1

Occasionally I'll be on sites I trust, and an ad will pop up. There will be an X saying to close the ad, in a pretty standard location (upper right corner of the frame, sometimes just outside the frame). I, hating ads, will click that X.

I've noticed that on occasion, when I click this a fully collapsed separate browser window will open, hang around for a second or two, then close itself.

This makes me really paranoid. I can't think of any vulnerabilities that I may be opening myself up to, but the fact that the page is so deliberately hidden forces my mind to wander towards malice. (I know clicking some sketchy download link or the ad itself opens me up, but I'm almost always certain these look and act like a regular close option)

Is this a cause for concern? If so, are there precautions I can take to make sure I don't click something malicious?

  • One tip is to disable JavaScript globally in your browser and whitelist it for sites that require it (you can do this in Chrome: Settings -> Advanced -> Content Settings, or Firefox using NoScript). Then those pop-ups won't be able to run JavaScript (unless they are on a whitelisted origin) which greatly reduces the number of available attacks. Also maybe use an Adblocker? – jamieweb Jul 18 '18 at 23:31
2

I don't know the sites that you are referring to so I can't say with certain what was going on behind the scenes, but I can perhaps explain how this happens within the scope of digital advertising.

What I believe you are referring to is a practice known as clickjacking, and this is sadly quite a common practice. See this OWASP page for more information.

Ordinarily when I detect this kind of behavior the clickjacking is used to falsely attribute your legitimate attempt to close a window with an advertising click, which essentially registers a click-through event on the would-be-visible ad. Generally [legitimate] clicks tell the advertiser that the ad (impression) was seen and interacted with by a [hopefully] real human visitor, and the advertiser rewards the publisher (the site that hosts the ad) with payment for serving the impression.

Unfortunately, in the malicious case of clickjacking attacks, the perpetrator gets paid and the advertiser's ad is never seen (though is inadvertently clicked on).

Hope this helps shed some light on what could be going on, but @bashCyper's answer is absolutely right, it is a threat and it is recommended to always keep your browser updated in order to protect yourself.


UPDATE:

Additionally, clickjacking can also provide the attacker with specific information about you. Digital advertising is one of the most effective ways to recon potential victims because of the invasive nature with regards to the information that is collected. Information grabbed by advertisers after a click is registered can be: browser type, version, IP, OS, etc. All of which can be used to mount highly precise malvertising campaigns, which essentially attempt to deliver malware via digital advertisements that target specific browser versions with known vulnerabilities! See the below articles for more information about this.

1

Couple things on this, first is "quickly". I'm sure you know that a human click is nothing compared to the speed at which a computer processes, so closing it manually isn't quick by the standards of the computer. Not trying to be pendantic, just saying that no one is quick enough to stop an injection if it came from a pop-up.

So back in the day clicking "ok" to close a window, or clicking a falsely placed "x" would actually turn the users click into an "OK" to install something. There are many mechanisms to protect against this in modern browers. Which browser are you using? Is it updated? Have you disabled pop-ups? I highly recommend you review the security section of your browser and increase it and also install a pop-up blocker extension.

End of the day the answer is "yes, those pop-up windows are a threat".

  • Thank! I do know that a human reaction is an eternity to a computer; the "quickly" there meant the browser closes itself quickly. I'm running chrome, updated, with pop-ups disabled, which is another reason I was unsure if it was malicious (I trust Chrome). The X wasn't a link; I'm assuming it probably ran some JS which opened a new page with their script? – Lord Farquaad Jul 18 '18 at 16:51
  • @LordFarquaad Hmm... that makes me curious what the site is and how it's making that happen to get around popup-blocker. As far as what middleware is being used to generate it, could be JS, could be php. If you do a wireshark capture and go to that site it will tell you more. – bashCypher Jul 18 '18 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.