Slashdot Mirror
Researchers Defeat Perceptual Ad Blockers, Declare 'New Arms Race' (vice.com)
dmoberhaus writes: Perceptual ad blockers were supposed to be the "superweapon" that put an end to the arms race between advertisers and users. According to new research, however, perceptual ad blockers will come out on the losing side in the war against internet advertisers and expose users to a host of new attack vectors in the process. Researchers at Stanford tricked six different visual classifiers used in perceptual ad blockers with adversarial ads designed to trick the ad blockers by making nearly imperceptible changes to the ads. "The researchers tried several different adversarial attacks on the perceptual ad blockers' visual classifiers," Motherboard reports. "One attack, for example, slightly altered the AdChoices logo that is commonly used to disclose advertisements to fool the perceptual ad blocker. In another attack, the researchers demonstrated how website publishers could overlay a transparent mask over a website that would allow ads to evade perceptual ad blockers."
"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."
"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."
Why would they test a visual ad blocker? Who uses those? All the ad blockers I have ever seen block domains. A visual ad blocker seems doomed to fail.
I don't respond to AC's.
If ads get too pervasive and hard to block people could just disable JavaScript completely.
If you want to get rid of ads, you shouldn't be looking to completely prevent them from loading because that's an eternal game of cat and mouse. Instead, you should be looking to poison advertisers click-though information. Basically, fooling ads into thinking you have clicked them and loading things in the background (after you have loaded the page excluding the ads) would have a very negative effect on advertisers because it spoils the very thing they keep track of: who clicks-through to a site. If most people provided a completely false click-through and browsing information it would diminish the value of ads entirely.
Honestly, people are fighting ad networks all wrong.
Anons need not reply. Questions end with a question mark.
would create and update lists of sites they blocked.
And you can always manually individually block sites/domains.
Soon it will really suck if the domain you created has the letters ad in it,
As opposed to AdBlock which exchanges cash to allow some advertisers to "bypass" built in blocks.
The problem I have seen with ad blockers (and admittedly, I have only tried a few, and haven't put a lot of effort into trying to find the best or most useful one) is that they work by preventing the loading of certain parts of web sites. Like, they refuse to load images from a certain domain, or refuse to load and run javascript from a certain domain, or whatever. The important point is that I believe they work by not loading content that they want to block.
It is my experience that sites can detect this behavior - they can tell when you have loaded all of a page but not the ads, because they can see that your browser only fetched part of the page. They probably also embed javascript in ways that require that it be run and show an ad or else some other javascript notices that this did not happen, and then knows that you did not load the ad. And then they run other javascript that blocks out the content of the site itself because they have detected that you are running an ad blocker.
I don't know why ad blockers don't then just implement the obvious:
Load the ad. Load the javascript. Just turn all the pixels that you display for those ads to white, and all the sound to zero volume. The javascript won't know that behind the scenes the APIs that would display images have instead decided to show white pixels. The remote server will still see you fetching all the content and "presenting" it to the user.
I'm talking about switching ad blocking from a detectable and defeatable "don't show ads" to an undetectable (by the ad displayer) "do everything you would have done up to the last possible moment which is the presentation of the ad image/sound, instead showing nothing".
This seems so much more foolproof to me. It doesn't have the nice property of reducing your bandwidth usage by not even loading ads but ... I personally don't care much about that. I just don't want to see the ads.
The only recourse of the advertisers at that point would be to make the content of the ads intrinsic to the content of the site; like the site text renders in javascript that also renders ads, or something. At that point, I don't know what we do to stop ads ... maybe stop allowing javascript?
In terms of how to detect what is an ad, just let users clock on anything that shows up as an ad image, choose a pop-up "this is an ad", when they select that, white out the image, and add the URL of the ad image to a voting database. Then when fetching images, if enough votes have been cast saying that it's an ad ... treat it as such.
What are the obvious flaws to this design that I am missing?
Between those two I can't remember the last time I saw an ad, and if I do uBlox will generally zap it for me if I point it at it.
Early generation technologies are often fragile in superficial ways.
Big whoop.
The main counterexamples come from startup ventures who define turd polishing as job #1.
Eventually even the sane do have to polish the turd (in the context of an adversarial arms race) to achieve mass deployment. Ideally, you financed your startup to also succeed at stage Number Two.
Because when another drive-by-download or execute vulnerability pop up, it won't help you to load in background you are as vulnerable as loading in plain sight.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
FTFA :
One attack ... slightly altered the AdChoices logo that is commonly used to disclose advertisements to fool the perceptual ad blocker.
Am I missing something here? A slight visual alteration can defeat the recognition of a ad graphic? Yet we are in an era of face recognition and self-driving perception software - and only waxwork dummies' faces look constantly the same, and I doubt that every road "Stop" sign is pixel-perfect identical.
I am pretty sure that I've seen Perceptual Ad Blockers on Doctor Who. They're kind of like psychic paper, only in reverse.
You know, I've given internet marketers a chance to explain themselves. An opportunity to prove they're not complete morons who not only don't understand their product, but their customer. I've been patient with them as they introduce new and ever more obnoxious and invasive advertising techniques that are heavily lauded, but that don't actually work. I've read their blogs. I've commented on their forums. I've tried to speak reason to power. And now... I'm done.
As I've explained to these intrepid idiots in the marketing industry for the last decade, people block ads because they're a blight. They're implemented poorly. They often contain malware which largely goes unpoliced, and they diminish the reading experience on pretty much any site they're on. If you're on a website, and the ads don't completely destroy both the credibility and quality of the host site, you're probably on buzzfeed. Nearly everywhere else, you're going to notice this nonsense.
The war on adblockers is a lost cause. Breaking adblockers is not going to result in higher clickthrough rates. It never has, in the entire time it's been around. If a user LOVES your website, they might whitelist you. Short of that, they'll bounce and get your content from somewhere else. Calling attention to and requesting a modification in the software a user runs is a violation of user rights. Period. Plain and simple. And it raises suspicions about the host site, bringing to the user's mind the other invasive practices a site might be engaged in, and the handling of their personal data in general. If you wouldn't demand to look in someone's underwear drawer when selling them a newspaper, you shouldn't engage in the ongoing harassment of your users in this way. There is no moral difference.
Asking users who are taking aggressive steps not to see ads will only result in lower documented clickthrough rates. It'll result in more bounce traffic. It'll result in fewer people showing an interest in your site, and less exposure over social media. Mind you, a lot of people that have never clicked on an ad in their lives think nothing of sharing your article with their network of followers. If you track the engagement numbers on sites that behave in this way, you'll see a downward trend overall in their engagement numbers -- resulting, ironically, in fewer ad impressions, and fewer clicks.
I don't know if there's anything to do about it. If the industry wants to sit there and gnaw off its own leg, they're welcome to do it. And I'm sure they will. Like I said in the beginning of this rant, they're not exactly the brightest bulbs to begin with.
This signature has Super Cow Powers
Use NoScript. NoScript will kill 99% of ads just by stopping Javascript. If they insist on having Javascript enabled then I'll abandon their site and go elsewhere.
If they force unavoidable ads on us, we'll all just start clicking away like mad motherfuckers and bury them in useless, irrelevant clicks. I'll click on every fucking ad I see and never buy anything.
I do the same thing (more or less) with cold callers who want to sell me duct cleaning or tree trimming services over the phone. I say, sure, come on out- then I give them a bogus address.
If they somehow make it to my door (which occasionally happens) I just give them a blank look and tell 'em, "Sorry, I have no idea what you're talking about." (Plus, as I point out to them, we have no trees on our property, so why in the world would I make an appointment for a tree trimming service? heh heh heh)
My hope is that making them respond to the false positives will waste enough of their time and gas and money that they'll eventually sour on the idea, and it may just force them to reconsider if cold calling is really worth it. Three or four wasted trips a day starts to add up for a business that depends on booking valid (i.e. paying) appointments.
I know I'm just one guy....but just imagine the result if we all did that.
Just cruising through this digital world at 33 1/3 rpm...
Isn't this whole throwing unwanted ads in your face against your will and intention abusive?
Who are the goon-robots programming this shit and the idiots trying to make a buck with this got nothing better to do?
Popup in your face - please subscribe - and have to act upon plugging an email address like "Ihate..." in..
The behavior causing this should be penalized with mandatory pot smoking and we will see progress happening very soon..
The problem of adversarial images has been studied since 2013. There are over 1500 papers citing the original paper. https://scholar.google.ro/scho...
This. Because the outsourced ads are generally horrible and annoying. But very few places bother to run their own ad server anymore, since you have to make an effort to get the ads from somewhere.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }