Measuring and Disrupting Anti-Adblockers Using Differential Execution Analysis
Measuring and Disrupting Anti-Adblockers Using Differential Execution Analysis
复制标题
DOI：
10.14722/ndss.2018.23331
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Shitong Zhu;Xunchao Hu;Zhiyun Qian;Zubair Shafiq;Heng Yin
中科院分区：
文献类型：
--
作者：
Shitong Zhu;Xunchao Hu;Zhiyun Qian;Zubair Shafiq;Heng Yin
数百万人使用广告拦截器来删除侵入性和恶意广告，并保护自己免受跟踪和无处不在的监视。在线出版商认为广告拦截器是对广告驱动的“免费”网络的主要威胁。他们已经开始通过使用反广告拦截器来报复广告拦截器，这些反广告拦截器可以检测并阻止广告拦截用户。为了应对这种报复，广告拦截器反过来试图检测和过滤反广告拦截脚本。这种反复促使广告拦截器和反广告拦截器之间的军备竞赛不断升级。我们希望全面了解反广告拦截器，最终目标是使广告拦截器能够绕过最先进的反广告拦截器。在本文中，我们提出了一种差分执行分析来自动检测和分析反广告拦截器。在高级别上，我们通过访问有和没有广告拦截器的网站来收集执行跟踪。通过差异执行分析，我们能够查明导致反广告拦截代码引起差异的条件。使用我们的系统，我们在30.5%的Alexa top10 K网站上检测到反广告拦截器，这是之前文献中报道的5-52倍。与局限于检测可见反应的现有工作（例如，警告消息），我们的系统可以发现检测广告拦截器的尝试，即使没有可见的反应。通过手动检查检测到的三分之一的网站，我们发现没有可见反应的网站占90%以上，完全主导了有可见警告信息的网站。最后，基于我们的发现，我们进一步开发了基于JavaScript重写和API挂钩的解决方案（后者作为Chrome扩展实现），以帮助广告拦截器绕过最先进的反广告拦截器。
Millions of people use adblockers to remove intrusive and malicious ads as well as protect themselves against tracking and pervasive surveillance. Online publishers consider adblockers a major threat to the ad-powered “free” Web. They have started to retaliate against adblockers by employing antiadblockers which can detect and stop adblock users. To counter this retaliation, adblockers in turn try to detect and filter anti-adblocking scripts. This back and forth has prompted an escalating arms race between adblockers and anti-adblockers. We want to develop a comprehensive understanding of antiadblockers, with the ultimate aim of enabling adblockers to bypass state-of-the-art anti-adblockers. In this paper, we present a differential execution analysis to automatically detect and analyze anti-adblockers. At a high level, we collect execution traces by visiting a website with and without adblockers. Through differential execution analysis, we are able to pinpoint the conditions that lead to the differences caused by anti-adblocking code. Using our system, we detect anti-adblockers on 30.5% of the Alexa top10K websites which is 5-52 times more than reported in prior literature. Unlike prior work which is limited to detecting visible reactions (e.g., warning messages) by anti-adblockers, our system can discover attempts to detect adblockers even when there is no visible reaction. From manually checking one third of the detected websites, we find that the websites that have no visible reactions constitute over 90% of the cases, completely dominating the ones that have visible warning messages. Finally, based on our findings, we further develop JavaScript rewriting and API hooking based solutions (the latter implemented as a Chrome extension) to help adblockers bypass state-of-the-art anti-adblockers.