As a typical software industry person, usually most of my searches land on stackoverflow. Besides software related quries, I sometimes, land on other stackexchange websites like bicycles, serverfault, superuser etc.
Last month I started observing a strange pattern. All of the stackexchange websites started opening popup ads on clicks. While looking for answers, click anywhere and a popup ad would appear. This was strange for me because:
- It is not normal for such websites to serve ads in this way
- I have ad block plugin installed in my browser, but the ad was bypassing it somehow
- No other person on my network was getting those ads
- A few other websites were also serving these ads
- Ads appear only on some plain http websites but none of the https website
Based on above mentioned points, I totally rejected the idea that stackexchange is serving these ads. My initial thought was that it is some kind of a malware installed into my browser and this malware is injecting ads into my normal browsing.
Finding & loosing the clue
It was very alarming for me as I am very careful about what gets installed on my machine and what is the source of the software. I thoroughly checked my system for possible trace of a malware. I checked installed applications, registry, startup items, running processes and every other possible thing. Finally I run the firefox without any plugin or extension but the ads were still being served.
Really annoyed by the situation, I pressed Ctrl+F5 and the ad stopped appearing. No more popups. This was possibly because of poisoned cache. Although I had solved the problem but this is now even more worrying. I am no longer getting the ads but someone managed to poison my browser cache and I have lost the clue.
Getting the ads once again
I never connected my system to any public wifi. I use it only at home, in office and connect it via 3G a few times. So, possible culprit was one of these three ISPs.
I almost forgot about the incident until yesterday. Yesterday, I was looking at a bicycle related question on bicycles.stackexchange.com on my iPhone. Naturally, I tapped on the screen. The poor Safari browser had several redirects and opened a popup. This time I was on 3G, Ufone 3G. This was exactly same behaviour.
Identifying the culprit
I immediately opened my laptop. Booted into Linux. Connected to Ufone 3G via hotspot connection. Opened a random stackoverflow question in Firefox Private browsing mode (no cache) and the popup ad is there. Connect to home internet and try the same steps. No popup. So, it is clear. Ufone is injecting popup ads code into stackoverflow website.
Why stackoverflow? I took dumps of same question opened via Ufone 3G and home internet connection and
So what was changed? First of all, obviously it was not Google who is serving the infected file. See the infected file response headers:
and the other one
So someone is using Microsoft IIS to serve
analytics.js. Obviously, Google does not serve its content from Microsoft IIS.
And here is what was injected at the bottom of the file:
another version had this:
Who is doing this? Why?
Honestly, I am not sure. It can be an employee of Ufone, it can be a malware infecting their servers or it can be multiple people in their management getting $$$s for clicks. In any case this is dishonesty and ethically wrong at their end. If they can hijack your browsing sessions, they can do anything they want.
I try to keep most of the my browsing on https but still there are a few websites on http. I also use Ghostery for firefox, I have blocked analytics.js and many other tracking from loading. Tunneling through Ufone 3G seems to be a good solution at this time.
Update [December 21, 2015]:
This is not something new. Many people have already written about it but no official response from Ufone yet and no action taken by PTA.
- First it was discovered by a tech blog Ahsan.pk
- Then it was discovered on 30th May, 2015 by Kamran Zubairy
- It was also shared by Ashraf Chaudhry
- Prominent Pakistani tech blog techjuice.pk mentioned it in their 4th June article
Now I am getting this randomly. 3 out of 10 times.
Update [Feburary 03, 2016]: At last got response from Ufone. As expected, they refused to accept the issue and suggesting me to install ad blockers :-/
Yet another reason for publishers to provide content over https.
Update [March 18, 2016]:
- The problem is still there. I registered a complaint with PTA with proofs. The result is that now Ufone knows how to bypass them. Now the injection is done randomly and it is hard to reproduce.
- It is now proven that this is not some misconfiguration or some virus in their servers. Ufone is doing this intentionally. And yes, I am not going to share the proofs here this time.
If You’re Not Paying For It, You Become The Product.