How Tracking Companies Circumvented Ad Blockers Using WebSockets - PowerPoint PPT Presentation


 How Tracking Companies Circumvented Ad Blockers Using WebSockets Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson 
 Northeastern University

Online Tracking 2

Online Tracking Surge in online advertising (internet economy) • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. 2

Online Tracking Surge in online advertising (internet economy) • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. User concern over tracking • Led to the proliferation of ad blocking extensions 2

Online Tracking Surge in online advertising (internet economy) • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. User concern over tracking • Led to the proliferation of ad blocking extensions Ad networks fight back • E.g Using anti ad blocking scripts 2

Google & Safari • Google evaded Safari’s third-party cookie blocking policy (Jonathan Mayer) • … by submitting a form in an invisible iFrame • Google was fined $22.5M by FTC 3

This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4

This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 1. What caused this? 2. How this bug was leveraged by ad networks? 4

Web Sockets 5

Web Sockets HTTP/S 5

Web Sockets request HTTP/S response 5

Web Sockets request HTTP/S response Chatting App 5

Web Sockets request HTTP/S response anything new? Chatting App 5

Web Sockets request HTTP/S response anything new? Chatting App Web Socket 5

Web Sockets request HTTP/S response anything new? Chatting App bidirectional Web Socket • Both client and server can send/receive data • This is a persistent connection 5

Web Sockets request HTTP/S response anything new? Chatting App bidirectional Web Socket ws:// or wss:// • Both client and server can send/receive data • This is a persistent connection 5

Ad Blockers 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Usually borrowed 
 Rule List from EasyList 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList http://doubleclick.com/s1.js webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList url http://doubleclick.com/s1.js webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList url http://doubleclick.com/s1.js webRequest API 6

Ad Blockers • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API url Usually borrowed 
 Rule List from EasyList url http://doubleclick.com/s1.js webRequest API 6

AdBlock Evasion 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API 2012 2013 2014 2016 2017 2018 2015 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API Original bug 
 reported 2012 2013 2014 2016 2017 2018 2015 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API Users report 
 unblocked ads Original bug 
 reported 2012 2013 2014 2016 2017 2018 2015 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API Users report 
 Patch unblocked ads Finalized 
 Original bug 
 ( Landed) reported 2012 2013 2014 2016 2017 2018 2015 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API Users report 
 Patch unblocked ads Finalized 
 Original bug 
 ( Landed) reported 2012 2013 2014 2016 2017 2018 2015 Chrome 58 
 released 7

AdBlock Evasion • Bug in webRequest API • ws/wss requests did not trigger the API Users report 
 Patch unblocked ads Finalized 
 Original bug 
 ( Landed) reported * * * * 2012 2013 2014 2016 2017 2018 2015 Chrome 58 
 released * Represents when our crawls were done 7

Data Crawling 8

Data Crawling 100K websites 
 sampled from Alexa 8

Data Crawling Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website Filter 
 WebSockets Filter all resources which end in 
 web sockets 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website Filter 
 WebSockets Filter all resources which end in 
 web sockets Mark web sockets 
 Detect A&A 
 which are used by WebSockets A&A domains A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website Filter 
 WebSockets Example Inclusion Tree pub/ Filter all resources index.html which end in 
 web sockets Mark web sockets 
 srv.ws ads/ Detect A&A 
 which are used by WebSockets script.js A&A domains ads/ frame.html A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs ads/ adnet/ img_a.jpg data.ws 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website Filter 
 WebSockets Example Inclusion Tree pub/ Filter all resources index.html which end in 
 web sockets Mark web sockets 
 srv.ws ads/ Detect A&A 
 which are used by WebSockets script.js A&A domains WebSocket ads/ frame.html A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs ads/ adnet/ img_a.jpg data.ws WebSocket 8

This means we know Data Crawling which resource included which other resource Collected chains for 100K websites 
 all included sampled from Alexa Visit 15 
 resources links / website Filter 
 WebSockets Example Inclusion Tree pub/ Filter all resources index.html which end in 
 web sockets Mark web sockets 
 srv.ws ads/ Detect A&A 
 which are used by WebSockets script.js A&A domains WebSocket ads/ frame.html A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs adnet/ data.ws WebSocket 8