Eraser deleting the word Pop-ups

Advertising: The Digital Turf War on your Desktop

Hello! Here’s your computer after ten minutes on the Internet:

Advert party on the desktop

This nightmarish vision of “Buy all the things” is a very old screenshot of mine from many years ago, when ads were in full swing, Adware vendors were happy to cover your screen in wall-to-wall pop ups and ad blockers were still running around in diapers.

Ads, ads everywhere: The Early Years

Everybody was a bit sick and tired of their browsers being buried beneath a raft of six thousand “You’ve won a prize, honest” boxes and the rise in popularity of blocking adverts was a given.

Indeed, at one point in 2006 adult webmasters were so enraged about Adware adverts that they started detecting which visitors had Zango installed then redirecting them to a page warning them about the programs:

Zango blocked

Exciting stuff, and that was just the beginning…

“Ads keep the Internet Free…”

Over the years, many website owners and ad networks have become increasingly annoyed at the practice of blocking ads, because it cuts into revenue streams. Some sites rely exclusively on ad content to pay for upkeep, and you’ll find no end of strong words on both sides of the subject – in some cases, spilling over into community in-fighting. We seem to have hit a bit of an impasse, especially in light of the immense popularity of Malvertising – it only takes one bad ad on a website and your PC is potentially trashed.

When you visit a website, can they say yes to the following?

1) They know the ad network(s) they’re using intimately, and said ad network has full details and knowledge of the people supplying the ads. Nobody supplying ads are listed as “Jimmy Mc Fake Name” of 123 Fake Street, Pretend Town.

2) Should a bad ad make its way through, the ad network will hold the people who supplied the ad responsible and take them to task. No “It wasn’t us, it was them” shenanigans.

3) The website has a clearly written policy somewhere on site, which outlines their ad policy and what they do to ensure nothing bad will (hopefully) get through.

The answer is “Probably not”. Most webmasters just pick whichever network sounds like it’ll make the most money and cross their fingers. Knowledge of the inner workings of ad networks is quite the specialist subject, and given how many Malvertising meltdowns take place on a regular basis it often seems as though the ad networks themselves have no idea what’s going on, never mind the webmasters.

A thankless task, then, and in my humble opinion guilt for blocking ads should not be placed upon the shoulders of businesses and individuals tired of seeing another PC reduced to an overpriced paperweight.

No ads? No content.

There’s always been a game of cat and mouse between ad providers and ad blockers. When Adware was at a peak, they’d “gate” the content behind installers – and if you switched off javascript to prevent the installer from popping, they’d know and direct you to pages demanding you re-enable it.

Nowadays, you probably won’t find Adware gates – but you will find all manner of messages reminding you about your ad blocking habits.

Don't block ads notice

On top of that, you may see additional notifications letting you know that Adblock Plus may be the focus of messages specific to its users and would you like to switch them off?

A message for Adblock Plus

This site has been known to show targeted messages to Adblock Plus users. Do you want Adblock Plus to hide targeted messages?

You may be picking up the definite whiff of an arms race slowly escalating. On the fringes, you can already see some site owners settling for the nuclear option (top tip for website owners: don’t do this).

Here’s a website offering up movies which, when visited with Javascript disabled, will take you to a large warning page which explains how to switch it back in to view the content:

Website says enable Javascript to continue

What do you see if you enable Javascript? A collection of survey offers!

Survey questions

I’d say it was worth switching it back on, except the sarcasm detector might blow the roof off.

Here’s another message to users of Adblock, which interestingly does mention a guarantee of “clean ads”:

Adblock enabled

We have detected that you are using Adblock on your web browser. Please disable Adblock or simply disable your Ad blocker....Ads are necessary to keep the site free. We guarantee clean ads.

I particularly like the below notice which detects an ad blocker, delays a download and asks visitors to whitelist their ads while simultaneously admitting that “they” (as in, the ad networks and not themselves) cannot guarantee clean adverts which are free of Malware.

Whitelist our ads

The blurb reads as follows:

Ad Blocking? Read this while waiting longer

There’s the rub – “Switch on our ads, we can’t guarantee they’ll be safe and report a rogue advert after the event.” Reporting a bad ad which just encrypted all of your files is so much more hassle than just disabling any and all adverts, and a lot to ask of random visitors.

Would you take the risk? On the other hand, without adverts most of your favourite sites would vanish. As I said earlier – it’s quite the impasse.

Dodging Ad Block Detection

You’ll also find tools designed to bypass the ad networks / websites detecting that you have blockers installed. Here’s one on the Google Chrome store, which claims to hide an Ad blocker from being detected by a website wanting to serve up some adverts:

Hide your ad blocker

The page reads as follows:

This extension hides your AdBlocker from Anti-AdBlock scripts on websites such as [urls removed] and more. This is an anti-anti-adblock extension, which removes time penalties and popups/warnings about your activated AdBlocker.

Nice! Except, er, it doesn’t seem to work. The reviews are less than great, and a lot of the sites listed either don’t exist anymore or use ads which have been whitelisted by Adblock Plus. One site is still live, but when we visited it with Adblock Plus and the extension installed we were greeted by the LARGEST DISABLE YOUR BLOCKER splash I’ve ever seen:

Disable your ad blocker

Nice idea, shame about the execution and so on.

Rise of the Ad Blocker Blockers

So far we’ve had:

1) Adverts.

2) Ad blockers blocking adverts.

3) Adware serving adverts.

4) Websites blocking Adware.

5) Websites blocking Ad blockers.

6) Extensions which hide Ad blockers from websites hunting Ad blockers (er, sort of).

The next step up is dedicated Ad Blocker Blockers. I’m not entirely sure what form this new form of tech is going to take – it seems to do most of the things the above sites already do – but what particularly caught my attention is the notion of “smashing through the Ad blocker“. If websites start blasting their way through whatever blocking technology the person at the PC has installed, will we see those sites being flagged as malicious by the public at large and, eventually, security software / blacklists? At the very least, you’d expect it to trigger a lot of bad feeling towards the sites in question, so it remains to be seen how popular these new forms of ad blocker detection turn out to be.

Ads, ads Everywhere: The Future

Adverts are slowly but surely taking some of their less popular features onto the streets:

We already have litterbugs being shamed in Hong Kong via DNA and mobiles being used to serve targeted ads in malls. Throw in the relentless rise of advertising on videogame consoles and there seems to be no escaping adverts, or the arguments for – and against – blocking them. Will we eventually see real world Ad blockers? It’s entirely possible, and the first iterations of such devices are already climbing off the drawing board.

One thing is for certain – the digital turf war on your desktop shows no sign of stopping anytime soon, and it would be a brave individual wanting to step onto the battlefield.

Christopher Boyd (Thanks to Jovi for additional research)


Christopher Boyd

Former Director of Research at FaceTime Security Labs. He has a very particular set of skills. Skills that make him a nightmare for threats like you.