Forcible /g00 adware insertion on newspaper websites

[uBlock-user]

URL(s) where the issue occurs

orlandosentinel.com
sandiegouniontribune.com
sun-sentinel.com
mcall.com
boston.com

Those are the ones I have seen so far, there may be more.

Describe the issue

Forcibly inserts g00 adware content and abuses window.location API if blocked by a filter like /g00^$important until it turns into a bad request.

Screenshot(s)

https://i.gyazo.com/86ab54811f6aaa1785b3d308566d6af6.png

Versions

• Browser/version: [here] Chromium 57
• uBlock Origin version: [here] 1.10.0

Settings

Default

Notes

1. This didn't happen when I visited the website few days ago, however it seems the website is infested with adware as of today, as it keeps trying to load the /g00 stuff when it fails the first time and it also inserts shitty adware cookies too.

2. Blocking inline script does stop the onslaught attack of /g00 however breaks pictures from loading and possibly other things.

[gorhill]

The /g00 stuff is Instart Logic's crap. I have no problem with perceiving this as crapware -- their code goes out of its way to work against end users, doing its best to try to turn user agents (browsers) into proprietary devices.

[uBlock-user]

Well is there any solution for this, besides from blocking the inline scripts ? Blocking inline scripts would be the last thing I wanna do, that's why I posted here.

[gorhill]

is there any solution for this

I will be able to answer when I have the time to investigate.

[IsraeliAdblocker]

I've investigated Instart Logic's crap for the past 3 hours, I now know how they work, how they communicate, how they implement on new customers and etc.
I have a lot of information to reveal and I know the best non "cat & mouse" solution to fight them that we can implement right now.

@gorhill , If you can arrange private channel maybe an invisible thread on issues.adblockplus.org (just give me access I am using the same username there) I will post there all the details.

I don't want Instart Logic people to see my research report.

[uBlock-user]

@IsraeliAdblocker Please do. If these guys find success, soon all other major blogs and websites will be infested with it and we will be forced to block inline scripts every now and then, so far folks at easylist forum came up with a filter which no longer works and only worsens the situation.

[okiehsch]

example.com##script:inject(abort-on-property-write.js, I10C) works on my end.
Example:
Go to http://www.sandiegouniontribune.com
You will get peppered with g00 requests.
Now add sandiegouniontribune.com##script:inject(abort-on-property-write.js, I10C)
no more g00 requests, at least on my end.
Should work with all the mentioned domains.

[gorhill]

example.com##script:inject(abort-on-property-write.js, I10C) works on my end

Tried first site in list, orlandosentinel.com, and the site is rather broken, images won't display.

I suggest:

orlandosentinel.com##script:inject(wowhead.com.js)

Will await feedback.

[okiehsch]

orlandosentinel.com displays fine on my end, nothing appears broken,
anyway, if I go to orlandosentinel.com, then clear cookies, add
orlandosentinel.com##script:inject(wowhead.com.js),
then reload this is the logger output filtered for "g00"

and this after I add orlandosentinel.com##script:inject(abort-on-property-write.js, I10C)

and like I said all the pictures display just fine on my end.

[okiehsch]

The only mentioned site that doesn´t work on my end is boston.com,
but the issue there seems to be the filter boston.com##script:inject(i10c-defuser.js)
in uBlock filters list, if I disable it, it also works on my end.

[uBlock-user]

sandiegouniontribune.com##script:inject(abort-on-property-write.js, I10C)

That does stop the onslaught attack /g00 attack, however manipulates and adds /g00/refferr/i to the domain at the address bar, and still adds referrer tracking cookies.

sandiegouniontribune.com##script:inject(wowhead.com.js)

This one stops the attack from happening at the root page, however cookies are still created and inserted to the browser and occasional /g00 ads get loaded silently after few mins.

[okiehsch]

Did you clear the cookies before you added the filter?
Because I don`t see any.

Neither is there anything added to the domain.

[uBlock-user]

Yes I do, I have page opened in another tab. Please let me finish what I'm testing. Also by cookies I meant third-party cookies which are inserted as first party.

https://i.gyazo.com/d40c182c13f113fb41ddee2a4ac4d5fd.png

using Wowhead reduced the amount crap cookies being inserted however some are still inserted apart from the main domain, even when I'm blocking 3rd party cookies and site data.

Apparently wowhead isn't effective as I thought. I deleted all cookies/site data related to the site sandiegounion tribune and with wowhead filter reloaded again.

Website (after few secs) - https://i.gyazo.com/b5fd844104770562743a921908b52b26.jpg

Cookies - https://i.gyazo.com/513e196f14fa3587ec624ade2a5c3bcf.png

[uBlock-user]

Tested with sandiegouniontribune.com##script:inject(i10c-defuser.js)

same result as wowhead, ads manage to load after few secs and crap cookies are being inserted.

[IsraeliAdblocker]

@gorhill , Please tell me how can I privately share my research with you?

[okiehsch]

@gorhill I can, not reliably, sometimes it works, reproduce a broken orlandosentinel.com
with the filter
orlandosentinel.com##script:inject(abort-on-property-write.js, I10C).

So my previous post was inaccurate. The reason that I couldn´t reproduce was that I didn´t
realize that I used Chrome 49 on that computer.
I still can never reproduce a broken orlandosentinel.com with Chrome 49, but I can with Chrome 55.
Sorry for any confusion I caused.