An iframe from googlesyndication.com tries to access the camera and microphone

Re:An iframe from googlesyndication.com tries to access the ... by eganist on Sunday December 19, 2021 @12:12PM (#29615786)

> This is likely a script that somehow avoided google's malware scanning pipelines.

I can't think of a good reason for scripts through google ad syndication to be asking for camera and microphone permissions. I'd assume Google runs these scripts in something like a lab environment to see what's ultimately invoked before deploying them to production? If so, would this be indicative of both a deliberate controls bypass and a ToS violation by the ad network?

Sounds like Google Syndication may have taken care of this by enabling Permissions Policies(1) across its domains? I can't tell because the article references Feature Policy (a predecessor to Permissions Policies(2)) "in Safari" even though Feature and Permissions Policies, as best as I understand them, are delivered from the origin for implementation by the browser. So I'm kinda confused.

And if they don't implement it, it tells me they're totally fine with this kind of fingerprinting.

(1)https://developer.mozilla.org/en-US/docs/Web/HTTP/Feature_Po... (2)https://www.w3.org/TR/permissions-policy-1/

---

A prior version of this comment suggested Google should add permissions policies. I since edited it to clarify that I'm quite confused over whether it's something Google already implemented or something Safari overlaid on top of Google syndication origins since I can't verify using the origins themselves. The article seems to suggest it's something Safari specific even though the spec for both FP and PP involves receiving a set of permissions from the origin as a header and implementing them in the browser.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by soared on Sunday December 19, 2021 @12:48PM (#29616229)

Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this.

See vendors like “the media trust”

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by VRay on Sunday December 19, 2021 @03:04PM (#29617773)

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by teej on Sunday December 19, 2021 @06:10PM (#29619521)

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by boomlinde on Sunday December 19, 2021 @08:46PM (#29620699)

Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other.

The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by VRay on Monday December 20, 2021 @02:17AM (#29622242)

haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned

It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by boomlinde on Monday December 20, 2021 @07:05PM (#29632144)

> if a country wants to spend a 9 figure sum

After the initial investment in developing the exploit and before the vulnerability was patched, there would have been a near zero cost to hack any one user in particular.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by tgsovlerkhgsel on Sunday December 19, 2021 @06:37PM (#29619782)

This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by cpeterso on Sunday December 19, 2021 @10:53PM (#29621396)

Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by jimbojet on Sunday December 19, 2021 @02:23PM (#29617342)

Malicious script can (1) fingerprint and detect lab machines and therefore not do bad thing — this is arbitrarily easy if Google test lab is the first to ever execute their script, (2) over time build a graph of IPs, geos, test machine characteristics that essentially allow them to avoid the world’s entire test lab infrastructure (there’s only a fixed number of test lab providers in the world since it’s so expensive to set up this infrastructure), (3) yes, bypassing testing like this is a violation of ToS, but that is fairly meaningless as entities and IPs are cheap to incorporate, (4) not sure what you’re saying about permission policies across its domains? Google does have such policies unless I’m missing something.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by tehlike on Sunday December 19, 2021 @01:52PM (#29616999)

"In a lab environment" -> Certainly happens, but what if the script targets "specific devices" like "samsung galaxy s10" which google won't be able list exhaustively?

What if bad actors figured out a way to identify google's emulators and avoid doing bad stuff in that situation?

The part i said "google develops browser solutions to prevent issues like this" is exactly what features policy will end up doing. But google's ad systems and chrome features don't always move at the same speed, but you can be sure that whatever ad malware team is finding will help chrome team to strengthen their defense.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by d0gbread on Sunday December 19, 2021 @02:09PM (#29617190)

I thought they meant more like sandbox environment. Why would the API to access those things exist at all?

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by jimbojet on Sunday December 19, 2021 @02:17PM (#29617285)

The API exists because zoom.com request microphone and camera through an iframe is a legit use case. As OP said below CSPs exist so that enterprises can lock down those vulnerabilities. But wouldn’t make sense to lock it down for all consumers.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by tehlike on Sunday December 19, 2021 @02:11PM (#29617221)

Sandbox is provided through things like ContentSecurityPolicy and Feature Policies. See my comment on this.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by tinus_hn on Sunday December 19, 2021 @01:53PM (#29617019)

Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments.

The script could just detect the test environment and avoid triggering its malicious behavior.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by charcircuit on Sunday December 19, 2021 @03:30PM (#29618029)

>Javascript is Turing complete so it is impossible to determine what the script is going to do in all environments without running it in all environments.

No, it just means that it is impossible to do for every program. Google could just make it reject scripts it is unable to handle.

[ Parent | on HN ]