Slashdot Mirror
Chrome and Firefox Headless Modes May Spur New Adware & Clickfraud Tactics (bleepingcomputer.com)
From a report: During the past month, both Google and Mozilla developers have added support in their respective browsers for "headless mode," a mechanism that allows browsers to run silently in the OS background and with no visible GUI. [...] While this feature sounds very useful for developers and very uninteresting for day-to-day users, it is excellent news for malware authors, and especially for the ones dabbling with adware. In the future, adware or clickfraud bots could boot-up Chrome or Firefox in headless mode (no visible GUI), load pages, and click on ads without the user's knowledge. The adware won't need to include or download any extra tools and could use locally installed software to perform most of its malicious actions. In the past, there have been quite a few adware families that used headless browsers to perform clickfraud. Martijn Grooten, an editor at Virus Bulletin, also pointed Bleeping Computer to a report where miscreants had abused PhantomJS, a headless browser, to post forum spam. The addition of headless mode in Chrome and Firefox will most likely provide adware devs with a new method of performing surreptitious ad clicks.
for years. This is nothing new. Plus, PhantomJS is popular for attacking web sites.
If it's using up my clock cycles, memory, and bandwidth without my consent then it's malicious, no matter how minor the impact may be.
I think we have that already - it's called a service or daemon
There has to be an upside. So I'll ask, why are features such as this being added? What value to they bring to the computer user?
I'm not a web developer. Can someone explain to me how this "headless" feature is useful for developers?
You are welcome on my lawn.
What checkbox? I don't see anything on the v59.0.3071.104 settings page that relates to headless. It is not "enable running background apps when google chrome is closed", as that has been available for a long time and is probably unrelated. Headless mode is started via command line option: "--headless". Care to explain where the setting to disable this is ?
...attention.
Because honestly, if not even the adblockers will be able to do something about that, then it's bye bye Firefox on my part - I've been a loyal "customer" for the longest time, but hey - this gives the other lesser known browsers on the market some much needed attention, are you listening "insert-unknown-up-and-coming-popular-browser-team"?
What this world is coming to - is for you and me to decide.
The adware won't need to include or download any extra tools and could use locally installed software to perform most of its malicious actions. In the past, there have been quite a few adware families that used headless browsers to perform clickfraud.
My first reaction to this is, I don't see why I should be concerned. Malware authors had the option of including a headless browser of their own to enable this, and now they can use the already-installed browser instead. So... if I do get this kind of malware, it'll install less crap on my system? Seems like a win to me.
The people who use the convenience of a fully-scripted browser to trick adservers into thinking humans clicked the ads, are probably not going to opt to forego that convenience.
To use an absurdly extreme example, you're saying, "bank robber, you could simply deposit money into the bank and then make normal withdrawals instead of robbing." You should expect most bank robbers to decline your suggestion, and I think the people who commit click-fraud will be similarly uninterested in your "don't do that" advice.
"Believe me!" -- Donald Trump
Unless the app is an actual web browser, restrict it to communication with a single domain via TLS.
So great, Chrome is a browser. but when running as an embedded browser or headless, it should only be able to communicate with a single domain associated with the app it is running in.
If someone really wants to make a browser app, they can bundle it with a browser engine instead of embedded WebView, or at least make it a permission request to communicate with other domains.
This attitude is why apps become more bloated over time. Why optimize when your users can be forced to upgrade?
That's off-topic, though. I don't care if it doesn't have much impact, if software is doing something without my consent, and for it's own benefit at my expense it's malware, no matter how small that expense. Sadly, though, by that definition most software is malware.
" When Focus is running in the background, we'll remind you through a notification and you can easily tap to erase your ..." https://blog.mozilla.org/blog/...
Fell for the hyper babble I guess, thread did get me noscripts(.net).
Some guy named Clifford Stoll would like to talk to you about a $0.75 accounting discrepancy in the computer usage accounts.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
The problem is it's a way to keep the people with the compromised machines from becoming aware that they have compromised machines.
This space intentionally left blank
This is inevitable with the current trend of having the web browser be a thick client.
The trend is to put as much code as possible, i.e. thick client, in Javascript. Now, suppose one wants to leverage that code as middleware? Taa daa! Headless mode. We've been down this road before with client/server, thick/thin clients.
What makes Javascript particularly impossible to reproduce is the fast moving, every changing set of libraries. This will put pressure on the business logic sitting in all the Javascript to become middleware so as to capitalize on ones investment. As they say, what's old is new again.
I predict within the next 2 years headless browsers as middleware will be common place.
Even stupider is Firefox "policy" which now *refuses* to load Google's page because it claims the "domain certificate is misconfigured". You can't add an exception, period. In other words, there is NO WAY to browse Google with Firefox now.
Now I may be wrong, but I think those dudes at Google know a thing or two about web stuff, so I guess using Firefox for my day-to-day stuff is now a no-go. Brilliant, Firefox, just fucking brilliant.
Just cruising through this digital world at 33 1/3 rpm...
Adware is something that shows ads to you, by adding them or by replacing other ads by them. This has something to do with ads, but that is not sufficient to make this adware. If we define malware as something you would not agree to have on your computer, this is plain old malware, and I'd argue not one of the worst sorts.
Part of me is actually happy that the ad industry is facing problems with fraudulent clicks, even if I would not want this on my own computers. (Having said that, I might want something that clicks ads randomly.)
Microsoft had a COM interface (IHtmlWebBrowser) nearly 20 years ago. When .NET came around, they offered the same headless functionality in the form of the WebBrowser object. The concept isn't new, the only thing that's new is that Chrome and Firefox are finally copying an old IE feature!
This is exactly what we need to have a more secure OS. Make a lot of useless crap running on the background while we are playing minesweeper. Did we just forget about SMBv1 running in the background by default even on standalone workstations?
Correct me if I’m wrong but if I have malware on my machine that’s capable of starting up my web browser in headless mode (a.k.a. arbitrary executable), well I probably have much more serious issues to address ASAP!
Correct me if I'm wrong
OK
You're wrong.
You're corrected.
All it takes is a 3rd-party banner-ad or something similar and usually innocuous on a normally-trustworthy website that's been hijacked to run a short piece of script to open a headless instance and have it happily continue to run and remain 'open' and 'clicking' ads long after you've closed the visible instance you were using.
Or maybe doing something else. Depends on what the attacker wants. Maybe subscribing you to a bunch of MLP/furry/yiff-porn E/snail-mail lists and 'hookup' services.
So many possibilities...
I don't trust checkboxes, anyway. I hardly trust anything anymore -- open source or not.
Firefox has a checkbox for offline storage that reads, "Tell me when a website asks to store data for offline use". The problem is, the browser will only inform you if the data being saved is larger than a specific amount, and the browser allows data to be written in small chunks. As a result, if you enable this feature, the browser will happily save lots of offline data without ever informing you, let alone asking your permission. I had this checkbox turned on (it's off by default) and I would still regularly find dozens of megs of offline data saved. To "properly" enable the checkbox, you have to go to about:config and change multiple settings, including the exact cutoff limits. The GUI checkbox doesn't do squat.
All browsers, even Firefox, are resorting to these silly tactics to keep you from actually controlling what the browser can do. Don't get me started about how Opera used to regularly break the feature to disable updates (and constantly changed the command-line options), in an attempt to force updates even if you didn't want them.
Advertisers want clicks, I do not want to see their shit. So my headless firefox is allowed to click (with a separate profile because of tracking cookies and so on) and I can support the websites which cry because of my adblocker.
If anyone objects, he should stop crying. Either they want me to load their ad or they do not want me to.