Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application.

I didn't add advertisements at all. It's a straightforward ASP.NET web application.

What I believe is happening is that the end user's PC is infected with malware that "hops" onto their browser session to display the ads. This could happen with any website, I guess. I recommended they scan their PC with Malwarebytes.

Is this something that can only be controlled by the end-user, or are there steps that web application developers can take to prevent this from happening? In addition, some hints regarding the mechanism employed by this type of malware would be nice.

share|improve this question

5 Answers 5

up vote 15 down vote accepted

While I also believe the most likely explanation is definitely that the users system is infected with adware, I would like to present some alternative explanations.

There is still a small possibility that your website is indeed serving advertisement. It isn't unheard of that criminals hack into insecure web applications and modify them to deliver ads or malware. When they do, they might take precautions to conceal this from the administrator, like serving unmodified output to certain IP ranges. When you receive similar reports from many other users, you might want to check if any source files on the server got modified somehow.

Your server could also serve advertisement because of an unlicensed 3rd party library you are using. There are, for example, DotNetNuke modules which inject advertisement into the website when they aren't properly licensed (thanks to Jasmine for the comment).

Another possible explanation could be that the advertisement isn't injected by you or by adware on the users machine but by a man-in-the-middle. The user might use an anonymous proxy server to improve their privacy. Some of these proxy servers generate revenue by injecting their own advertisement into the websites they relay.

share|improve this answer
5  
The ads could also be injected by un-licensed modules or components. I've seen DotNetNuke modules that "work" but throw ads when you don't have a license. –  Jasmine May 9 at 16:46
1  
@Jasmine thanks for the comment. I added this to the answer. –  Philipp May 9 at 17:06
1  
Thank you, greatly appreciated. Interesting point about components. While I am very careful as I hate ads for professional facing sites, they could get through. Having said all of that nothing has been experienced by other users or in testing. Also I have just been informed that my colleague helped the end user remove the quilty malware !! So happy customer.... –  SamJolly May 9 at 18:17

Look for browser extensions maybe the user have downloaded some malicious extension that is tracking user's browsing history and sending him ads and stuff

share|improve this answer
    
Thanks for comment. So is this something that is user related only ie they need to keep their machines clean, or is there something that web developers can do to prevent the web application being hijacked/overlayed by ads when used? –  SamJolly May 9 at 12:59
3  
@SamJolly Not really, unless you want to restructure your website in such an absurd way that adware doesn't know where to insert any advertising and stops doing so. But that way you would also make it equally incomprehensible to search engines and likely also negatively affect the usability. –  Philipp May 9 at 14:20

Is this something that is under the control of the end user, or are there things web application developers can do to prevent this happening.

Hack the user and install malwarebytes and AV for them. :)

Honestly there is nothing you can do and it is entirely outside of your control. Get them to find a local tech person to help as the user may be infected with something that does more than just show ads. Typically adware programs also have other surprises, in addition a user who accidentally gets adware could also accidentally get a virus.

share|improve this answer

I have seen a piece of ad-injection malware that installs a proxy server on the user's machine, and change the proxy settings redirect traffic to that proxy. The proxy injects a script that inserts ads, and it also quite effectively blocks any page that might have information of itself and its removal, I guess it uses some heuristic filter.

I think the primary reason for this course is to be able to hide behind a legal protection, it doesn't use any malware-only techniques, it simply delivers a product that no-one in their right mind would want. A bit like the Ask toolbar, but far more aggressive.

I can't say if that is it, but it certainly fits the description.

The name of the "product" unfortunately slipped my mind.

share|improve this answer

As @Philipp has already stated, the most likely cause of the inserted advertising is coming from the end users machine IMHO. I would like to expand upon his point about proxy traffic.

The reality is that any hop in the network path is capable of altering the traffic/inserting code. There have been examples of this happening at a government level and also at an ISP level and you didn't mention if your app is served over a secure connection? (not that https is any guarantee these days).

Other examples of ISPs inserting advertising can be found at superuser.com (question 652995) "Why-does-my-browser-try-to-open-ads-from-fwdsnp.com" (sorry, rep limited for <2 links) and also a blog post by Eric Helgeson on his github.io titled "I fought my ISPs bad behavior and won"(google this).

Taking my tin foil hat off for a couple of moments... Other answers have touched on browser extensions, I recently had a client ask me to help clean his PC that was displaying similar symptoms to your end user. However, this adware(malware) was inserting itself onto only a specific set of websites. The client had first noticed the advertising on my country's equivalent to ebay - where the adware would insert an image into the last slot of the gallery slider of the item the user happened to be looking at. Clicking on the inserted image would whisk you off to a third party auction site, complete with affiliate links for good measure. When browsing amazon, ebay, [insert well known shopping/auction site here] the end result was the same.

Turns out the cause was a browser extension in chrome. I was able to narrow down the possibilities quickly by asking my client to check and see if the symptoms persisted in I.E or Firefox - answer came back 'no extra ads'. 'Could he please open a chrome incognito tab and re-test?' - nope, no inserted advertising there. 'Installed any browser extensions recently?', 'ah yes I have - funny you mention it, I found a great little extension that helps take screenshots...'

I understand that you are a asp.net developer and not a help desk, so trouble shooting your end users machine shouldn't be your concern. It may help them(and you) if you can lock onto where and when your app displays these ads. Do they have a secondary broswer they could test it on? Does it happen at home, or only at work etc. Depending on the nature of your app it's not beyond the realms of possibility that some malware writer loves you enough to write some code that focuses on your app. (puts tin foil hat back on...)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.