Sajjad "JJ" Arshad, profile picture
Uploaded bySajjad "JJ" Arshad
63 views

How Tracking Companies Circumvent Ad Blockers Using WebSockets

The document discusses how advertising and analytics companies were able to circumvent ad blockers by leveraging a bug in the Chrome API that allowed WebSocket requests to bypass extension inspection. The authors crawled over 100,000 websites before and after the bug was patched to analyze the use of WebSockets by these companies. They found that around 2% of sites used WebSockets, and 55-73% of WebSocket connections were initiated by or contacted advertising and analytics domains. The number of unique advertising domain initiators dropped after the bug was patched in Chrome 58.

Embed presentation

Download to read offline
How Tracking Companies Circumvented Ad Blockers Using WebSockets Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson
 
 Northeastern University
Online Tracking 2
Online Tracking • Boom in online advertising. • Ad networks pour in billions of dollars. • Value for their investment? 2
Online Tracking • Boom in online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. 2
Online Tracking • Boom in online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. • User concern over tracking • This has led to the proliferation of ad blockers 2
Online Tracking • Boom in online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. • User concern over tracking • This has led to the proliferation of ad blockers • Ad networks fight back • E.g Using anti-ad blocking scripts 2
Google & Safari • Google evaded Safari’s third-party cookie blocking policy (Jonathan Mayer) • … by submitting a form in an invisible iFrame • Google was fined $22.5M by FTC 3
This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4
This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4 • What caused this? • How this bug was leveraged by ad networks?
Web Sockets 5
Web Sockets 5 HTTP/S
Web Sockets 5 HTTP/S
Web Sockets 5 HTTP/S request response
Web Sockets 5 HTTP/S request response Chatting App
Web Sockets 5 HTTP/S request response Chatting App anything new?
Web Sockets 5 HTTP/S request response Chatting App anything new? Web Socket
Web Sockets 5 HTTP/S request response Chatting App anything new? Web Socket bidirectional ws:// or wss:// • Both client and server can send/receive data • This is a persistent connection
Ad Blockers 6
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests webRequest API
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url webRequest API Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
Ad Blockers 6 • Chrome extension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
AdBlock Evasion 7
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads Patch
 Landed
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 * * Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released * Represents when our crawls were done
AdBlock Evasion • Due to a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 * * * * Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released * Represents when our crawls were done
Data Crawling 8
Data Crawling 8 100K websites 
 sampled from Alexa
Data Crawling 8 100K websites 
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources
Data Crawling 8 100K websites 
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources This means we know which resource included which other resource
Data Crawling 8 100K websites 
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources Filter all resources which end in 
 web sockets Filter 
 WebSockets This means we know which resource included which other resource
Data Crawling 8 100K websites 
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources Filter all resources which end in 
 web sockets Filter 
 WebSockets Detect A&A 
 WebSocketsMark web sockets
 which are used by A&A domains Companies involved in Advertising and Analytics are collectively referred as A&A This means we know which resource included which other resource
High-Level Numbers 9
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 Before 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 Before 
 Chrome 58 After 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. Before 
 Chrome 58 After 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains Before 
 Chrome 58 After 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain Before 
 Chrome 58 After 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain • # Initiators drops after Chrome 58 release. Before 
 Chrome 58 After 
 Chrome 58
High-Level Numbers 9 Crawl Dates %Websites 
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain • # Initiators drops after Chrome 58 release. • Small but persistent A&A receivers. Before 
 Chrome 58 After 
 Chrome 58
Initiators and Receivers 10
Initiators and Receivers 10 Initiator ReceiverJavaScript
Initiators and Receivers 10 Initiator Receiver ws/s JavaScript
Initiators and Receivers 10 Initiator Receiver ws/s JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 Top A&A 
 Initiators Initiator Receiver ws/s JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 Top A&A 
 Initiators Initiator Receiver ws/s JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. • 33across & Lockerdome are advertising platforms. JavaScript
Initiators and Receivers 10 A&A Initiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. • 33across & Lockerdome are advertising platforms. • Inspectlet & Hotjar are session replay services. JavaScript
Sent Items Over Web Sockets 11
Sent Items Over Web Sockets 11 Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
Sent Items Over Web Sockets 11 •Stateful Identifiers like Cookie and User IDs Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
Sent Items Over Web Sockets 11 •Stateful Identifiers like Cookie and User IDs • Fingerprinting data in ~3.4% WebSockets. 
 97% is 33across Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
Sent Items Over Web Sockets 11 •Stateful Identifiers like Cookie and User IDs • Fingerprinting data in ~3.4% WebSockets. 
 97% is 33across • ~1.5% WebSockets sends the entire DOM to Hotjar Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
12 Received Items Over Web Sockets
12 Received Items Over Web Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
12 Received Items Over Web Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
12 Received Items Over Web Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
12 Received Items Over Web Sockets Ads served from Lockerdome HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
Summary • ~67% of socket connections are initiated or received by A&A domains. • Major companies like Google, Facebook, Addthis adopted WebSockets. 
 Abandoned after Chrome 58 was released. • The culprits: • 33across was harvesting fingerprinting data. • HotJar was exfiltrating the entire DOM • Lockerdome downloaded URLs to serve ads. • We need to keep with the current practices of A&A companies. 13
Summary • ~67% of socket connections are initiated or received by A&A domains. • Major companies like Google, Facebook, Addthis adopted WebSockets. 
 Abandoned after Chrome 58 was released. • The culprits: • 33across was harvesting fingerprinting data. • HotJar was exfiltrating the entire DOM • Lockerdome downloaded URLs to serve ads. • We need to keep with the current practices of A&A companies. 13 Questions? ahmad@ccs.neu.edu
Discussion Points • What’s Next? • Can these findings be used to fine advertisers or shape new policies? • Major Ad Exchanges abandoned WebSockets — Why? • New web standards. • Can be problematic? Where should we intervene? • Surprising that it took few years to patch this bug • WebRTC aspect of it. 14
Backup Slides
Inclusion Chain 16 <html> <body> <script src=“tracker/script.js” </script> <img src=“tracker/img.jpg”> </img> <script src=“ads/script.js”> </script> <iframe src=“frame.html”> <html> <body> <script src=“script_12.js”> </script> <img src=“img_a.jpg”> </img> </body> </html> </iframe> </body> </html> pub/ index.html tracker/ script.js tracker/ img.jpg ads/ script.js ads/ frame.html ads/ script_12.js ads/ img_a.jpg adnet/ data.ws Source code for ads/script_12.js
 
 let ws =
 new WebSocket(“ws://adnet/data.ws”, …);
 ws.onopen = function (e) {ws.send(“…”);} DOM Tree Inclusion Tree

More Related Content

PDF
11 Advanced Uses of Screaming Frog Nov 2019 DMSS
byOliver Brett
 
PDF
How Tracking Companies Circumvented Ad Blockers Using WebSockets
bySajjad "JJ" Arshad
 
PDF
Browser Changes That Will Impact SEO From 2019-2020
byTom Anthony
 
PPTX
The Future of https in Search
bysemrush_webinars
 
PDF
Keeping Things Lean & Mean: Crawl Optimisation - Search Marketing Summit AU
byJason Mun
 
PPTX
Redefining Technical SEO, #MozCon 2019 by Paul Shapiro
byPaul Shapiro
 
PPTX
It pres
byafayan
 
PPTX
Honing headers for highly hardened highspeed hypertext
byFastly
 
11 Advanced Uses of Screaming Frog Nov 2019 DMSS
byOliver Brett
 
How Tracking Companies Circumvented Ad Blockers Using WebSockets
bySajjad "JJ" Arshad
 
Browser Changes That Will Impact SEO From 2019-2020
byTom Anthony
 
The Future of https in Search
bysemrush_webinars
 
Keeping Things Lean & Mean: Crawl Optimisation - Search Marketing Summit AU
byJason Mun
 
Redefining Technical SEO, #MozCon 2019 by Paul Shapiro
byPaul Shapiro
 
It pres
byafayan
 
Honing headers for highly hardened highspeed hypertext
byFastly
 

Similar to How Tracking Companies Circumvent Ad Blockers Using WebSockets

PDF
Improving frontend performance
bySagar Desarda
 
PPTX
Web fundamentals - part 1
byBozhidar Boshnakov
 
PDF
More Than You Ever Wanted to Know About Resource Hints - Harry Roberts (CSS W...
byShift Conference
 
PDF
JS Fest 2019. Andrew Betts. Headers for hackers
byJSFestUA
 
PDF
CommTech Talks: Lightstreamer (A. Alinone)
byAntonio Capone
 
PDF
Preconnect, prefetch, prerender...
byMilanAryal
 
PDF
Understanding and Mitigating the Security Risks of Content Inclusion in Web B...
bySajjad "JJ" Arshad
 
PDF
High Performance Web Sites, With Ads: Don't let third parties make you slow
byTobias Järlund
 
PDF
Hacking Web Performance
byMaximiliano Firtman
 
PDF
Black hat usa_2015-bypass_surgery-6_aug2015
bya4202655
 
PDF
Http/2 - What's it all about?
byAndy Davies
 
PPTX
SearchLove San Diego 2018 | Mat Clayton | Site Speed for Digital Marketers
byDistilled
 
PDF
Web performance mercadolibre - ECI 2013
bySantiago Aimetta
 
PDF
Making the web faster
byPatrick Meenan
 
PPTX
Measuring web performance
byPatrick Meenan
 
PDF
Seo by Google
byNikul Patel
 
PDF
Web performance optimization - MercadoLibre
byPablo Moretti
 
PPTX
Web Performance Hacks
bySagar Desarda
 
PPTX
Art and Science of Web Sites Performance: A Front-end Approach
byJiang Zhu
 
PPTX
Honing headers for highly hardened highspeed hypertext
byFastly
 
Improving frontend performance
bySagar Desarda
 
Web fundamentals - part 1
byBozhidar Boshnakov
 
More Than You Ever Wanted to Know About Resource Hints - Harry Roberts (CSS W...
byShift Conference
 
JS Fest 2019. Andrew Betts. Headers for hackers
byJSFestUA
 
CommTech Talks: Lightstreamer (A. Alinone)
byAntonio Capone
 
Preconnect, prefetch, prerender...
byMilanAryal
 
Understanding and Mitigating the Security Risks of Content Inclusion in Web B...
bySajjad "JJ" Arshad
 
High Performance Web Sites, With Ads: Don't let third parties make you slow
byTobias Järlund
 
Hacking Web Performance
byMaximiliano Firtman
 
Black hat usa_2015-bypass_surgery-6_aug2015
bya4202655
 
Http/2 - What's it all about?
byAndy Davies
 
SearchLove San Diego 2018 | Mat Clayton | Site Speed for Digital Marketers
byDistilled
 
Web performance mercadolibre - ECI 2013
bySantiago Aimetta
 
Making the web faster
byPatrick Meenan
 
Measuring web performance
byPatrick Meenan
 
Seo by Google
byNikul Patel
 
Web performance optimization - MercadoLibre
byPablo Moretti
 
Web Performance Hacks
bySagar Desarda
 
Art and Science of Web Sites Performance: A Front-end Approach
byJiang Zhu
 
Honing headers for highly hardened highspeed hypertext
byFastly
 

More from Sajjad "JJ" Arshad

PDF
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
PDF
Large-Scale Analysis of Style Injection by Relative Path Overwrite
bySajjad "JJ" Arshad
 
PDF
On the Effectiveness of Type-based Control Flow Integrity
bySajjad "JJ" Arshad
 
PDF
UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
bySajjad "JJ" Arshad
 
PDF
Tracing Information Flows Between Ad Exchanges Using Retargeted Ads
bySajjad "JJ" Arshad
 
PDF
Identifying Extension-based Ad Injection via Fine-grained Web Content Provenance
bySajjad "JJ" Arshad
 
PDF
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
PDF
"Recommended For You": A First Look at Content Recommendation Networks
bySajjad "JJ" Arshad
 
PDF
A Longitudinal Analysis of the ads.txt Standard
bySajjad "JJ" Arshad
 
PDF
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
PDF
Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions
bySajjad "JJ" Arshad
 
PDF
Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Librari...
bySajjad "JJ" Arshad
 
PDF
HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Gu...
bySajjad "JJ" Arshad
 
PDF
Practical Challenges of Type Checking in Control Flow Integrity
bySajjad "JJ" Arshad
 
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
Large-Scale Analysis of Style Injection by Relative Path Overwrite
bySajjad "JJ" Arshad
 
On the Effectiveness of Type-based Control Flow Integrity
bySajjad "JJ" Arshad
 
UNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
bySajjad "JJ" Arshad
 
Tracing Information Flows Between Ad Exchanges Using Retargeted Ads
bySajjad "JJ" Arshad
 
Identifying Extension-based Ad Injection via Fine-grained Web Content Provenance
bySajjad "JJ" Arshad
 
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
"Recommended For You": A First Look at Content Recommendation Networks
bySajjad "JJ" Arshad
 
A Longitudinal Analysis of the ads.txt Standard
bySajjad "JJ" Arshad
 
Cached and Confused: Web Cache Deception in the Wild
bySajjad "JJ" Arshad
 
Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions
bySajjad "JJ" Arshad
 
Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Librari...
bySajjad "JJ" Arshad
 
HotFuzz: Discovering Algorithmic Denial-of-Service Vulnerabilities Through Gu...
bySajjad "JJ" Arshad
 
Practical Challenges of Type Checking in Control Flow Integrity
bySajjad "JJ" Arshad
 

Recently uploaded

PPTX
feedback mechanism for science 10 quarter 3.pptx
byBlackVenus
 
PDF
National Reporting Under the UN CBD: Experiences and Lessons Learned from Pre...
bypensoftservices
 
PDF
Reminder of the Context and UN CBD Decisions on TSCCs
bypensoftservices
 
PDF
Sujay Rao Mandavilli Knowledge production lifecycle FINAL FINAL FINAL FINAL F...
bySujay Rao Mandavilli
 
PPTX
Basic concept of Systematic Review and PRISMA
byAshok Pandey
 
PPTX
Evaluation of absolute entropy from heat capacity
byilakiyasankar7
 
PDF
UK National Report and the NBSAP Experience
bypensoftservices
 
PDF
European Subregional Technical Scientific Cooperation Support Centre
bypensoftservices
 
PDF
Contribution of Thermal Tides to Venus Upper Cloud‐LayerSuperrotation
bySérgio Sacani
 
PDF
LE - CHATELIER'S PRINCIPLE WITH PROBLEMS
byvadavengadame
 
PDF
TSC Knowledge Hub for the UN CBD - Target 3
bypensoftservices
 
PDF
The Inner Kernel of the Classical Kuiper Belt
bySérgio Sacani
 
PDF
Overdispersed radio source counts and excess radio dipole detection
bySérgio Sacani
 
PDF
ICAR SRF, ASRB NET / SMS & STO Exam – Entomology Syllabus | Complete Unit-Wis...
bySatyam Sharma
 
PDF
Discriminating abiotic and biotic organics in meteorite and terrestrial sampl...
bySérgio Sacani
 
PDF
ICAR SRF, ASRB NET / SMS & STO Exam – Biotechnology Syllabus | Complete Unit-...
bySatyam Sharma
 
PDF
eTap 2025 Navy Yellow Modern Professional Designer.pdf
bylindokumaar
 
PPTX
Ontologies for Semantic Interoperability in the Age of AI
byMichel Dumontier
 
PPTX
THEORIES OF EVOLUTION (socialist vs evolutionists).pptx
bybismashakils
 
PPTX
Hypothesis testing tests of significance based on T Z and F tests.pptx
byDr Showkat Ahmad Wani
 
feedback mechanism for science 10 quarter 3.pptx
byBlackVenus
 
National Reporting Under the UN CBD: Experiences and Lessons Learned from Pre...
bypensoftservices
 
Reminder of the Context and UN CBD Decisions on TSCCs
bypensoftservices
 
Sujay Rao Mandavilli Knowledge production lifecycle FINAL FINAL FINAL FINAL F...
bySujay Rao Mandavilli
 
Basic concept of Systematic Review and PRISMA
byAshok Pandey
 
Evaluation of absolute entropy from heat capacity
byilakiyasankar7
 
UK National Report and the NBSAP Experience
bypensoftservices
 
European Subregional Technical Scientific Cooperation Support Centre
bypensoftservices
 
Contribution of Thermal Tides to Venus Upper Cloud‐LayerSuperrotation
bySérgio Sacani
 
LE - CHATELIER'S PRINCIPLE WITH PROBLEMS
byvadavengadame
 
TSC Knowledge Hub for the UN CBD - Target 3
bypensoftservices
 
The Inner Kernel of the Classical Kuiper Belt
bySérgio Sacani
 
Overdispersed radio source counts and excess radio dipole detection
bySérgio Sacani
 
ICAR SRF, ASRB NET / SMS & STO Exam – Entomology Syllabus | Complete Unit-Wis...
bySatyam Sharma
 
Discriminating abiotic and biotic organics in meteorite and terrestrial sampl...
bySérgio Sacani
 
ICAR SRF, ASRB NET / SMS & STO Exam – Biotechnology Syllabus | Complete Unit-...
bySatyam Sharma
 
eTap 2025 Navy Yellow Modern Professional Designer.pdf
bylindokumaar
 
Ontologies for Semantic Interoperability in the Age of AI
byMichel Dumontier
 
THEORIES OF EVOLUTION (socialist vs evolutionists).pptx
bybismashakils
 
Hypothesis testing tests of significance based on T Z and F tests.pptx
byDr Showkat Ahmad Wani
 

How Tracking Companies Circumvent Ad Blockers Using WebSockets

  • 1.
    How Tracking CompaniesCircumvented Ad Blockers Using WebSockets Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson
 
 Northeastern University
  • 2.
  • 3.
    Online Tracking • Boomin online advertising. • Ad networks pour in billions of dollars. • Value for their investment? 2
  • 4.
    Online Tracking • Boomin online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. 2
  • 5.
    Online Tracking • Boomin online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. • User concern over tracking • This has led to the proliferation of ad blockers 2
  • 6.
    Online Tracking • Boomin online advertising. • Ad networks pour in billions of dollars. • Value for their investment? • Extensive tracking to serve targeted ads. • User concern over tracking • This has led to the proliferation of ad blockers • Ad networks fight back • E.g Using anti-ad blocking scripts 2
  • 7.
    Google & Safari •Google evaded Safari’s third-party cookie blocking policy (Jonathan Mayer) • … by submitting a form in an invisible iFrame • Google was fined $22.5M by FTC 3
  • 8.
    This Talk How AdNetworks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4
  • 9.
    This Talk How AdNetworks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4 • What caused this? • How this bug was leveraged by ad networks?
  • 10.
  • 11.
  • 12.
  • 13.
  • 14.
  • 15.
  • 16.
  • 17.
    Web Sockets 5 HTTP/S request response Chatting App anythingnew? Web Socket bidirectional ws:// or wss:// • Both client and server can send/receive data • This is a persistent connection
  • 18.
  • 19.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests
  • 20.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests webRequest API
  • 21.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API
  • 22.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List Usually borrowed 
 from EasyList
  • 23.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
  • 24.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
  • 25.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url Usually borrowed 
 from EasyList
  • 26.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List url webRequest API Usually borrowed 
 from EasyList
  • 27.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API Usually borrowed 
 from EasyList
  • 28.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
  • 29.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
  • 30.
    Ad Blockers 6 • Chromeextension chrome.webRequest API • Extension can inspect / modify / drop outgoing requests http://cnn.com/logo.jpeg webRequest API Rule List http://doubleclick.com/s1.js url webRequest API url Usually borrowed 
 from EasyList
  • 31.
  • 32.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7
  • 33.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018
  • 34.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported
  • 35.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads
  • 36.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads Patch
 Landed
  • 37.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released
  • 38.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 * * Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released * Represents when our crawls were done
  • 39.
    AdBlock Evasion • Dueto a bug in chrome.webRequest API • All ws/wss requests bypassed this extension 7 2012 2013 2014 2015 2016 2017 2018 * * * * Original bug
 reported Users report 
 unblocked ads Patch
 Landed Chrome 58
 released * Represents when our crawls were done
  • 40.
  • 41.
    Data Crawling 8 100K websites
 sampled from Alexa
  • 42.
    Data Crawling 8 100K websites
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources
  • 43.
    Data Crawling 8 100K websites
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources This means we know which resource included which other resource
  • 44.
    Data Crawling 8 100K websites
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources Filter all resources which end in 
 web sockets Filter 
 WebSockets This means we know which resource included which other resource
  • 45.
    Data Crawling 8 100K websites
 sampled from Alexa Visit 15 
 links / website Collected chains for all inclusion resources Filter all resources which end in 
 web sockets Filter 
 WebSockets Detect A&A 
 WebSocketsMark web sockets
 which are used by A&A domains Companies involved in Advertising and Analytics are collectively referred as A&A This means we know which resource included which other resource
  • 46.
  • 47.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 Before 
 Chrome 58
  • 48.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 Before 
 Chrome 58 After 
 Chrome 58
  • 49.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. Before 
 Chrome 58 After 
 Chrome 58
  • 50.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains Before 
 Chrome 58 After 
 Chrome 58
  • 51.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain Before 
 Chrome 58 After 
 Chrome 58
  • 52.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain • # Initiators drops after Chrome 58 release. Before 
 Chrome 58 After 
 Chrome 58
  • 53.
    High-Level Numbers 9 Crawl Dates %Websites
 with sockets % Sockets
 with A&A
 Initiators % Sockets
 with A&A
 Receivers #Unique A&A
 Initiators #Unique A&A
 Receivers Apr 02-05, 2017 2.1 60.2 72.0 72 14 Apr 11-16, 2017 2.4 61.0 73.0 61 16 May 07-12, 2017 1.6 60.2 68.3 17 13 Oct 12-16, 2017 2.5 54.9 55.1 19 14 • ~2% websites use web sockets. • 55-61 % sockets are initiated by A&A domains • 55-73 % sockets contact an A&A domain • # Initiators drops after Chrome 58 release. • Small but persistent A&A receivers. Before 
 Chrome 58 After 
 Chrome 58
  • 54.
  • 55.
  • 56.
    Initiators and Receivers 10 InitiatorReceiver ws/s JavaScript
  • 57.
    Initiators and Receivers 10 InitiatorReceiver ws/s JavaScript
  • 58.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 Top A&A 
 Initiators Initiator Receiver ws/s JavaScript
  • 59.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 Top A&A 
 Initiators Initiator Receiver ws/s JavaScript
  • 60.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s JavaScript
  • 61.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. JavaScript
  • 62.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. JavaScript
  • 63.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. • 33across & Lockerdome are advertising platforms. JavaScript
  • 64.
    Initiators and Receivers 10 A&AInitiator #A&A
 Receivers facebook 11 google 11 doubleclick 9 youtube 8 addthis 8 hotjar 6 googlesyndication 6 cloudfront 4 sharethis 4 adnxs 3 A&A Receiver #A&A
 Initiators realtime 27 33across 19 intercom 15 disqus 13 zopim 12 hotjar 11 feedjit 10 lockerdome 8 inspectlet 6 smartsupp 4 Top A&A 
 Initiators Top A&A 
 Receivers Initiator Receiver ws/s • Disqus provides comment board services. • Zopim, Intercom, Smartsupp provide live chat services. • 33across & Lockerdome are advertising platforms. • Inspectlet & Hotjar are session replay services. JavaScript
  • 65.
    Sent Items OverWeb Sockets 11
  • 66.
    Sent Items OverWeb Sockets 11 Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
  • 67.
    Sent Items OverWeb Sockets 11 •Stateful Identifiers like Cookie and User IDs Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
  • 68.
    Sent Items OverWeb Sockets 11 •Stateful Identifiers like Cookie and User IDs • Fingerprinting data in ~3.4% WebSockets. 
 97% is 33across Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
  • 69.
    Sent Items OverWeb Sockets 11 •Stateful Identifiers like Cookie and User IDs • Fingerprinting data in ~3.4% WebSockets. 
 97% is 33across • ~1.5% WebSockets sends the entire DOM to Hotjar Cookie IP User IDs Fingerprinting 
 Variables DOM % Requests 0 20 40 60 80 WebSockets HTTP/S
  • 70.
  • 71.
    12 Received Items OverWeb Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
  • 72.
    12 Received Items OverWeb Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
  • 73.
    12 Received Items OverWeb Sockets HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
  • 74.
    12 Received Items OverWeb Sockets Ads served from Lockerdome HTML JSON JavaScript Images % Responses 0 10 20 30 40 50 WebSockets HTTP/S
  • 75.
    Summary • ~67% ofsocket connections are initiated or received by A&A domains. • Major companies like Google, Facebook, Addthis adopted WebSockets. 
 Abandoned after Chrome 58 was released. • The culprits: • 33across was harvesting fingerprinting data. • HotJar was exfiltrating the entire DOM • Lockerdome downloaded URLs to serve ads. • We need to keep with the current practices of A&A companies. 13
  • 76.
    Summary • ~67% ofsocket connections are initiated or received by A&A domains. • Major companies like Google, Facebook, Addthis adopted WebSockets. 
 Abandoned after Chrome 58 was released. • The culprits: • 33across was harvesting fingerprinting data. • HotJar was exfiltrating the entire DOM • Lockerdome downloaded URLs to serve ads. • We need to keep with the current practices of A&A companies. 13 Questions? ahmad@ccs.neu.edu
  • 77.
    Discussion Points • What’sNext? • Can these findings be used to fine advertisers or shape new policies? • Major Ad Exchanges abandoned WebSockets — Why? • New web standards. • Can be problematic? Where should we intervene? • Surprising that it took few years to patch this bug • WebRTC aspect of it. 14
  • 78.
  • 79.
    Inclusion Chain 16 <html> <body> <script src=“tracker/script.js”</script> <img src=“tracker/img.jpg”> </img> <script src=“ads/script.js”> </script> <iframe src=“frame.html”> <html> <body> <script src=“script_12.js”> </script> <img src=“img_a.jpg”> </img> </body> </html> </iframe> </body> </html> pub/ index.html tracker/ script.js tracker/ img.jpg ads/ script.js ads/ frame.html ads/ script_12.js ads/ img_a.jpg adnet/ data.ws Source code for ads/script_12.js
 
 let ws =
 new WebSocket(“ws://adnet/data.ws”, …);
 ws.onopen = function (e) {ws.send(“…”);} DOM Tree Inclusion Tree