63

I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as text/images, normally, yet I saw this ad being served:

<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk709561699">
  <iframe id="ados_frame_adzerk709561699_2368633" scrolling="no" width="300" height="250" frameborder="0">
    <html>

    <head>
      <style>
        div,
        iframe {
          top: 0;
          position: absolute;
        }
      </style>
    </head>

    <body style="margin:0px;padding:0px;">
      <script type="text/javascript">
        var divName = "adzerk709561699";
        var inFIF = true;
        var inDapIF = true;
      </script>
      // Here starts the iframe
      <iframe scrolling="no" marginheight="0" marginwidth="0" src="https://fw.adsafeprotected.com/rjsi/ad.atdmt.com/65472/10865004/d/a.html;p=11087208769628;cod=1;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1476025155332?click=https%3A%2F%2Fengine.adzerk.net%2Fr%3Fe%3DeyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzMzLCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJ1ciI6bnVsbH0%26s%3DFznTTw6e8UZQkignHDresWHKLNk%26url="
      topmargin="0" leftmargin="0" allowtransparency="1" width="300" height="250" frameborder="0"></iframe>
      <script type="text/javascript">
        (function($) {
          function HijackedTextarea(t) {
            var filters = {
                questions: '-ox0X.YDyJfh',
                answers: '!b6vl_mZrb8iVXs'
              },
              textarea = t.addClass('link-hijacked')[0],
              form = t.closest('form'),
              span = document.createElement('span'),
              link = new RegExp('(?:^|[^\\w\\\\])https?://([^\\s/]+)/(q(?:uestions)?|a)/([0-9]+)', 'ig'),
              lock = 0,
              submitComment = form.data('events').submit[0].handler,
              validSites = /^(?:(?:(?:meta\.)?(?:stackoverflow|[^.]+\.stackexchange|serverfault|askubuntu|superuser))|stackapps)\.com$/i,
              miniLink = /(^|\W)(\[([^\]]+)\]\((?:(?:https?|ftp):\/\/[^)\s]+?)(?:\s(?:"|&quot;)(?:[^"]+?)(?:"|&quot;))?\))/g,
              miniCode = /(^|\W)(`(?:.+?)`)(?=\W|$)/g,
              results = [];

            form.data('events').submit[0].handler = handler;

            function handler() {
              if (lock)
                return;

              lock = -1;

              var url, questions = {},
                answers = {},
                comment = textarea.value.replace(miniLink, "$1##").replace(miniCode, "$1##");

              while (url = link.exec(comment)) {
                var type = url[2] === 'a' ? answers : questions,
                  domain = url[1];

                if (!type[domain])
                  type[domain] = [];

                type[domain].push(url[3]);
              }

              if (Object.keys(questions).length || Object.keys(answers).length) {
                request(questions, 'questions', callback);
                request(answers, 'answers', callback);
              } else {
                submit.call(form.eq(0));
              }

              link.lastIndex = 0;

              return false;
            }

            function callback(data, domain) {
              lock = lock - 1 === 0 ? -1 : lock - 1;

              if (!data.items || !data.items.length) {
                if (lock < 0) {
                  submit();
                }

                return;
              }

              data.domain = domain;

              results.push(data);

              if (lock < 0) {
                submit();
              }
            }

            function submit() {
              var i, j, id, post, pattern, swaps = [],
                swapper = function(s, m1, m2) {
                  swaps.push(m2);

                  return m1 + "~%" + (swaps.length - 1) + "#";
                },
                comment = textarea.value;

              if (results.length) {
                for (i = 0; i < results.length; ++i) {
                  comment = comment.replace(miniLink, swapper).replace(miniCode, swapper);

                  for (j = 0; j < results[i].items.length; ++j) {
                    post = results[i].items[j];
                    id = post.question_id || post.answer_id;
                    pattern = '(^|[^\\w\\\\])http(s?)://' + results[i].domain.replace('.', '\\.') + '/(q(?:uestions)?|a)/' + id + '(?:/[-\\w]*)?(/[0-9]+)?(?:\\?[a-z]+=1)?(#\\w+)?';
                    comment = comment.replace(new RegExp(pattern, 'gi'), function(s, leading, https, type, trailing, anchor) {
                      leading = leading || '';
                      trailing = trailing || '';
                      anchor = /^#comment(\d+)_/.exec(anchor || '');

                      var url;

                      if (anchor) {
                        url = '/posts/comments/' + anchor[1];
                      } else if (type === 'questions' && trailing) {
                        url = '/a' + trailing;
                      } else if (type === 'a') {
                        url = '/a/' + id;
                      } else {
                        url = '/q/' + id;
                      }

                      return leading + '[' + escapeMarkdown(toText(post.title)) + '](http' + https + '://' + results[i].domain + url + ')';
                    });
                  }
                }

                textarea.value = comment.replace(/~%(\d+)#/g, function(s, m1) {
                  return swaps[+m1];
                });
                $(textarea).trigger('keyup');
              }

              submitComment.call(form[0]);

              results = [];
              lock = 0;
            }

            function toText(html) {
              span.innerHTML = html;

              return span.textContent;
            }

            function escapeMarkdown(text) {
              return text.replace(/\[/g, '\\[')
                .replace(/\]/g, '\\]')
                .replace(/\*/g, '\\*')
                .replace(/_/g, '\\_')
                .replace(/`/g, '\\`');
            }

            function request(ids, type, callback) {
              Object.keys(ids).forEach(function(domain) {
                if (validSites.test(domain)) {
                  lock = lock < 0 ? 1 : lock + 1;

                  $.get(window.location.protocol + '//api.stackexchange.com/2.1/' + type + '/' + ids[domain].join(';') + '?site=' + domain + '&filter=' + filters[type] + '&key=p0r10MZ01l1H4So8wqT*qA((',
                    function(data) {
                      // Go home Firefox you are drunk
                      if (typeof(data) === 'string') {
                        data = JSON.parse(data);
                      }

                      callback(data, domain);
                    }
                  );
                }
              });
            }
          }

          $(document).on('focus', 'textarea[name="comment"]:not(.link-hijacked)', function() {
            new HijackedTextarea($(this));
          });
        })(jQuery)
      </script>
    </body>

    </html>
  </iframe>
  <div class="adzerk-vote-controls" style="display: none;">
    <div class="adzerk-vote-option adzerk-vote-up">
      <div class="adzerk-vote-icon"></div>
    </div>
    <div class="adzerk-vote-option adzerk-vote-down">
      <div class="adzerk-vote-icon"></div>
    </div>
  </div>
  <div class="adzerk-vote-survey" style="display:none;">
    <form><span>No problem. We won't show you that ad again. Why didn't you like it?</span>
      <ul>
        <li>
          <label>
            <input value="12" name="downvoteReason" type="radio">Uninteresting</label>
        </li>
        <li>
          <label>
            <input value="13" name="downvoteReason" type="radio">Misleading</label>
        </li>
        <li>
          <label>
            <input value="14" name="downvoteReason" type="radio">Offensive</label>
        </li>
        <li>
          <label>
            <input value="15" name="downvoteReason" type="radio">Repetitive</label>
        </li>
        <li>
          <label>
            <input value="16" name="downvoteReason" type="radio">Other</label>
        </li>
      </ul><a href="#" class="adzerk-vote-cancel">Oops! I didn't mean to do this.</a>
    </form>
  </div>
  <img style="position:absolute;" src="https://engine.adzerk.net/i.gif?e=eyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzM0LCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJmcSI6MH0&amp;s=SKTrvQZ1nqRp5oM-6v-VMF6JXVA"
  border="0" width="0px" height="0px">
</div>

The interesting iframe served is too long (which also rings some alarms), so here the gist. I wasn't able to get another ad from them after loading 20 something pages. The original page which I saw the ad was deleted.

Would we be served ads from adsafeprotected, or something is wrong on my end?

17
  • 6
    Reading your gist made me sad inside. Oct 10, 2016 at 15:37
  • It doesn't even look minified, just... Sad. Oct 10, 2016 at 15:38
  • 2
    @gelliott181 so you saw the accountForSadImps value?
    – Braiam
    Oct 10, 2016 at 15:44
  • 10
    That, cocaPuffsPath being empty, the doNothing property being false, the list goes on. How can the sad imp who wrote this live without his cocaPuffs and free time? Oct 10, 2016 at 15:48
  • 24
    AFAIK that's a way used by the advertiser to ensure that the ad runs correctly. It's not malicious, but we're aware that it's suboptimal in a number of ways. There should be a meeting happening to discuss this internally in a few days, and we'll respond here once we have something meaningful to say. (And by "we" I mean someone other than me since I'm not really involved in the ad side of things here. But I wanted to drop in a note that we're on this. :))
    – Adam Lear StaffMod
    Oct 10, 2016 at 17:15
  • 22
    I'm sure if you let PPCG have a go at optimizing it, it'd come back in 100 characters and also do your laundry for you.
    – Compass
    Oct 10, 2016 at 19:02
  • 1
    As someone who doesn't know much JS beyond alert("Hello, World!"), can someone explain what's so sad/bad about this ad, beyond the fact that it's huge?
    – MattDMo
    Oct 11, 2016 at 17:54
  • 2
    @MattDMo Most advertisements on Stack Overflow come from a particular website (adzerk). This particular ad has content from a totally different website embedded in it, which could look a little sketchy from a security standpoint (i.e., it's trying to inject dangerous scripts into your browser via Stack Overflow). As Adam Lear mentioned, it's not actually sketchy. But it is weird. Oct 11, 2016 at 20:20
  • @MattDMo I'm going to hazard a guess and say that said users are expressing that said code is bad because said code is somewhat obfuscated, and truly unreadable at best with lines such as B = db(y, c, D), the existence of try ... catch blocks, etc . As such, it looks malicious, but it may not be. Also, it uses jQuery which makes it horrible.
    – user4639281
    Oct 26, 2016 at 22:58
  • 3
    @MattDMo in my specific case, it's interactive code that is not included in my whitelisted domains, and totally unexpected on SO.
    – Braiam
    Oct 26, 2016 at 23:04
  • @Braiam The SSL certificate used to load resources from https://static.adsafeprotected.com will be distrusted in M66. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information. Jan 25, 2018 at 9:47
  • 1
    I'm having trouble figuring out how it's using them, but the the Gist defines an exchList array which contains the ROT13 of the following strings: admeld, googleads.g.doubleclick, rubiconproject, pubmatic, openx, adbrite.com, glam.com, yieldmanager.com, lijit, adnxs, turn.com, mathtag, [17 omitted values], piratebay, proxybay, bayproxy, pirateproxy, proxypirate, baypirate, gwallet, w55c.net, p0y.cn, ipinyou.com, and p0yjsrender. Ad and piracy sites? WTF? Feb 16, 2018 at 10:29
  • 1
    @MarkHaferkamp exclusion host List?
    – Braiam
    Feb 16, 2018 at 11:13
  • @MarkHaferkamp How did you figure that out? (The ROT13 part). To me, it just looked like gibberish... Feb 16, 2018 at 11:22
  • 3
    @PranavNutalapati The values indeed looked like gibberish, but the dots indicated structure, so I figured it was obfuscation rather than encryption. ROT13 is the most common text obfuscation method I've seen, so I tried that first and it worked. Jun 29, 2018 at 23:25

1 Answer 1

12

As users look for additional feedback, I want to provide an update as to where we are with this. Some of our advertising clients use monitoring products, in this case Integral Ad Sciences, but also see Media Trust or Geo Edge, to ensure that:

  • Ads are running in the correct geographic area
  • Ads are targeted to the correct screen (desktop/mobile/tablet)
  • Ads are appearing around brand-safe content
  • Ads are viewable on the screen (and how long)

The ad sales and ad operations teams at Stack Overflow are very careful about user privacy and make every effort to put the user experience first. This includes but is not limited to running only static, non-animated banner,keeping all ads relevant to software development, not participating in real-time bidding or selling our inventory to ad networks. We are not selling user data or targeting ads to you based on any personally identifiable user data.

We have always targeted ads by screen, geography and site tags. Our ad server, Adzerk, makes the initial ad call that checks to ensure a user meets the criteria for an ad to be served. Once the ad serves, the monitoring product then checks to ensure the environment matches all agreed upon criteria.

There are a lot of people involved in this process:

  • Advertiser
  • Advertising Agency Buyer
  • Advertising Agency Creative Team
  • Advertising Agency Trafficking Team
  • Monitoring Product Team (multiple people)
  • Stack Overflow Sales
  • Stack Overflow Ad Operations
  • Stack Overflow Developers

Therefore, it is taking a while to dissect the ads in question to determine how it is affecting size of the ad, page load times, and requests. As there is no malicious intent, we are allowing these ads to continue to run as we work on this.

@AdamLear's comment gave the summary of what is happening. I've expanded upon it more here. Once we have some further information to share, I will update this post; however I don't have an exact time frame as discussions are ongoing.

10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .