If using Chrome on Android you may be browsing a benign website with no obvious advertising, only to find that when you tap on a link it opens a new tab to falsely say you’ve won something, or falsely claim “Virus detected on your phone, click OK to start the cleaning process” which *also replaces the tab of the site you were browsing* (presumably accessing it via window.opener) and *prevents you from pressing Back to resume reading that site*.
In one case I managed to catch how this rude interruption of an apparently calm website was being done, and it’s not pretty.
The original page was written by a hobbyist about programming a certain old computer (certainly nothing to suggest malicious advertising deals), so I was expecting to uncover a case of the original site’s server having been compromised i.e. broken into, and I planned to alert the hobbyist’s ISP once I’d figured out some details about this break-in.
But the ‘hijack’ vector turned out to be much more mundane than that: the webmaster of the original site had used a statistics service called NedStatBasic (aka Motigo or WebStats4U) which had asked him to embed some Javascript that fetched instructions from their third-party server. Motigo’s terms and conditions said “By ordering the service level ‘Free of charge’ you...allow Motigo to advertise on your...website” (they might not have said this when the webmaster originally signed up, but he evidently didn’t check for changes), and also said they work with advertising companies called Captify and Eyeota. They also had an indemnification clause, trying to pass legal responsibility for any bad behaviour of their service back to the original webmaster.
The Motigo script created several divs with id “motigoAdtagPopunder”. The term “pop-under” is used in Web advertising to refer to opening a new browser window *underneath* the present one, the idea being that the user will find it later and not know where it came from. It doesn’t work so well if your foreground window is small enough for you to see what’s happening behind, but they assume people browse maximised. That seems sneaky enough already, but on Android these tabs were popping up *over* the site (not under it) and, as mentioned above, sometimes *replacing* the site as well—probably *not* what any webmaster would want unless they’re in it *purely* for advertising revenue (which wasn’t the case here, because they were being given only *statistics* in exchange for this madness), and arguably also in breach of Motigo’s own contract if the phrase “advertise on your website” means *on* it—not *under* it or *over* it or *replacing* it, but *on* it, like traditional magazine advertising next to an article—but their lawyers will probably say “on” somehow means “using” here.
Motigo’s added “pop-under” divs contained scripts from mirando.de fetching 302-redirects from an nginx server that inspects the browser’s User-Agent string (Lynx wasn’t redirected unless run with -useragent); the eventual page had an iframe with source on AdNetworkPerformance.com (which had no homepage and cloaked their whois data, so we can’t easily see which company is responsible), which served Javascript (from an OpenResty server) that eventually resulted in a 302 redirect to kuaptrk.com (registered to Mundo Media Ltd of Canada), and from there to an https page on ads.diamonds (one of the newer TLDs) who had again cloaked their whois, this time by using a proxy company in Hong Kong.
The ads.diamonds page contained Javascript to manipulate the history of the “pop-under” window (in case the user tried to use Back to close the tab on Android?) before loading another page—a different one every time—that refreshed to trackmedia101.com (again cloaked via HK) which eventually redirected to one of several places, e.g.:
The fake “virus detected” message was coming from a site called wsjpnxdm8u.top registered to a certain Lei Gao in Ningyang, Shandong and hosted on Amazon. This server was returning 404s to all other URLs. Another, similar message (“corrupted with virus and battery has been damaged”) was served from inbox-msg-cg000.gdn (falsely claiming to be Google; actually hosted on Amazon and registered to a company in Bangkok); this site contained code to activate the phone’s vibration (as did some of the fake “you have won” sites), and falsely threatens the user with “permanent lockdown” unless they install “Turbo Cleaner” from Google Play, an application which, as far as I could tell from its .class files, didn’t seem to do anything useful, but presumably they were hoping its in-app advertisements might get them more revenue than they were spending to spread it. And I didn’t see that they’d compromised any ordinary web servers to do this, although we can’t rule out the possibility that they found a way to bypass billing on the advertising network, since advertising money spent for the sole purpose of raising other advertising money does seem a bit wasteful if they don’t have a particularly effective ‘multiplier’ in the middle.
Some routers can be set to block some of these sites (see below), but the obvious takeaway for responsible webmasters is don’t use ‘free’ statistics services if you value your reputation. Use Analog or similar instead, or if your ISP doesn’t give you the logs then write your own call to another server if you must know; personally I don’t mind not being given the logs at all—it means I’m not tempted to fret about how many computers opened this or that one of my pages, which are just here for reference anyway.
I am most certainly *not* going to recommend that original webmaster’s site to anyone, because I cannot in good conscience recommend a site that has become associated with so much intrusive false advertising. I’m not even sure I’d want to recommend a different site that happens to include that site in a “links” section. (I did attempt to contact the webmaster about this, but the email address they listed was no longer valid.)
It would be a pity if an otherwise good resource were tainted in this way by being *hosted* on a server that’s paid for by aggressive advertising, but it’s doubly a pity that all this was because the original webmaster signed up to a mere *statistics service* that doesn’t even pay his hosting bills. He wanted statistics about his readers, but at this rate he won’t *have* any readers, because they’ll be taken out of his site and put off from returning as soon as they try to tap one of his links. If you ran a library or bookshop, would you accept someone’s offer to count your visitors if they reserved the right to grab said visitors by the scruff of the neck and drag them off to unsavoury places the moment they started to look at any of your items?
Third-party statistics services are simply not worth the risk.
If an Android device is being used on Wi-Fi, the router attached to the access point *might* be able to help block advertising networks that carry malicious payloads. Many consumer routers can be configured to block on the browser’s outgoing Host: header, which covers only sites that don’t yet use HTTPS; to go beyond that the router would have to interfere with DNS lookups, or block IPs (which change).
Based on the above experience I’d certainly suggest blocking ads.diamonds and trackmedia101.com if not the others.
Android’s Wi-Fi settings has a per-connection “Advanced options” that let you set a proxy for the browser to use when on that Wi-Fi network. Therefore if your router’s blocking options are insufficient, you could apt-get install tinyproxy on a Raspberry Pi (with a static IP), set Filter in /etc/tinyproxy.conf to a file containing the domains you want to block (restart or send SIGHUP to make it re-read this file), and set this IP and port 8888 in the Advanced options of your home Wi-Fi network on the Android device (long tap on the connection, select “Modify network” and enable the advanced options). Remember to use iptables or other access controls if you’ve set your router to send “DMZ” traffic to the Raspberry Pi. If tinyproxy sometimes gets “stuck”, you could cron a periodic /etc/init.d/tinyproxy restart or try something else like ngx_http_proxy_connect_module (likely to require compiling from source).
This proxy approach has the disadvantage of requiring a settings change on each device that uses your network, but it *does* mean you can block HTTPS sites at the domain level (tinyproxy detects the browser’s CONNECT request and denies it).
All material © Silas S. Brown unless otherwise stated. Android is a trademark of Google LLC. Google is a trademark of Google LLC. Javascript is a trademark of Oracle Corporation in the US. Raspberry Pi is a trademark of the Raspberry Pi Foundation. Wi-Fi is a trademark of the Wi-Fi Alliance. Any other trademarks I mentioned without realising are trademarks of their respective holders.