Online Ads vs. Security: An Invisible War

If you've visited a news sites recently, you're probably aware of the war between these sites and ad blockers. It's understandable — these outlets need advertising revenue to make money, so they need their visitors to watch ads.

However, you may be less aware of the invisible war between web complexity and security that's happening because of modern advertising and analytics. Unfortunately, the same mechanisms that allow news sites to quickly add revenue-generating advertisements also lead to horribly complex and potentially insecure Web applications, which criminal "malvertisers" exploit.

To illustrate this complexity-versus-security issue, I visited an average site using one of my favorite security plug-ins: NoScript.

NoScript is a great Firefox browser plug-in that blocks all active scripting such as JavaScript, Java, Flash, ActiveX, etc., on a Web page by default. There are similar extensions, such as ScriptSafe, for other browsers. Doing this helps protect you from many types of web-based attacks, since they usually require scripting to succeed.

Many legitimate sites use scripting for reasonable things such as advertisements, so using these extensions becomes a process of whitelisting the real sites that you want to let run script, while blocking unknown and suspicious domains. Using these plug-ins also shows how many different domains you actually visit when you go to "one" Internet site.

Let's look at an example: CNN.com.

When you first visit CNN.com with a fresh, default installation of NoScript, you don't see much at all because the extension even blocks CNN's scripts. NoScript warns me that it blocked 31 items — a mixture of scripts and fonts.

Source: Corey Nachreiner

NoScript's dropdown menu shows all the extra content from other domains that CNN wants to load. I'll begin sparingly, and just allow script and content that comes from CNN's specific domain. This means continuing to ignore script from Chartbeat.com, Optimizely.com, and Sharethrough.com.

Source: Corey Nachreiner

I've personally used these plug-ins enough that I recognize those domains and know they're "legitimate." Chartbeat is data visualizing software, Optimizely is a third-party site optimization tool and Sharethrough is advertising software. While I might recognize those domains from experience, how would the average user know this? More importantly, each domain CNN trusts adds more potential attack surface. If one of those third parties is careless, CNN's site and visitors might pay too.

After I trust the CNN.com domain, the site reloads again. This time NoScript allows CNN's scripts to run, and I can start to see some page content. Now NoScript warns that seven more untrusted scripts have tried to run, because the scripts I've allowed from CNN are loading more content from other domains. The image below only represents part of the results, as it scrolls off the page.

Source: Corey Nachreiner

This time, I get a little more generous with my trust. I recognize Google, Amazon, Twitter and Bing, so I trust anything with those in the name (even if it isn't the root domain). I figure CNN.io and CNN.net are also part CNN, so I trust those too. Another page reload, and another NoScript result. This time, despite trusting so much more, the site attempts to run 24 newly blocked scripts and loads content from even more domains.

Source: Corey Nachreiner

By now, you see the trend. CNN's page is loading a ton of scripted content from other third-party domains, which in turn loads more content from other third- parties. In the end, I eventually "trust" every single thing CNN wants me to and get this final list of all the domains CNN.com loads.

Source: Corey Nachreiner

So, I visited one page in my browser — CNN.com — and it loaded content from 47 other domains and ran many scripts from other domains.

In this case, CNN.com isn't compromised, but imagine if CNN did suffer some flaw that allowed attackers to inject code, like a hidden iframe. How would anyone spot one malicious domain, when normal sites typically load so much third-party content already?

Worse yet, what if one of those third parties got compromised? If an advertising network got infected by a criminal that bought ad space for malicious purposes, the hidden iframe might come from one of these other domains CNN is trusting. In fact, malvertising — malicious advertising — campaigns are common nowadays, and often go undetected for long periods of time. A site like CNN makes a great "watering hole" to infect a big pool of victims.

This isn't unique to CNN and I don't mean to pick on it specifically. This issue is that the industry has moved toward accepting complexity as standard practice.

Tools like NoScript let users protect themselves from some of the risks of malicious advertisements, and I suggest everyone use them until the industry simplifies some of these websites or gets smarter about how they deliver targeted ads.

In short, we are at an impasse between ad revenue and security. Sites need to generate revenue, but the complexity from these third-party connections introduces potential insecurities and a wider attack surface. There should be a balance between security and acceptable business risks, but this level of website complexity tips the scales too far away from security.

For more, Corey Nachreiner has a video on the topic, available here. 

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Check out the security track here. Early Bird Rates expire Friday March 16. Use Promo Code DR200 & save $200.