adblockingand counter-blocking - steven murdoch · • anti-adblockers are employed by at least6.7%...
TRANSCRIPT
![Page 1: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/1.jpg)
Adblocking andCounter-Blocking
JuliaE.Powles
EmilianoDeCristofaro
HamedHaddadi
StevenMurdoch
RishabNithyanand
SheharbanoKhattak
MobinJaved
Narseo Vallina-Rodriguez
MarjanFalahrastegar
![Page 2: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/2.jpg)
Now…oursponsors
Skippingslidein15seconds
![Page 3: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/3.jpg)
Or…Turnoffyouradblocker toproceed
![Page 4: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/4.jpg)
Inthispaper,we…
• Understandthecurrentstateofthecontentprovidervs. adblocker armsrace
AdobeandPageFair 2015adblocking report
August ‘15 March‘16
IABTechLabPublisherAdblocking Primer
March‘16
Eyeo wins5th straightcaseinGermany
Popularwebsitesdeployanti-adblockers
Securityandprivacyactivistsfightback
April ‘16
Andimmediatelyfacemalvertising scares
![Page 5: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/5.jpg)
Inthispaper,we…• Understandthecurrentstateofthecontentprovidervs. adblocker armsrace
• Howwidespreadareanti-adblockers?• Anti-adblockers:Adblocker blockersanddetectors.
• Whatsitesareemployingthem?
• Whoarethemostpopularvendorsofanti-adblockers?
• Howdothepopularanti-adblockerswork?
• Canadblockers blockanti-adblockers?• Or,canadblockers blockadblocker blockers?
![Page 6: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/6.jpg)
Howwidespreadareanti-adblockers?
• CrawlanddownloadallJSes intheAlexaT-5K.• Over200KJSinAlexaT-5K.• Analyzing(functionalityof)eachoneisnotfeasible.
• Observation:MostsitesusethesameJSes.• Boughtfromvendors,partofalibrary,etc.
• ClustersimilarJSes andanalyzeeachcluster.
![Page 7: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/7.jpg)
ClusteringsimilarJSes
• FormulateastheCliqueFindingproblem.
• Findallcliqueswithedgeweight>=x (say,.80).
• JS1,JS2,andJS4arelikelytohaveidenticalfunctionalityandsourceforsufficientlyhigh“x”.
• Givesalower-boundofsharedJSes:FailswithdifferentlyobfuscatedcodeandcomposedJSes.
JS1
JS3
JS2
JS4
.9
.6
.9
.9 .7
.8
Similarityofcode(TF-IDF)
White-spaceinsensitivePosition insensitiveResistanttonoise
![Page 8: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/8.jpg)
AnalyzingclustersofJSes
• Characteristics(scriptvendorandfunctionality)ofeachcliqueareidentifiedbyanalyzing:
• Sourcesofscripts.
• Externalresourcesutilizedbythescripts.
• (TF-IDF)Keywordsassociatedwiththescript.
• Manually.
![Page 9: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/9.jpg)
Howwidespreadareanti-adblockers?
• Totalnumberofcliqueswithsize>=5:1882• 1882JSes sharedby5+websites.
• TotalnumberoftrackerJSes:456of1882• 456JSes usedfortrackingsharedby2741websites.
• Totalnumberofanti-adblocker JSes:22of1882• 22JSes usedfordetectingadblockers sharedby335websites.• Thisisalowerbound.
![Page 10: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/10.jpg)
Whatsitesareemployinganti-adblockers?
• McAfee’sURLcategoriesoverthe335identifiedwebsites.
![Page 11: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/11.jpg)
Whoarethepopularanti-adblocking vendors?
![Page 12: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/12.jpg)
Howdoanti-adblockers work?
• Keyidea:Baitobjects.• Example1:UsingabaitDIVelement
var test = document.createElement('div'); //Create a new DIV elementtest.innerHTML = ' ‘; test.className = 'adsbox‘; //Set bait
document.body.appendChild(test); //Add element to document body
if (test.offsetHeight === 0) //Check element height{
document.body.classList.add('adblock');}
![Page 13: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/13.jpg)
Howdoanti-adblockers work?
• Keyidea:Baitobjects.• Example2:UsingbaitJSes
// ads.jsvar foo = False
// main.jsvar foo = True// main.htmlif (foo is True){
document.body.classList.add('adblock');}
![Page 14: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/14.jpg)
Canadblockers blockanti-adblockers?
![Page 15: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/15.jpg)
TL;DR
• Anti-adblockers areemployedbyatleast 6.7%oftheAlexaT-5K.
• Anti-adblockers aremostlyemployedby“News”websites.
• Anti-adblockers arebeingsuppliedmostlybyadvendors.• PageFair reportshouldbetakenwithagrainofsalt(conflictofinterest).
• Thearmsracehasenteredthenextphase.• Escalationseemslikelyunlessacompromiseisfound(e.g.,Eyeo AAI).
![Page 16: Adblockingand Counter-Blocking - Steven Murdoch · • Anti-adblockers are employed by at least6.7% of the Alexa T-5K. • Anti-adblockers are mostly employed by “News” websites](https://reader034.vdocuments.mx/reader034/viewer/2022042222/5ec8ec090486163f9040320c/html5/thumbnails/16.jpg)
Upcomingwork
• AutomatedcategorizationofJSes.
• Longitudinalmeasurements.