I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as text/images, normally, yet I saw this ad being served:
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk709561699">
<iframe id="ados_frame_adzerk709561699_2368633" scrolling="no" width="300" height="250" frameborder="0">
<html>
<head>
<style>
div,
iframe {
top: 0;
position: absolute;
}
</style>
</head>
<body style="margin:0px;padding:0px;">
<script type="text/javascript">
var divName = "adzerk709561699";
var inFIF = true;
var inDapIF = true;
</script>
// Here starts the iframe
<iframe scrolling="no" marginheight="0" marginwidth="0" src="https://fw.adsafeprotected.com/rjsi/ad.atdmt.com/65472/10865004/d/a.html;p=11087208769628;cod=1;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1476025155332?click=https%3A%2F%2Fengine.adzerk.net%2Fr%3Fe%3DeyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzMzLCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJ1ciI6bnVsbH0%26s%3DFznTTw6e8UZQkignHDresWHKLNk%26url="
topmargin="0" leftmargin="0" allowtransparency="1" width="300" height="250" frameborder="0"></iframe>
<script type="text/javascript">
(function($) {
function HijackedTextarea(t) {
var filters = {
questions: '-ox0X.YDyJfh',
answers: '!b6vl_mZrb8iVXs'
},
textarea = t.addClass('link-hijacked')[0],
form = t.closest('form'),
span = document.createElement('span'),
link = new RegExp('(?:^|[^\\w\\\\])https?://([^\\s/]+)/(q(?:uestions)?|a)/([0-9]+)', 'ig'),
lock = 0,
submitComment = form.data('events').submit[0].handler,
validSites = /^(?:(?:(?:meta\.)?(?:stackoverflow|[^.]+\.stackexchange|serverfault|askubuntu|superuser))|stackapps)\.com$/i,
miniLink = /(^|\W)(\[([^\]]+)\]\((?:(?:https?|ftp):\/\/[^)\s]+?)(?:\s(?:"|")(?:[^"]+?)(?:"|"))?\))/g,
miniCode = /(^|\W)(`(?:.+?)`)(?=\W|$)/g,
results = [];
form.data('events').submit[0].handler = handler;
function handler() {
if (lock)
return;
lock = -1;
var url, questions = {},
answers = {},
comment = textarea.value.replace(miniLink, "$1##").replace(miniCode, "$1##");
while (url = link.exec(comment)) {
var type = url[2] === 'a' ? answers : questions,
domain = url[1];
if (!type[domain])
type[domain] = [];
type[domain].push(url[3]);
}
if (Object.keys(questions).length || Object.keys(answers).length) {
request(questions, 'questions', callback);
request(answers, 'answers', callback);
} else {
submit.call(form.eq(0));
}
link.lastIndex = 0;
return false;
}
function callback(data, domain) {
lock = lock - 1 === 0 ? -1 : lock - 1;
if (!data.items || !data.items.length) {
if (lock < 0) {
submit();
}
return;
}
data.domain = domain;
results.push(data);
if (lock < 0) {
submit();
}
}
function submit() {
var i, j, id, post, pattern, swaps = [],
swapper = function(s, m1, m2) {
swaps.push(m2);
return m1 + "~%" + (swaps.length - 1) + "#";
},
comment = textarea.value;
if (results.length) {
for (i = 0; i < results.length; ++i) {
comment = comment.replace(miniLink, swapper).replace(miniCode, swapper);
for (j = 0; j < results[i].items.length; ++j) {
post = results[i].items[j];
id = post.question_id || post.answer_id;
pattern = '(^|[^\\w\\\\])http(s?)://' + results[i].domain.replace('.', '\\.') + '/(q(?:uestions)?|a)/' + id + '(?:/[-\\w]*)?(/[0-9]+)?(?:\\?[a-z]+=1)?(#\\w+)?';
comment = comment.replace(new RegExp(pattern, 'gi'), function(s, leading, https, type, trailing, anchor) {
leading = leading || '';
trailing = trailing || '';
anchor = /^#comment(\d+)_/.exec(anchor || '');
var url;
if (anchor) {
url = '/posts/comments/' + anchor[1];
} else if (type === 'questions' && trailing) {
url = '/a' + trailing;
} else if (type === 'a') {
url = '/a/' + id;
} else {
url = '/q/' + id;
}
return leading + '[' + escapeMarkdown(toText(post.title)) + '](http' + https + '://' + results[i].domain + url + ')';
});
}
}
textarea.value = comment.replace(/~%(\d+)#/g, function(s, m1) {
return swaps[+m1];
});
$(textarea).trigger('keyup');
}
submitComment.call(form[0]);
results = [];
lock = 0;
}
function toText(html) {
span.innerHTML = html;
return span.textContent;
}
function escapeMarkdown(text) {
return text.replace(/\[/g, '\\[')
.replace(/\]/g, '\\]')
.replace(/\*/g, '\\*')
.replace(/_/g, '\\_')
.replace(/`/g, '\\`');
}
function request(ids, type, callback) {
Object.keys(ids).forEach(function(domain) {
if (validSites.test(domain)) {
lock = lock < 0 ? 1 : lock + 1;
$.get(window.location.protocol + '//api.stackexchange.com/2.1/' + type + '/' + ids[domain].join(';') + '?site=' + domain + '&filter=' + filters[type] + '&key=p0r10MZ01l1H4So8wqT*qA((',
function(data) {
// Go home Firefox you are drunk
if (typeof(data) === 'string') {
data = JSON.parse(data);
}
callback(data, domain);
}
);
}
});
}
}
$(document).on('focus', 'textarea[name="comment"]:not(.link-hijacked)', function() {
new HijackedTextarea($(this));
});
})(jQuery)
</script>
</body>
</html>
</iframe>
<div class="adzerk-vote-controls" style="display: none;">
<div class="adzerk-vote-option adzerk-vote-up">
<div class="adzerk-vote-icon"></div>
</div>
<div class="adzerk-vote-option adzerk-vote-down">
<div class="adzerk-vote-icon"></div>
</div>
</div>
<div class="adzerk-vote-survey" style="display:none;">
<form><span>No problem. We won't show you that ad again. Why didn't you like it?</span>
<ul>
<li>
<label>
<input value="12" name="downvoteReason" type="radio">Uninteresting</label>
</li>
<li>
<label>
<input value="13" name="downvoteReason" type="radio">Misleading</label>
</li>
<li>
<label>
<input value="14" name="downvoteReason" type="radio">Offensive</label>
</li>
<li>
<label>
<input value="15" name="downvoteReason" type="radio">Repetitive</label>
</li>
<li>
<label>
<input value="16" name="downvoteReason" type="radio">Other</label>
</li>
</ul><a href="#" class="adzerk-vote-cancel">Oops! I didn't mean to do this.</a>
</form>
</div>
<img style="position:absolute;" src="https://engine.adzerk.net/i.gif?e=eyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzM0LCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJmcSI6MH0&s=SKTrvQZ1nqRp5oM-6v-VMF6JXVA"
border="0" width="0px" height="0px">
</div>
The interesting iframe served is too long (which also rings some alarms), so here the gist. I wasn't able to get another ad from them after loading 20 something pages. The original page which I saw the ad was deleted.
Would we be served ads from adsafeprotected, or something is wrong on my end?
accountForSadImps
value?cocaPuffsPath
being empty, thedoNothing
property being false, the list goes on. How can the sad imp who wrote this live without his cocaPuffs and free time?alert("Hello, World!")
, can someone explain what's so sad/bad about this ad, beyond the fact that it's huge?B = db(y, c, D)
, the existence of try ... catch blocks, etc . As such, it looks malicious, but it may not be. Also, it uses jQuery which makes it horrible.The SSL certificate used to load resources from https://static.adsafeprotected.com will be distrusted in M66. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information.
exchList
array which contains the ROT13 of the following strings:admeld
,googleads.g.doubleclick
,rubiconproject
,pubmatic
,openx
,adbrite.com
,glam.com
,yieldmanager.com
,lijit
,adnxs
,turn.com
,mathtag
, [17 omitted values],piratebay
,proxybay
,bayproxy
,pirateproxy
,proxypirate
,baypirate
,gwallet
,w55c.net
,p0y.cn
,ipinyou.com
, andp0yjsrender
. Ad and piracy sites? WTF?