Are quickly closed pop-up windows in browsers a threat?

Question

Occasionally I'll be on sites I trust, and an ad will pop up. There will be an X saying to close the ad, in a pretty standard location (upper right corner of the frame, sometimes just outside the frame). I, hating ads, will click that X.

I've noticed that on occasion, when I click this a fully collapsed separate browser window will open, hang around for a second or two, then close itself.

This makes me really paranoid. I can't think of any vulnerabilities that I may be opening myself up to, but the fact that the page is so deliberately hidden forces my mind to wander towards malice. (I know clicking some sketchy download link or the ad itself opens me up, but I'm almost always certain these look and act like a regular close option)

Is this a cause for concern? If so, are there precautions I can take to make sure I don't click something malicious?

Answer 1

I don't know the sites that you are referring to so I can't say with certain what was going on behind the scenes, but I can perhaps explain how this happens within the scope of digital advertising.

What I believe you are referring to is a practice known as clickjacking, and this is sadly quite a common practice. See this OWASP page for more information.

Ordinarily when I detect this kind of behavior the clickjacking is used to falsely attribute your legitimate attempt to close a window with an advertising click, which essentially registers a click-through event on the would-be-visible ad. Generally [legitimate] clicks tell the advertiser that the ad (impression) was seen and interacted with by a [hopefully] real human visitor, and the advertiser rewards the publisher (the site that hosts the ad) with payment for serving the impression.

Unfortunately, in the malicious case of clickjacking attacks, the perpetrator gets paid and the advertiser's ad is never seen (though is inadvertently clicked on).

Hope this helps shed some light on what could be going on, but @bashCyper's answer is absolutely right, it is a threat and it is recommended to always keep your browser updated in order to protect yourself.

---

UPDATE:

Additionally, clickjacking can also provide the attacker with specific information about you. Digital advertising is one of the most effective ways to recon potential victims because of the invasive nature with regards to the information that is collected. Information grabbed by advertisers after a click is registered can be: browser type, version, IP, OS, etc. All of which can be used to mount highly precise malvertising campaigns, which essentially attempt to deliver malware via digital advertisements that target specific browser versions with known vulnerabilities! See the below articles for more information about this.

• https://www.wired.com/insights/2014/11/malvertising-is-cybercriminals-latest-sweet-spot/
• https://www.scmagazine.com/scammers-exploit-native-ad-content-providers-to-serve-malvertising/article/696789/

Answer 2

Couple things on this, first is "quickly". I'm sure you know that a human click is nothing compared to the speed at which a computer processes, so closing it manually isn't quick by the standards of the computer. Not trying to be pendantic, just saying that no one is quick enough to stop an injection if it came from a pop-up.

So back in the day clicking "ok" to close a window, or clicking a falsely placed "x" would actually turn the users click into an "OK" to install something. There are many mechanisms to protect against this in modern browers. Which browser are you using? Is it updated? Have you disabled pop-ups? I highly recommend you review the security section of your browser and increase it and also install a pop-up blocker extension.

End of the day the answer is "yes, those pop-up windows are a threat".