I have made NoScript and uBlock origin trust Stack Overflow served ads (Adzerk and zkcdn), but I saw something weird today. Is my understanding that all advertising is served directly from adzerk as text/images, normally, yet I saw this ad being served:
<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk709561699">
<iframe id="ados_frame_adzerk709561699_2368633" scrolling="no" width="300" height="250" frameborder="0">
<html>
<head>
<style>
div,
iframe {
top: 0;
position: absolute;
}
</style>
</head>
<body style="margin:0px;padding:0px;">
<script type="text/javascript">
var divName = "adzerk709561699";
var inFIF = true;
var inDapIF = true;
</script>
// Here starts the iframe
<iframe scrolling="no" marginheight="0" marginwidth="0" src="https://fw.adsafeprotected.com/rjsi/ad.atdmt.com/65472/10865004/d/a.html;p=11087208769628;cod=1;idfa=;idfa_lat=;aaid=;aaid_lat=;cache=1476025155332?click=https%3A%2F%2Fengine.adzerk.net%2Fr%3Fe%3DeyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzMzLCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJ1ciI6bnVsbH0%26s%3DFznTTw6e8UZQkignHDresWHKLNk%26url="
topmargin="0" leftmargin="0" allowtransparency="1" width="300" height="250" frameborder="0"></iframe>
<script type="text/javascript">
(function($) {
function HijackedTextarea(t) {
var filters = {
questions: '-ox0X.YDyJfh',
answers: '!b6vl_mZrb8iVXs'
},
textarea = t.addClass('link-hijacked')[0],
form = t.closest('form'),
span = document.createElement('span'),
link = new RegExp('(?:^|[^\\w\\\\])https?://([^\\s/]+)/(q(?:uestions)?|a)/([0-9]+)', 'ig'),
lock = 0,
submitComment = form.data('events').submit[0].handler,
validSites = /^(?:(?:(?:meta\.)?(?:stackoverflow|[^.]+\.stackexchange|serverfault|askubuntu|superuser))|stackapps)\.com$/i,
miniLink = /(^|\W)(\[([^\]]+)\]\((?:(?:https?|ftp):\/\/[^)\s]+?)(?:\s(?:"|")(?:[^"]+?)(?:"|"))?\))/g,
miniCode = /(^|\W)(`(?:.+?)`)(?=\W|$)/g,
results = [];
form.data('events').submit[0].handler = handler;
function handler() {
if (lock)
return;
lock = -1;
var url, questions = {},
answers = {},
comment = textarea.value.replace(miniLink, "$1##").replace(miniCode, "$1##");
while (url = link.exec(comment)) {
var type = url[2] === 'a' ? answers : questions,
domain = url[1];
if (!type[domain])
type[domain] = [];
type[domain].push(url[3]);
}
if (Object.keys(questions).length || Object.keys(answers).length) {
request(questions, 'questions', callback);
request(answers, 'answers', callback);
} else {
submit.call(form.eq(0));
}
link.lastIndex = 0;
return false;
}
function callback(data, domain) {
lock = lock - 1 === 0 ? -1 : lock - 1;
if (!data.items || !data.items.length) {
if (lock < 0) {
submit();
}
return;
}
data.domain = domain;
results.push(data);
if (lock < 0) {
submit();
}
}
function submit() {
var i, j, id, post, pattern, swaps = [],
swapper = function(s, m1, m2) {
swaps.push(m2);
return m1 + "~%" + (swaps.length - 1) + "#";
},
comment = textarea.value;
if (results.length) {
for (i = 0; i < results.length; ++i) {
comment = comment.replace(miniLink, swapper).replace(miniCode, swapper);
for (j = 0; j < results[i].items.length; ++j) {
post = results[i].items[j];
id = post.question_id || post.answer_id;
pattern = '(^|[^\\w\\\\])http(s?)://' + results[i].domain.replace('.', '\\.') + '/(q(?:uestions)?|a)/' + id + '(?:/[-\\w]*)?(/[0-9]+)?(?:\\?[a-z]+=1)?(#\\w+)?';
comment = comment.replace(new RegExp(pattern, 'gi'), function(s, leading, https, type, trailing, anchor) {
leading = leading || '';
trailing = trailing || '';
anchor = /^#comment(\d+)_/.exec(anchor || '');
var url;
if (anchor) {
url = '/posts/comments/' + anchor[1];
} else if (type === 'questions' && trailing) {
url = '/a' + trailing;
} else if (type === 'a') {
url = '/a/' + id;
} else {
url = '/q/' + id;
}
return leading + '[' + escapeMarkdown(toText(post.title)) + '](http' + https + '://' + results[i].domain + url + ')';
});
}
}
textarea.value = comment.replace(/~%(\d+)#/g, function(s, m1) {
return swaps[+m1];
});
$(textarea).trigger('keyup');
}
submitComment.call(form[0]);
results = [];
lock = 0;
}
function toText(html) {
span.innerHTML = html;
return span.textContent;
}
function escapeMarkdown(text) {
return text.replace(/\[/g, '\\[')
.replace(/\]/g, '\\]')
.replace(/\*/g, '\\*')
.replace(/_/g, '\\_')
.replace(/`/g, '\\`');
}
function request(ids, type, callback) {
Object.keys(ids).forEach(function(domain) {
if (validSites.test(domain)) {
lock = lock < 0 ? 1 : lock + 1;
$.get(window.location.protocol + '//api.stackexchange.com/2.1/' + type + '/' + ids[domain].join(';') + '?site=' + domain + '&filter=' + filters[type] + '&key=p0r10MZ01l1H4So8wqT*qA((',
function(data) {
// Go home Firefox you are drunk
if (typeof(data) === 'string') {
data = JSON.parse(data);
}
callback(data, domain);
}
);
}
});
}
}
$(document).on('focus', 'textarea[name="comment"]:not(.link-hijacked)', function() {
new HijackedTextarea($(this));
});
})(jQuery)
</script>
</body>
</html>
</iframe>
<div class="adzerk-vote-controls" style="display: none;">
<div class="adzerk-vote-option adzerk-vote-up">
<div class="adzerk-vote-icon"></div>
</div>
<div class="adzerk-vote-option adzerk-vote-down">
<div class="adzerk-vote-icon"></div>
</div>
</div>
<div class="adzerk-vote-survey" style="display:none;">
<form><span>No problem. We won't show you that ad again. Why didn't you like it?</span>
<ul>
<li>
<label>
<input value="12" name="downvoteReason" type="radio">Uninteresting</label>
</li>
<li>
<label>
<input value="13" name="downvoteReason" type="radio">Misleading</label>
</li>
<li>
<label>
<input value="14" name="downvoteReason" type="radio">Offensive</label>
</li>
<li>
<label>
<input value="15" name="downvoteReason" type="radio">Repetitive</label>
</li>
<li>
<label>
<input value="16" name="downvoteReason" type="radio">Other</label>
</li>
</ul><a href="#" class="adzerk-vote-cancel">Oops! I didn't mean to do this.</a>
</form>
</div>
<img style="position:absolute;" src="https://engine.adzerk.net/i.gif?e=eyJhdiI6NDM3LCJhdCI6NSwiYnQiOjAsImNtIjo0ODczOTQsImNoIjoxMTc4LCJjayI6e30sImNyIjoxNzAyNTQyLCJkaSI6IjNiZDgzNWIyNjkzOTQzMDBiODBjMzAwNjZiMjY1ODk5IiwiZG0iOjEsImZjIjoyMDIyNjAwLCJmbCI6MjM2ODYzMywiaXAiOiIxNDguMTAxLjIzMS4yMzMiLCJrdyI6InZpc3VhbC1zdHVkaW8seDg2LHdpbmRvd3MtMTAseC11c2VyLXJlZ2lzdGVyZWQseC0xNTAwcGx1cy1yZXAiLCJtayI6InZpc3VhbC1zdHVkaW8iLCJudyI6MjIsInBjIjo2LjYsImVjIjo2LjYsInByIjo4MjE5OSwicnQiOjIsInJmIjoiaHR0cDovL2NoYXQuc3RhY2tvdmVyZmxvdy5jb20vcm9vbXMvNDE1NzAvc28tY2xvc2Utdm90ZS1yZXZpZXdlcnMiLCJzdCI6ODI3NywidWsiOiJ1ZTEtNDlmYzU0MmIwODcyNDExMGIxOGQ2NGVlYjI3OTA0OWMiLCJ6biI6NDUsInRzIjoxNDc2MDI1MTU1MzM0LCJiZiI6dHJ1ZSwicG4iOiJhZHplcms3MDk1NjE2OTkiLCJmcSI6MH0&s=SKTrvQZ1nqRp5oM-6v-VMF6JXVA"
border="0" width="0px" height="0px">
</div>
The interesting iframe served is too long (which also rings some alarms), so here the gist. I wasn't able to get another ad from them after loading 20 something pages. The original page which I saw the ad was deleted.
Would we be served ads from adsafeprotected, or something is wrong on my end?
accountForSadImps
value? – Braiam Oct 10 '16 at 15:44cocaPuffsPath
being empty, thedoNothing
property being false, the list goes on. How can the sad imp who wrote this live without his cocaPuffs and free time? – gelliott181 Oct 10 '16 at 15:48alert("Hello, World!")
, can someone explain what's so sad/bad about this ad, beyond the fact that it's huge? – MattDMo Oct 11 '16 at 17:54B = db(y, c, D)
, the existence of try ... catch blocks, etc . As such, it looks malicious, but it may not be. Also, it uses jQuery which makes it horrible. – user4639281 Oct 26 '16 at 22:58The SSL certificate used to load resources from https://static.adsafeprotected.com will be distrusted in M66. Once distrusted, users will be prevented from loading these resources. See https://g.co/chrome/symantecpkicerts for more information.
– guest271314 Jan 25 '18 at 9:47exchList
array which contains the ROT13 of the following strings:admeld
,googleads.g.doubleclick
,rubiconproject
,pubmatic
,openx
,adbrite.com
,glam.com
,yieldmanager.com
,lijit
,adnxs
,turn.com
,mathtag
, [17 omitted values],piratebay
,proxybay
,bayproxy
,pirateproxy
,proxypirate
,baypirate
,gwallet
,w55c.net
,p0y.cn
,ipinyou.com
, andp0yjsrender
. Ad and piracy sites? WTF? – Mark Haferkamp Feb 16 '18 at 10:29