Slashdot Mirror
Attackers Abuse Legitimate EU Cookie Law Notices In Clickjacking Campaign (malwarebytes.org)
An anonymous reader writes: Hackers have set up a clever new clickjacking campaign taking advantage of pop-up alerts that European users are (by now) accustomed to see: the "EU Cookie Law" notifications. The criminals are placing a legitimate ad banner on top of the warning message via an iframe. The trick is to make the ad invisible by setting its opacity to zero. So, each time a user clicks anywhere on the legitimate message, he or she clicks also on the hidden ad.
Blockity blockity blockity. When the advertisers clean their own house, then I'll stop blocking them.
I'm not holding my breath here.
AC
The people running these spammy practises don't help themselves. All they're achieving is pushing more people to ad blocking software hurting the rest of us who don't run spammy ads and keep them as unobtrusive as possible. Bravo fuckwits.
So, would Ad Blocker Plus stop an invisible ad? I would hope so as long as the code calls an ad... visible or not...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Services such as ClarityRay defeat your blocking.
But there are two ways around ClarityRay: either block access to the servers that serve these scripts or block the browser from executing any scripts. Sites are unlikely to hide text from no-script users because that also hides text from search engines.
Please.
I was thinking of this the other day: we need someone who can maintain a good HOSTS file that we can all subscribe to. Anyone know of anyone like that? As a bonus, the maintainer should be grumpy.
The problem is that @ opacity 0%, it's still being rendered and the software believes it to be visible.....it's just that it's as visible as good quality glass covering a picture....it's there, but you eyes look through it.
So shit I don't allow (popups and scripts) being used to tell me that something else I don't allow (cookies) is being used to fool people into clicking ads they don't even see, from companies we shouldn't trust, so we can see ads for stuff we don't want, so some asshole can get revenue for ad clicks?
And people wonder why we keep saying allowing arbitrary sites to execute scripts and Flash isn't a completely moronic practice??
I'm sorry, but EVERYTHING about internet ads and how most sites work is in direct opposition to sensible security practice.
Sorry, but this is precisely why I will continue to block the hell out of any form of ads, because I have no choice but to assume any 3rd party actor called in from a site I am visiting isn't a hostile actor ... and with sufficiently advanced incompetence, "hostile" takes on a very broad meaning.
The internet got so thoroughly broken when ads came along it isn't funny. Because they seem to want to force us to use terribly insecure technologies on the chance that some small subset of the shit on the interwebs is what we want and can be trusted.
Lost at C:>. Found at C.
Actually, why can't this be done by the browser? Browsers could easily have an option, whereby any time you access a new site or domain, that tries to set a cookie or use the local browser storage, you get warned.
A better law could simply require sites to have an info page listing what is being tracked? Maybe a standard http://..../privacy/ or http://..../cookies/ section? Could make the advertisers uncomfortable :)
Jumpstart the tartan drive.
And why put the burden on every single web site owner, instead of putting the burden on the very few user against commonly used?
I would love to give an answer here, but I can't really get my head around what you mean with that last part.
The idea behind the law is that the users should be informed if a page tracks them, and ensure that it is an opt in system rather than opt out.
It would probably have been better if the browser behaved a bit like noscript but with cookies instead of scripts, but politicians seldom finds a good solution.
Anyway, the burden is put on the single web site owner because he is the one who wants to track the users.
It makes sense to put the burden on the one who benefits from it, otherwise you repeat the whole DMCA crap that is open for abuse without any reason for the one who benefits to hold back.
on the very few user against commonly used?
Huh?
Did you mean "user agents"? If so, how is a browser supposed to determine which cookies are, or are not, strictly necessary for a particular action requested by the user?
systemd is Roko's Basilisk.
Apologies for the source but here's a bit of a humorous summary of the Cookie law as implemented in the UK.
Here in UK, we're having a referendum this year or next on leaving the EU. It's this sort of bureaucratic nonsense that pushes people to vote to leave.
You can do these things, but you have to take ownership of it, and you have to be fairly diligent about it.
My mom? Probably not so much.
So, someone came up with a strategy whereby if they just said "we set teh cookies", then they're covered. That it might be cookies from 10 external partners which add nothing at all to your overall experience, well, that's a little detail to gloss over.
I block the heck out of this crap, use extensions to block stuff, and keep blacklisting stuff or adding rules to Chrome. But I wouldn't expect your average user to be willing to do that.
The problem is the default position of the web is everybody wants you to run the browser in the most insecure, wide open method possible to allow their precious pile of shit to work as envisioned.
Me, I see a page which tells me I need to enable javascript, or turn on cookies ... and the back button is all they'll see. Because I have no intention of trusting most web sites, and not at all their third part ad/analytics companies.
Lost at C:>. Found at C.
And even if transparent overlays were treated as a special case, all they would have to do is set the ad to 1% opacity.
All my liberal friends think I'm a conservative, all my conservative friends think I'm a liberal.
My initial thought as well. The difficult part is: what opacity is invisible? For example: a frame with a single background colour and no border may just be interpreted as part of the legitimate widget for clicking.
Great minds think alike; fools seldom differ.
Firefox has that option, then it's possible to configure if it shall be denied, accepted or just valid for the session. I usually select the last because it looks to the site as if the cookie was successfully set but next visit after a browser restart it's not there anymore. And I also try to avoid third-party cookies as much as possible.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The only shocking thing about it is how easy manipulation of public opinion through mass media still is.
"The "Cookie Law" is not really about cookies and is widely misinterpreted. It merely affirms that these two principles apply to websites - if you are collecting personally identifying data about your visitors you need to let them know first."
The problem is, of course, that the "Cookie Law" neither affirms those rights nor was intended to do so, just pretend. Like going through the movements but still not dancing.
When I first began seeing these "Cookies Exist" banners, (I see a lot of them, using a European server through my VPN), I was immediately suspicious. I mean, who needs to be told web sites use cookies? Why do you have to click something? I was surprised to find out this was an actual EU law. Glad my initial paranoia's been vindicated, though.
-- sudon't
Air-ride Equipped
Why are we at this point? Why let ads be HTML+CSS+Javascript in the first place?
Forcing ads to go back to being simple PNG or JPEG images with an HREF link would solve a lot of problems. Non-annoying, static images would probably lower the number of people installing ad blockers too.
But the fix would be equally easy, just block things set a both 0% and 1% opacity!
Oh wait...
This law is the worst, dumbest idea in the history of bad ideas. Actually the intention itself isn't bad, but the law is. Because "collecting personal data" is also interpreted to mean cookies of pretty much any kind, meaning it applies to almost all website. Thus on almost every bloody site you visit, you first have to click through this stupid and pointless warning. The net effect has been pretty much zero; and as the article suggests it may actually be dangerous: people are now so used to clicking away these warnings that the do so without really looking at them. Thankfully an increasing number of companies and organisations are starting to ignore this law.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
...some amusing background on the cookie law https://silktide.com/the-stupi...
Aside from degrading the web experience for millions of users, costing companies money better spent on accessibiity or security improvements and trashing analytics, it was only a matter of time before someone caught on to the nefarious possibilities of a popup that the user has been conditioned to see (and accept without scrutiny).
This law was one of the bloody stupidest moves in the history of technology and serves only to reinforce the unfortunate attitude that clicking a box can equate to "informed consent". A classic case of confusing the success of a mechanism with the desired outcome.
"Life is pain Highness. Anyone who says otherwise is selling something"
Westly, The Princess Bride
Because it is the bloody server owner who inflicts the tracking cookies on its users. Therefore it's their responsibility to make sure that the users are informed about being fucked over.
Finally! A year of moderation! Ready for 2019?
Do you ever restart your browser? I mean other than for kernel or browser updates?
Self destructing cookies gets this right. That add-on should be built-in functionality with an opt-out for the few who don't want it.
Finally! A year of moderation! Ready for 2019?
Because "collecting personal data" is also interpreted to mean cookies of pretty much any kind, meaning it applies to almost all website.
That is because almost all websites collect personal data. They could just stop doing that; they have no legitimate reason to do so. Then the cookie warnings would go away.
Finally! A year of moderation! Ready for 2019?
Well, the intention is that the consumer is to start questioning why. I mean, if I go a browse a few pages, not logging in or anything, WHY is it setting cookies? Why does it need to track me? Fine, sure, if I log in, you need a cookie to track that. But if I'm a guest, why are you doing it? Why do you need session cookies when I'm just pulling information?
I mean, we asked why people stored cookies just to view static web sites. And most web content is static - if I'm finding information out about a car, I don't need a cookie to track me as I view the options and features and specifications.
Etc. etc. etc.
The entire EU is covered a common Data Protection law to ensure peoples' privacy is respected by companies collecting private data. Some idiotic jobsworths have interpreted this have chosen to interpret this that everybody must opt-in to visit a website.
There is no such requirement in the directive, here is the UK Information Commissioner guidance on what is required.
https://ico.org.uk/for-organis...
How about: browsers do not accept clicks on items with less than 100% opacity? Or at least something like 50% opacity? I can't think of a legitimate reason to make user click on something invisible, so there's no reason to make anything invisible clickable.
There are thousands of such petty issues, and some not so petty. But it's the principal of the thing, we will not be ruled by someone in another country. Oh and it's not petty getting a banner on every single website I visit, it's as annoying as ads. Anyone got an adblocker that blocks cookie notices?
There's a browser extension for people who wish to hide the nonsense cookie notices:
http://www.kiboke-studio.hr/i-...