First fake news, now fake ads...
Banner ads on CNN.com contain keyloggers
51–60 of 83 posts
Re: Banner ads on CNN.com contain keyloggers
#52It appears to be getting the keypress.js library from ssl.cdn.turner.com. Not clear if the data is being exfiltrated, though, just by looking at that tweet.
Exactly it is incorrect to jump to the conlusion that they are using a keylogger. I mean, they're loading a JS library that allows to handle keypress events; but if you talk about a keylogger everyone assumes that they're stealing your keystrokes.
What needs to be done is to navigate the site and typing a given char sequence on every page while logging the HTTP traffic, then do a search for that sequence to see if it appears in any request. That's the basic thing you could do to actually verify if there is a keylogger.
Re: Banner ads on CNN.com contain keyloggers
#53Here's what is actually being run http://dmauro.github.io/Keypress/
So basically, it's just an event-capturing interface to what you can do natively in the browser already. It doesn't necessarily mean anything is being logged. The code using the library would need to be inspected—whatever callbacks are being fired, etc.
Re: Banner ads on CNN.com contain keyloggers
#54Earlier quoted context omitted.
Google's monopoly status means it fulfills 90+% of the ads. I can guarantee you that CNN has no control. There is no competition. So, erm, maybe the onus is on Google?
Google ads container keyloggers? I doubt that.
> Google ads container keyloggers? I doubt that.
Just to be clear, I think they are talking about advertisements placed via Google's platform, not ad campaigns by Google.
I think there is only one way to solve this: programmatic ads cannot contain executable code (no access to local storage or network) and ads must come from the same origin as the page they are on. For example, YouTube will host an ad for Subaru on YouTube's servers. The sticking point as people have pointed to me before on HN is fraud. The customer (in this case Subaru) does not trust Google to be honest in counting the number of impressions.
Perhaps what we need is legislation banning this behavior across the board. When no ad vendor is able to allow customers to do what they please on user's web browsers, the customer has no recourse other than to accept that this is not possible. I don't know how such a legislation would work though. Perhaps it needs to be an industry alliance instead of legislation?
Re: Banner ads on CNN.com contain keyloggers
#55Earlier quoted context omitted.
Change or not, I think the trend is not to trust ads anymore. I question whether or not it’s feasible in the long term to sustain a model based on tracking people, selling their data, and calling that “advertising.” Oh and if you want to see what CNN is crapping out without the cruft, lite.cnn.io works well.
Surveillance is not advertising.
I can hear them responding with something like:
Surveillance is helpful information gathering and customer profiling in order to understand customer needs better. This enables us to put more relevant ads in front of your eyes. It also helps us to understand when is most convenient to sneak in the middle of the night and harvest your and your family's vital organs, as permitted by the service agreement you signed.
Re: Banner ads on CNN.com contain keyloggers
#56Lots of speculation here, not much analysis, even from lazy gits like me.
Chrome web inspector kindly gives the "Initiator" for every request. In this case it's cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it.
The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at https://pastebin.com/EwgPAM6T
It's a bit obfuscated/minified, and they don't seem to have a non-minified version available, so it's not clear exactly what functionality this is enabling.
Either way, not really a keylogger if it's not capturing all keystrokes and shipping them off somewhere.
Re: Banner ads on CNN.com contain keyloggers
#57It's not CNN. It's ads. Advertising has ruined every medium it has ever touched. It will ruin the web. It is only a matter of time. It did not destroy ancient network television overnight. It did not destroy cable tv overnight. The last time I saw cable tv a few years back, it had become so bad that after a long run of ads, they would then put bugs and walk on people right over the content of the show you were watchi…
Which is why NF is so successful and cable is bleeding from the arteries. Consumers want to choose their device, on their schedule, without tampering with the content, and they want good and timely selection of content. They will pay well for this.
Re: Banner ads on CNN.com contain keyloggers
#58Earlier quoted context omitted.
Google's monopoly status means it fulfills 90+% of the ads. I can guarantee you that CNN has no control. There is no competition. So, erm, maybe the onus is on Google?
Google ads container keyloggers? I doubt that.
It is possible, and thus against their policy, and thus invites the worst of the web to circumvent their detection systems. https://support.google.com/adwordspolicy/answer/6020954?hl=e...
Re: Banner ads on CNN.com contain keyloggers
#59Scripts from the ad should be iframed no? Doesn't make sense that an ad could run arbitrary JS within the same browsing context as the host.
It doesn't make any sense, but it's very popular.
To be fair, when they're desperate real world newspapers are like this too.
A flush successful newspaper will make a deal of its editorial independence and insist you write "Advertising Feature" in big letters at the top of your full page ad, use a completely different typeface and give your company's name, but when money is tight the guy selling those adverts is under pressure to compromise. What if it says "Sponsored content" rather than "Advertising Feature"? And rather than big letters at the top, how about small disclosure text at the bottom? The typeface could be a very good clone of your normal editorial typeface, and still count as "different" right? And lets have a byline which says "Our staff", that's vague, and the poor reader might think it means it was written by journalists, but it doesn't strictly _say_ that, it just says "Staff" which could be anybody...
This is how internationally famous British newspapers end up running content literally written in Beijing or Moscow to let everybody know how free and wonderful those countries are, using weasel words like "in co-operation with". And if the _actual_ news is a bit awkward? Well, you wouldn't want that lucrative sponsored content deal to lapse would you? Maybe a brief mention on page 14 is enough, even if those newspapers which still have a backbone ran it on their front page.
Re: Banner ads on CNN.com contain keyloggers
#60Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.
Right? Imagine IRL advertising that would break into your house and put up advertising posters or plant listening devices.
I don’t think I would like that at all.