Ad Injection at Scale: Assessing Deceptive Advertisement Modifications

Abstract

Today, web injection manifests in many forms, but fundamentally occurs when malicious and unwanted actors tamper directly with browser sessions for their own profit. In this work we illuminate the scope and negative impact of one of these forms, ad injection, in which users have ads imposed on them in addition to, or different from, those that websites originally sent them. We develop a multi-staged pipeline that identifies ad injection in the wild and captures its distribution and revenue chains. We find that ad injection has entrenched itself as a cross-browser monetization platform impacting more than 5% of unique daily IP addresses accessing Google-tens of millions of users around the globe. Injected ads arrive on a client's machine through multiple vectors: our measurements identify 50,870 Chrome extensions and 34,407 Windows binaries, 38% and 17% of which are explicitly malicious. A small number of software developers support the vast majority of these injectors who in turn syndicate from the larger ad ecosystem. We have contacted the Chrome Web Store and the advertisers targeted by ad injectors to alert each of the deceptive practices involved.

It's Free for a Reason: Exploring the Ecosystem of Free Live Streaming Services

“…A threshold of 0.3 achieved best precision and recall. are more inclined in targeting the popular browser(s) for ad injections and malversting [48], [51], [30]. As such, for Internet Explorer and Firefox, it may be more beneficial for malicious advertisers, along with presenting malware sites, to expose FLIS users to money laundering scams, adult gaming/video websites, and fraudulent technician services.…”

“…To analyze malware binaries we used the VirusTotal (VT) service [10], to determine whether the binary had ever been scanned before and whether it was labeled as malicious by an antivirus vendor. To examine malicious Chrome extensions, we leverage the techniques from [48], [51] and manually analyze the behavior of collected extensions in the browser.…”

Identifying Extension-Based Ad Injection via Fine-Grained Web Content Provenance

“…If the content injection is also malicious in nature, the publisher's reputation can be further harmed in addition to exposing users to security risks due to malware, phishing, and other threats. Prior work has shown that users exposed to ad injection are more likely to be exposed to "malvertising" and traditional malware [46,48]. Figure 1 gives an overview of ad injection's effect on the normal ad delivery process, while Figure 3 shows an instance of ad injection on amazon.com.…”

“…A recent line of work has focused on the problem of ad injection via browser extensions. Thomas et al [46] proposed a detection methodology in which, they used a priori knowledge of a legitimate DOM structure to report the deviations from that structure as potential ad injections. However, this approach is not purely client-side and requires cooperation from content publishers.…”

Measurement and detection of security properties of client-side web applications

“…In 2015, a study found 249 Chrome extensions in the Chrome Web store injecting unwanted ads [96]. The authors identified two drops in their measurement of ad injection.…”