Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An iframe from googlesyndication.com tries to access the camera and microphone

techsparx.com

Post reply on HN
Print view View original

261–270 of 280 posts

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#261

Post by ziml77 »

Malcx wrote: post #37
vklmn wrote: post #29

I don't think that it's google's fault. Google sometimes trade ads on auctions, meaning they issue and HTTP request to partners asking "Hey, you want to show an ad here", and partner respond with price and HTML code, the highest bidder wins and HTTP code is inserted. HTTP contains JavaScript, and theoretically anything can be executed within the browser (I've seen people mining bitcoins!). Google can't monitor an exe…

That sill is Google's fault as far as I'm concerned as an end user.

If you're looking at it from an end-user perspective then it's the fault of techsparx.com.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#262

Post by tekknik »

ghusbands wrote: post #213
shukantpal wrote: post #171

Earlier quoted context omitted.

Yeah but if you search for something generic, Google will infer what you are searching for based on your profile.

But the context/question is whether or not the adverts are different, not whether the search results are different.

As a counter point, google used to (still does?) recruit based off of your search history. the famous “now you’re speaking our language” popups

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#263

Post by asdfasgasdgasdg »

denton-scratch wrote: post #185
jsnell wrote: post #107

Earlier quoted context omitted.

If they tried to unilaterally make such a change and ban the old formats, both the advertisers and publishers would complain to competition regulators around the world. And whether you think there would be any merit to those complaints or not, the outcome would still be another round of lawsuits with billions on the line.

> with billions on the line Not my money. Why should I care about lawsuits between advertising networks and their advertisers, regulators and so on?

> Why should I care

You don't need to. But the person is asking why Google is or is not doing a particular thing. So it is their interests that are relevant to the current discussion, not yours.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#264

Post by cpeterso »

tgsovlerkhgsel wrote: post #249
teej wrote: post #238

Earlier quoted context omitted.

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.

Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#265

Post by 1vuio0pswjnm7 »

Animats wrote: post #258
1vuio0pswjnm7 wrote: post #220

Earlier quoted context omitted.

"In my experience, with tools like Cover Your Tracks (apparently this is the new name for Panopticlick), the more you try and thwart fingerprinting, the more unique you appear." In the interest of fair balance, I have had the opposite experience. "I've given up..." That's probably what "tech" companies are hoping you will do. I see this response repeatedly on HN when the fingerprinting topic comes up. I am wondering…

"I've given up... That's probably what "tech" companies are hoping you will do. You don't have "googlesyndication.com" blocked?

I prefer to take an "allow list" approach rather than "blocking". That domain is certainly not one I have any use for and it is not on the allow list. Not much for me to read or download from "googlesyndication.com". The browser I use to read HTML does not auto-load iframes. Iframes are not a "feature" that I find myself needing.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#266

Post by tehlike »

tomrod wrote: post #230
charcircuit wrote: post #199

Earlier quoted context omitted.

He just told you? "Ad networks need to be able to do their own attribution and click spam detection."

This doesn't answer why the end product (the person receiving the ad) is exposed to anything but images and text, which was the question. Step outside technical approach mode and look at it from the highest level possible -- why are end users ever given more than images and text, or, why are ads anything more than a very simple a href tag. Spam detection and other protection of the ad platform should be done long bef…

No - spam protection needs as many signals as possible, sadly.

You will have headless browsers simulating clicks and so on. This gets extremely hard over time fake, and the more signals there are, the easier it's to spot anomalies.

In a way, the thinking is - a malicious actor will get at least a few of those signals inorganic and ML can detect them...

"Long before the information ever goes to the eyeball" => wish it was true.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#267

Post by shukantpal »

ghusbands wrote: post #213
shukantpal wrote: post #171

Earlier quoted context omitted.

Yeah but if you search for something generic, Google will infer what you are searching for based on your profile.

But the context/question is whether or not the adverts are different, not whether the search results are different.

The adverts will also be different since Google would infer what to show you - both in the results and advertisements.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#268

Post by VRay »

boomlinde wrote: post #260
teej wrote: post #238

Earlier quoted context omitted.

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other. The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.

haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned

It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#269

Post by zrm »

ravenstine wrote: post #69
tomudding wrote: post #31

I think this sounds more like some sort of fingerprinting attempt. It good to see that random access to these kind of resources fails due to new(er) browser controls. However, this does not mean that the fingerprinting actually failed. There is probably some way to determine if the request was denied automatically by the browser or manually by the user (e.g., time to get "response"), which is definitely something whi…

In my experience, with tools like Cover Your Tracks (apparently this is the new name for Panopticlick), the more you try and thwart fingerprinting, the more unique you appear. Although I still do everything I can to block and filter everything conceivable, I've given up on trying to figure out how identifiable I am on the web because it seems useless. If you don't try then you're identifiable, and if you do then you…

> the more you try and thwart fingerprinting, the more unique you appear.

This is presumably because most people don't attempt to thwart fingerprinting.

If a particular feature behaves differently between the three most common browsers, it can be used to distinguish them. If you disable it, now you don't look like any of the most common browsers, which puts you in a category with a smaller number of people in it.

Solution: Get more people in it by having more people install anti-fingerprinting extensions etc.

Re: An iframe from googlesyndication.com tries to access the camera and microphone

#270

Post by davidwritesbugs »

kevin_thibedeau wrote: post #215
dc3k wrote: post #173

Earlier quoted context omitted.

> https://fingerprintjs.com/blog/audio-fingerprinting/ > It is particularly useful to identify malicious visitors attempting to circumvent tracking Ah yes, the visitor trying to not be tracked is the malicious one. Barf.

The nerve of some people protecting themselves against browser exploits.

Must be terrorists or communists.
Post reply on HN