measuring and disrupting anti- adblockers using ...€¦ · improving adblockers • avoiding...
TRANSCRIPT
![Page 1: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/1.jpg)
Measuring and Disrupting Anti-Adblockers Using Differential
Execution AnalysisShitong Zhu*, Xunchao Hu†, Zhiyun Qian*, Zubair Shafiq‡, Heng Yin*
*University of California, Riverside
‡The University of Iowa
†Syracuse University
ShitongZhuetal. 1
![Page 2: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/2.jpg)
What Is Happening?
ShitongZhuetal. 2[1]Adblockingrapidlyescalating,saysresearcherhttps://www.networkworld.com/article/3087339/internet/ad-blocking-rapidly-escalating-says-researcher.html
![Page 3: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/3.jpg)
Web Tracking & Ads
ShitongZhuetal. 3
tracking-fueled/conciseness
[2]16CreepiestTargetedFacebookAdshttp://mashable.com/2014/08/13/facebook-ads-creepy/#kuIr6KVMAaqc
![Page 4: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/4.jpg)
Or Worse, Malvertising
ShitongZhuetal. 4[3]RoughTed:theantiad-blockermalvertiserhttps://blog.malwarebytes.com/cybercrime/2017/05/roughted-the-anti-ad-blocker-malvertiser/
![Page 5: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/5.jpg)
Ad Blockers To The Rescue!
ShitongZhuetal. 5
![Page 6: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/6.jpg)
ShitongZhuetal. 6
How Ad blocking Works?
![Page 7: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/7.jpg)
What Does Ads Industry Think/React?
ShitongZhuetal. 7
• Inaword,nothappy…• Considersadblockersaseriousthreattotheirbusinessmodel• Theirmove:deployingAnti-Adblockerthat
• (1)detectsthepresenceofadblocker,• (2)reactstoadblockerby:
• completely/partlyblockingtherealcontent• issuingwarningmessages• silentlyreportingadblockingstatus
![Page 8: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/8.jpg)
What Does Ads Industry Think/React?
ShitongZhuetal. 8
eitherwhitelistingthesite …orsubscribe
![Page 9: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/9.jpg)
Now, Our Turn?
• Alreadyanescalatingarmsrace,withnowinneryet• Goals:
1) wewanttoinvestigatetheongoingarmsrace2) withthisknowledge,wewanttoescalatethisarmsrace
• Ourpriorwork:• IMC’17:coverageofthecurrentanti-adblockfilter-listisNOTgood(only~9%)• PETS‘17:A/Btesting,staticanalysis(onlyforvisibleones/cannotlocaterelevantcode)
• Ourlatestmove:differentialexecutionanalysis
ShitongZhuetal. 9
![Page 10: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/10.jpg)
Our Idea & System
• Keyobservation:awebsiteemployinganti-adblockerwouldhaveadifferentJavaScriptexecutiontraceifitisloadedwithadblocker(positivetrace)ascomparedtowithoutadblocker(negativetrace)• Systemoverview:
Divergencefound:-->anti-adblockerdetected
Divergencefound:-->anti-adblockernotdetected
ShitongZhuetal. 10
①② ③
![Page 11: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/11.jpg)
Differential Execution Analysis? What Is It?
• It’singeneralalong-awaitedprogramanalysistechnique,butcanbesomehowimplementedquitestraightforwardinourcase:
• whatwillappearinourexecutiontracewhenweenableadblocker?
• whatwillappearinourexecutiontracewhenwedisableit?
ShitongZhuetal. 11
![Page 12: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/12.jpg)
How Good Is It?
• Onground-truthdatasets,oursystemachieves• TruePositiverate:86.9%|FalsePositiverate:0%
• Moreinformationbeyondthebinaryresults
ShitongZhuetal. 12
![Page 13: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/13.jpg)
Large-Scale Analysis In The Wild
• Keyfinding:• wedetectedantiad-blockerson30.5%oftheAlexatop-10Kwebsiteswhichis5-52timesmorethanreportedinpriorliterature
• Whysuchabiggap?• rememberthatatypicalanti-adblockerhastwocomponents:1. adblockerdetection2. subsequentreaction(possiblysilent)
ShitongZhuetal. 13
![Page 14: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/14.jpg)
Large-Scale Analysis In The Wild
ShitongZhuetal. 14
![Page 15: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/15.jpg)
Other Findings
• Originsoftopscriptscontaininganti-adblockinglogic:
• Popularityofanti-adblockersbywebsiteranking
ShitongZhuetal. 15
![Page 16: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/16.jpg)
Improving Adblockers
• AvoidingAnti-adblockerswithJavaScriptRewriting
• HidingAdblockerswithAPIHooking(stealthyadblocker)• allAPIcallsusedbypublisherscriptstoexaminethestateofthepage(e.g.,whetheranadisvisible)canbeinterceptedandmodifiedbyabrowserextension
ShitongZhuetal. 16
![Page 17: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/17.jpg)
Future
• Usersshouldhavetherighttomakeachoice
• Alternativebusinessmodels• AcceptableAdsprogram&BetterAdsstandards• Adsprofitre-distribution:Bravebrowser
ShitongZhuetal. 17
![Page 18: Measuring and Disrupting Anti- Adblockers Using ...€¦ · Improving Adblockers • Avoiding Anti-adblockers with JavaScript Rewriting • Hiding Adblockers with API Hooking (stealthy](https://reader030.vdocuments.us/reader030/viewer/2022041016/5ec8ec9547a4c641285d9ff3/html5/thumbnails/18.jpg)
Q & A
ShitongZhuetal. 18
• ComplementaryMaterial• https://sites.google.com/view/antiadb-proj