow
more intrusive ads
as a way to help pay for services that can’t finance themselves with normal pop-up ads.
This may strike some people as “ironic” who haven’t thought about it very carefully. Getting
users to give larger amounts of their attention in exchange for premium service, is an honest
and mutually beneficial
transaction; scaring users with deceptive ads, or using ad space to try to infect their computer,
is not. I think that Starbucks has the right to charge whatever they want for coffee;
that doesn’t mean they have the right to pee in your coffee.)
In order for this window-history-tracing feature
to make a difference, at least the following two conditions also
have to be true:
- The advertiser network has to be honest (honest enough to kick out advertisers who they
know are serving malicious content), or at least, be located in a jurisdiction where they
have to worry about being sued or prosecuted if they don’t kick bad apples out of their
network.
- When the malicious ads are served, enough users have to complain about them that the
advertiser network takes notice. You wouldn’t want the advertiser network to take action
just based on a single complaint, since then anyone with a grudge could file a phony complaint
against an advertiser in order to get them shut down, but if complaints start coming in from
several sources, then they should investigate.
Fortunately, these would be likely to be true in many if not most cases where malicious pop-up
windows are being served. With regard to the first condition,
I’ve dealt with several advertising networks to find ads to serve
on the proxy sites that I run, and they were all based out of law-and-order countries (the U.S.,
Canada, Israel, i.e. not China or Kazahkstan). As for the second condition, the advertiser
would probably have to serve the ad to many different users in order to achieve their goal –
whether their goal is
to infect users’ machines, or to get them to buy the advertiser’s fake anti-virus software,
or whatever –
and as long as a fixed percentage of users viewing the malicious ads are inclined to file complaints
about them, then the more the ads are served, the more complaints will come in until the ads are
taken out of rotation.
Of course, if the URL that’s actually serving the malicious content, is located in
a law-and-order country, you could always just complain to the admins of the network where the
content is being hosted. But that’s likely to be less effective, since (a) the actual URLs
that I’ve seen serving the malicious content, usually are located in cybercrime-infested
nations like China, and (b) even if you get one of those sites shut down, the advertiser
can instantly rotate in other sites with the same content,
and make that the new URL that users are redirected to.
It is also of course true that some pop-up ads are spawned not by websites, but by malicious programs
that actually infect your machine and force your browser to display pop-up windows. If some browser
maker adopted the feature I’m suggesting, and stored a user-viewable “history” associated with
each pop-up window, then a malicious program running on your machine might even be able to spoof
the history associated with a pop-up window, so that the user would right-click on it and think
it came from http://www.cnn.com/ instead of being spawned by malware. Once the user has their
machine infected by a rogue program, nothing that any other application tells them can really
be trusted after that point. So an advertiser network would have to be careful not to take
action against an innocent third party, just based on a flood of complaints that were sent in by
people whose machines were infected by malware that spoofs the origin of the pop-up windows.
Fortunately, if the allegedly malicious ad is still in rotation, it would be easy for
the advertiser network to check the validity of the complaint, by simply going to the advertiser’s
ad-content page, and seeing if it redirects to the malicious content. If it does, then you have
grounds to boot the advertiser out of the network.
(You’d want to check the page’s content
from some anonymous IP address not affiliated with the advertiser network though. Otherwise,
the advertiser might try to fool the ad network people, by showing “innocent” content when
the page is loaded from the IP addresses associated with the ad network’s office, and serving
the scareware content to everybody else. Just trying to think of everything here.)
I’m sure there are other counter-strategies and counter-counter-strategies that would have to
be taken into account, and kinks to be worked out, but probably not fatal to the whole idea.
If a pop-up window opens on the user’s computer that is possibly illegal, it is probably a good
thing to give the user the tools to figure out where the ad came from, and which advertiser network
to complain to. Right now, the ad window just floats there, and it’s maddening not to have any
way of knowing which ad-serving network put it there, or even if you can identify the ad-serving
network, which of their advertisers created the content.
The main obstacle standing in the way of a major browser maker implementing this, may be that it
doesn’t bring any particular benefit to the users of that browser.
When Microsoft adds SmartScreen to
Internet Explorer, they can now claim that IE users are better-protected than users of other
browsers. On the other hand, if the Mozilla Foundation adds the pop-up window right-click-history
feature to their browser, they can’t legitimately claim that Firefox users are better
protected, since this feature wouldn’t actually block anything.
Firefox users would simply be better equipped to complain about malicious
pop-up windows, and increase the chances of those rogue advertisements being taken down, or at
least kicked out of ad networks where they would do the most damage. However, the benefits
of that increased policing, would accrue to all Internet users, not just Firefox users.
Still, abuse desks get so many complaints about spam and spammers, that there are apparently
plenty of people out there who get enough satisfaction from complaining about net abuse, that
they would make use of the pop-up window-tracing feature if they had it. I know that when I
see a stupid ad pretending to “scan” my computer for viruses, I get unreasonably
disgusted, not from seeing the ad itself (which I can easily ignore), but from knowing
that the advertiser has probably fleeced people of thousands of dollars with that ad.
It would be nice to be able to help stop them before they cheat the next person.
Source: Window Pain
The Iraq war and its aftermath have left physical and psychic wounds on both local residents who lived through the American invasion and many U.S. soldiers. But anecdotal reports suggest that another demographic may have suffered as well: unborn babies. Doctors in Fallujah, Iraq have reported a high number of children born with birth deformities ever since the massive battle between Iraqi insurgents and U.S. forces that raged there in 2004.
An Italian court in Milan has just convicted three 