Researchers Defeat Perceptual Ad Blockers, Declare 'New Arms Race' (vice.com)

dmoberhaus writes: Perceptual ad blockers were supposed to be the "superweapon" that put an end to the arms race between advertisers and users. According to new research, however, perceptual ad blockers will come out on the losing side in the war against internet advertisers and expose users to a host of new attack vectors in the process. Researchers at Stanford tricked six different visual classifiers used in perceptual ad blockers with adversarial ads designed to trick the ad blockers by making nearly imperceptible changes to the ads. "The researchers tried several different adversarial attacks on the perceptual ad blockers' visual classifiers," Motherboard reports. "One attack, for example, slightly altered the AdChoices logo that is commonly used to disclose advertisements to fool the perceptual ad blocker. In another attack, the researchers demonstrated how website publishers could overlay a transparent mask over a website that would allow ads to evade perceptual ad blockers."

"The aim of our work is not to downplay the merits of ad-blocking, nor discredit the perceptual ad blocking philosophy, which is sound when instantiated with a robust visual ad detector," the researchers concluded. "Rather, our overarching goal is to highlight and raise awareness on the vulnerabilities that arise in building ad blockers with current computer vision systems."

Comments

Why visual?

[DogDude]

Why would they test a visual ad blocker? Who uses those? All the ad blockers I have ever seen block domains. A visual ad blocker seems doomed to fail.

Javascript

[Anonymous Coward]

If ads get too pervasive and hard to block people could just disable JavaScript completely.

Re:Javascript

[ChromeAeonuim]

That's how I do it. I use NoScript, and rarely ever see ads. The ads themselves are all being served up from some other site anyway, so even if I allow the scripts coming from the site itself, the ads are still blocked, which is fine by me.

If advertisers really want me to see ads, the simple solution is to stop being assholes. Stop using tricks like native advertising to deceive users, stop redirecting to God knows which questionable and potentially malicious sites, stop advertising scams, and in general stop being so hostile. They'll piss and moan about how I'm taking away advertising revenue, when really, all I want to do is keep myself and my machine safe. You guys are the ones who started the hostile behavior, not me, so don't be surprised when I react accordingly.

If they really want me to see ads, it is simple. Have an image, using standard basic Img tag, saying 'Drink Brand X Cola!' or whatever, clearly linking to brandXcola.com. There, simple. No scams, no malware, no tricks, transparent and honest. If they don't want to do that, then it's not my problem if someone's unethical behavior bites them in the ass.

Re:Javascript

[Opportunist]

This is basically why the ad industry is in the huge pit they're in today. You might notice that the amount of sites that beg and whine to turn off the adblocker has increased in the past 1-2 years. Why? Because now even the computer illiterates block ads.

Ads have always been part of the internet. Pretty much since the first time the masses entered with AOL there were banners. And ads got more and more invasive because they could. They'd pop up, over, under, blare from speakers and go fullscreen video. Why? Because advertisers were used to getting away with it from TV. What would you do? Change the channel?

What they didn't take into account was that on a computer, the owner of the computer can easily turn off their obnoxious invasion. But that was ok. The ones that could were few and far between. And the illiterates were plentiful enough to keep the ad industry going.

But apparently not enough people clicked their ads. Even when they tricked people by disguising them as "close" buttons. So ads got more and more invasive, because apparently the ad industry thought that people somehow missed that full screen flashing and honking ad. And at some point the breaking point was reached: The illiterates installed ad blockers.

To give you an idea what we're talking about: We're talking about the user that dutifully closes 20 error messages when he starts his computer from programs that didn't quite uninstall properly. The user that doesn't care that his i7 is slow as molasses when browsing because of the 99 tracking plugins littering his browser, or that he has a browser real estate of a stamp on his 28" screen due to all the plugin bars that somehow got installed. The ad industry managed to piss off THIS user enough to get off his ass and install an ad blocker.

And he's not gonna uninstall it. Can you imagine just HOW much you have to piss off someone like this to block your ads? You could promise him a new car to uninstall that ad blocker and he won't uninstall it. That ship has sailed.

Moving the wrong way.

[Gravis Zero]

If you want to get rid of ads, you shouldn't be looking to completely prevent them from loading because that's an eternal game of cat and mouse. Instead, you should be looking to poison advertisers click-though information. Basically, fooling ads into thinking you have clicked them and loading things in the background (after you have loaded the page excluding the ads) would have a very negative effect on advertisers because it spoils the very thing they keep track of: who clicks-through to a site. If most people provided a completely false click-through and browsing information it would diminish the value of ads entirely.

Honestly, people are fighting ad networks all wrong.

Re: Moving the wrong way.

[Anonymous Coward]

Clicking on ads automatically on behalf of users would be very dangerous. I'm an author of the paper discussed in the article, and we looked at one ad-blocker that actually does this (specifically it clicks on ads to check whether they link to an ad statement page). It turns out that you can fool the ad-blocker into thinking something is an ad, which then causes it to click on an arbitrary link of your choice... You could use this for DDoS purposes, cross site request forgery attacks, etc.

Re:Moving the wrong way.

[Anonymous Coward]

If you find yourself in a fair fight, your tactics suck. Have a type of proxy set up for the ad servers based on their DNS call, that allows the original content in, but tells the ad networks you're based in, say, Nepal. Poison the stream with false information. Pretty soon the ad networks will realize they are ineffective.

I already blackhole every ad network at the DNS level using a Pi-hole. I add new subscriptions all the time. I also block referers, CSS history, the ability for sites to see anything about my computer or it's OS, software/hardware. I falsify my fingerprint, as it were. Works a treat. I test myself against test sites to see how I'm faring once or twice a month.

Re:Moving the wrong way.

[Rockoon]

Doesnt sound like fraud to me. The user has not given you a promise to do anything in particular with your advertisement, therefore they are not misleading you when they click but dont visit.

Re:Why aren't adblockers implemented like this?

[markdavis]

>" don't know why ad blockers don't then just implement the obvious: Load the ad. Load the javascript. Just turn all the pixels that you display for those ads to white, and all the sound to zero volume. [...]What are the obvious flaws to this design that I am missing?"

1) Because that still causes the page to load very, very slowly. Try it- the speed difference is almost unbelievable on many sites. Many sites that load and render in 3 seconds suddenly take 6, 10 or even more seconds.

2) Because it doesn't help prevent tracking and spying.

3) Because it doesn't reduce bandwidth/date usage.

4) Because it doesn't reduce memory, CPU, and power/battery usage.