How Tracking Companies Circumvented Ad Blockers Using ...using WebSockets 4. This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4 1. What

How Tracking Companies Circumvented Ad Blockers Using WebSockets

Muhammad Ahmad Bashir, Sajjad Arshad, Engin Kirda, William Robertson, Christo Wilson

Northeastern University

Online Tracking

2

Online Tracking

Surge in online advertising (internet economy)

• Ad networks pour in billions of dollars.

• Value for their investment?

• Extensive tracking to serve targeted ads.

2

Online Tracking





2

User concern over tracking

• Led to the proliferation of ad blocking extensions

Online Tracking





2

User concern over tracking

• Led to the proliferation of ad blocking extensions

Ad networks fight back

• E.g Using anti ad blocking scripts

Google & Safari

• Google evaded Safari’s third-party cookie blocking policy (Jonathan Mayer)

• … by submitting a form in an invisible iFrame

• Google was fined $22.5M by FTC

3

This Talk

How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers

using WebSockets

4

This Talk

How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers

using WebSockets

4

1. What caused this?

2. How this bug was leveraged by ad networks?

Web Sockets

5

Web Sockets

5

HTTP/S

Web Sockets

5

HTTP/S request

response

Web Sockets

5

HTTP/S request

response

Chatting App

Web Sockets

5

HTTP/S request

response

Chatting Appanything new?

Web Sockets

5

HTTP/S request

response


Web Socket

Web Sockets

5

HTTP/S request

response


Web Socketbidirectional

• Both client and server can send/receive data • This is a persistent connection

Web Sockets

5

HTTP/S request

response


Web Socketbidirectional

ws:// or wss://

• Both client and server can send/receive data • This is a persistent connection

Ad Blockers

6

Ad Blockers

6

• Chrome extension chrome.webRequest API• Extension can inspect / modify / drop outgoing requests

Ad Blockers

6


webRequest API

Ad Blockers

6


http://cnn.com/logo.jpegwebRequest API

Ad Blockers

6



Rule ListUsually borrowed from EasyList

Ad Blockers

6



Rule List

url

Usually borrowed from EasyList

Ad Blockers

6



Rule List

url


Ad Blockers

6



Rule List

url


Ad Blockers

6



Rule List

url

webRequest API


Ad Blockers

6



Rule List

http://doubleclick.com/s1.js

url

webRequest API


Ad Blockers

6



Rule List


url

webRequest API

url


Ad Blockers

6



Rule List


url

webRequest API

url


Ad Blockers

6



Rule List


url

webRequest API

url


AdBlock Evasion

7

AdBlock Evasion

• Bug in

• ws/wss requests did not trigger the API

7

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018

Original bugreported

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018


Users report unblocked ads

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018



Patch Finalized ( Landed)

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018




Chrome 58 released

webRequest API

AdBlock Evasion

• Bug in


7

2012 2013 2014 2015 2016 2017 2018

* * * *




Chrome 58 released* Represents when our crawls were done

webRequest API

Data Crawling

8

Data Crawling

8

100K websites sampled from Alexa

Data Crawling

8

100K websites sampled from Alexa Visit 15

links / website

Collected chains for all included resources

Data Crawling

8


links / website


This means we know which resource included

which other resource

Data Crawling

8


links / website


Filter all resources which end in web sockets

Filter WebSockets



Data Crawling

8


links / website



Filter WebSockets

Detect A&A WebSockets

Mark web sockets which are used by

A&A domains

A&A = Advertising and Analytics e.g. DoubleClick, Criteo, Adnxs



Data Crawling

8


links / website



Filter WebSockets



A&A domains




pub/ index.html

srv.ws ads/ script.js

ads/ frame.html

ads/ img_a.jpg

adnet/ data.ws

Example Inclusion Tree

Data Crawling

8


links / website



Filter WebSockets



A&A domains




pub/ index.html


ads/ frame.html

ads/ img_a.jpg

adnet/ data.ws


WebSocket

WebSocket

Data Crawling

8


links / website



Filter WebSockets



A&A domains




pub/ index.html


ads/ frame.html

adnet/ data.ws


WebSocket

WebSocket

Data Crawling

8


links / website



Filter WebSockets



A&A domains




pub/ index.html

ads/ script.js

ads/ frame.html

adnet/ data.ws


WebSocket

High-Level Numbers

9

High-Level Numbers

9

Crawl Dates %Websites with sockets

% Socketswith A&AInitiators

% Socketswith A&AReceivers

#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18

Before Chrome 58

High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18

Before Chrome 58

After Chrome 58

High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18

• ~2% websites use web sockets.

Before Chrome 58

After Chrome 58

High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18


• ~61 % sockets are initiated by A&A domains

Before Chrome 58

After Chrome 58


High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18



• ~71 % sockets contact an A&A domain

Before Chrome 58

After Chrome 58


High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18




• # Initiators drop after Chrome 58 release.

Before Chrome 58

After Chrome 58


High-Level Numbers

9




#Unique A&A

Initiators

#Unique A&A

ReceiversApr 02-05, 2017 2.1 60.6 73.7 75 16

Apr 11-16, 2017 2.4 61.3 74.6 63 18

May 07-12, 2017 1.6 60.2 69.7 19 15

Oct 12-16, 2017 2.5 63.4 63.7 23 18




• # Initiators drop after Chrome 58 release.

• Small but persistent A&A receivers.

Before Chrome 58

After Chrome 58


Initiators and Receivers

10


10

Initiator ReceiverJavaScript


10

Initiator Receiverws/s

JavaScript


10


JavaScript


10

A&A Initiator #A&AReceivers

facebook 11google 11

doubleclick 9youtube 8addthis 8

hotjar 7googlesyndication 6

twitter 5sharethis 4

adnxs 3

Top A&A Initiators


JavaScript


10






adnxs 3

Top A&A Initiators


JavaScript


10






adnxs 3

A&A Receiver #A&AInitiators

realtime 2733across 19intercom 16

disqus 13zopim 12hotjar 11feedjit 10

lockerdome 8inspectlet 6

smartsupp 4

Top A&A Initiators

Top A&A Receivers


JavaScript


10






adnxs 3





smartsupp 4

Top A&A Initiators

Top A&A Receivers


• Disqus provides comment board services.

JavaScript


10






adnxs 3





smartsupp 4

Top A&A Initiators

Top A&A Receivers



• Zopim, Intercom, Smartsupp provide live chat services.

JavaScript


10






adnxs 3





smartsupp 4

Top A&A Initiators

Top A&A Receivers




• 33across & Lockerdome are advertising platforms.

JavaScript


10






adnxs 3





smartsupp 4

Top A&A Initiators

Top A&A Receivers




• 33across & Lockerdome are advertising platforms.

• Inspectlet & Hotjar are session replay services.

JavaScript

Sent Items Over Web Sockets

11


11

Cookie

IP

User IDs

Fingerprinting Variables

DOM

% Requests

0 20 40 60 80

WebSocketsHTTP/S


11

•Stateful Identifiers like Cookie and User IDs

Cookie

IP

User IDs


DOM

% Requests

0 20 40 60 80

WebSocketsHTTP/S


11


• Fingerprinting data in ~3.4% WebSockets. 97% is 33across

Cookie

IP

User IDs


DOM

% Requests

0 20 40 60 80

WebSocketsHTTP/S


11


• Fingerprinting data in ~3.4% WebSockets. 97% is 33across

• ~1.6% WebSockets sends the entire DOM to Hotjar, LuckyOrange, TruConversion

Cookie

IP

User IDs


DOM

% Requests

0 20 40 60 80

WebSocketsHTTP/S

12

Received Items Over Web Sockets

12

Received Items Over Web SocketsHTML

JSON

JavaScript

Images

% Responses

0 10 20 30 40 50

WebSocketsHTTP/S

12


JSON

JavaScript

Images

% Responses

0 10 20 30 40 50

WebSocketsHTTP/S

12


JSON

JavaScript

Images

% Responses

0 10 20 30 40 50

WebSocketsHTTP/S

12

Received Items Over Web Sockets

Ads served from Lockerdome

HTML

JSON

JavaScript

Images

% Responses

0 10 20 30 40 50

WebSocketsHTTP/S

Summary• ~67% of socket connections are initiated or received by A&A domains.

• Major companies like Google, Facebook, Addthis adopted WebSockets. Abandoned after Chrome 58 was released.

• The culprits:

• 33across was harvesting fingerprinting data.

• DOM exfiltration by HotJar, LuckyOrange, TruConversion

• Lockerdome downloaded URLs to serve ads.

• We need to keep up with the current practices of A&A companies.

13

Summary• ~67% of socket connections are initiated or received by A&A domains.

• Major companies like Google, Facebook, Addthis adopted WebSockets. Abandoned after Chrome 58 was released.

• The culprits:

• 33across was harvesting fingerprinting data.

• DOM exfiltration by HotJar, LuckyOrange, TruConversion

• Lockerdome downloaded URLs to serve ads.

• We need to keep up with the current practices of A&A companies.

13

[email protected]

Backup Slides

Inclusion Chain

15

<html> <body>

<script src=“tracker/script.js” </script> <img src=“tracker/img.jpg”> </img>

<script src=“ads/script.js”> </script> <iframe src=“frame.html”>

<html> <body> <script src=“script_12.js”> </script> <img src=“img_a.jpg”> </img>

</body> </html> </iframe>

</body> </html>

pub/ index.html

tracker/ script.js

tracker/ img.jpg

ads/ script.js

ads/ frame.html

ads/ script_12.js

ads/ img_a.jpg

adnet/ data.ws

Source code for ads/script_12.js let ws = new WebSocket(“ws://adnet/data.ws”, …); ws.onopen = function (e) {ws.send(“…”);}

DOM Tree Inclusion Tree

Documents

How Tracking Companies Circumvented Ad Blockers Using ...using WebSockets 4. This Talk How Ad Networks leveraged a bug in Chrome API to bypass Ad Blockers using WebSockets 4 1. What