Site-level ad blocking evasion (submitted by community) | expressen.se & aftonbladet.se

[lukemulks]

• Did you search for similar issues before submitting this one?
  Yes

• Describe the issue you encountered:
  Filed from a Community user.
  Link to Community:
  https://community.brave.com/t/websites-showing-ads-even-with-all-adblock-filters/908

"Two Swedish sites are still showing ads with adblock on, i have tested with all filters on the desktop version of brave and it still shows ads. There are no ads on the iOS version of brave and no ads when using chrome with adblock/adblock plus. Expressen is the worst, you can remove some ads by using swedish fanboy but not all..."

The two sites are:

expressen.se
http://www.aftonbladet.se/

• Platform (Win7, 8, 10? macOS? Linux distro?):
  Mac OS (OS X El Capitan) - likely in other OS's as well.

• Brave Version (revision SHA):
  0.13.0

• Actual result:
  Ads

• Expected result:
  Blocked ads

• Will the steps above reproduce in a fresh profile? Tbd

If not what other info can be added?

• Is this an issue in the currently released version?
  Yes
• Can this issue be consistently reproduced?
  Tbd

User experienced w/flash enabled and disabled in Brave. Going to investigate (Luke)

[lukemulks]

Additional note from the same issue in the Community, related to these two sites on MacOS (in Windows, this is not an issue from what they've tested)

Community URL: https://community.brave.com/t/websites-showing-ads-even-with-all-adblock-filters/908/6

Hi i noticed a new very strange issue on these websites!
I tested if i had the same problem with my pc running windows 10 and brave 0.13.0 and the ad issue is not there but the website just doesent want to update to https it just says that i am using a insecure connection... I have tried to turn on and off the brave shields but it doesent work.

Really strange i have restarted the browser and tried all those things you may suggest to a noob 😉

[Jacalz]

Well i just wanted to say that it was the same problem on two computers one running OS X El Captitan and one running MacOS Sierra... I never tested on mavericks as it said in the description ;) Just wanted to point that out ;) By the way I am the same person that submitted the issue :D

[lukemulks]

@Jacalz updated the issue above to reflect! Thanks!

[lukemulks]

@Jacalz was kind enough to update on Community after reviewing the sites in question post: v0.13.1

https://community.brave.com/t/websites-showing-ads-even-with-all-adblock-filters/908/7

• Ads are no longer being reported. I was unable to repro to get ads to display either.
• White space is observed where the ads were, but that's covered in a separate GH issue.
• It appears that one of the sites doesn't have an SSL cert, so HTTPSe is functioning as expected in that case.
• It appears that the other site in question does have an SSL cert, but is using some redirecting to send the user back to http over https. This may be to allow for trackers to pass data in the clear, but I will investigate. We won't be able to update the publisher redirect behavior since it is taking place from their configuration, and tracking concerns are diffused when tracking protections are enabled through the shields.

Given the above, I'm going to close this ad-related issue, and will open a separate one if it appears HTTPSe is not working as expected with the one site mentioned above.

Thanks again @Jacalz - really glad we have you in the Community. :-)

[lukemulks]

Re-opening the issue, as a pub has resurfaced with what appear to be wallpaper ads and interstitials.

from @Jacalz via Community: https://community.brave.com/t/websites-showing-ads-even-with-all-adblock-filters/908/11

Ok here I am again after all this time to say that the issue is back again for me in 0.13.4! 😬 "http://aftonbladet.se" shows a big background ad that covers the whole background and some times there is a big ad square covering the whole screen without any ad in it, that you need to click on an "x" to remove

Domain: http://aftonbladet.se

Additional feedback:

It happends on both Windows 10 Home and Pro and on Mac OS X 10.11.6 (El Capitan) and 10.12.3 (Sierra) but does not happend every time, some times it is there but sometimes it always blocks all ads 😉
I could not get it to pop up today on my Win10 Pro pc but I managed to do it yesterday and on mac os X 😱
This very big leovegas.com ad is kinda disturbing

Screenshots provided:
https://cdn-standard2.discourse.org/uploads/brave/optimized/1X/50e4dc099ebf7c27734a6ab50a2245d592d2c4f4_1_690x350.jpeg

https://cdn-standard2.discourse.org/uploads/brave/original/1X/f93e8c3686c146adfa487c3a90a4e70a7cf59e0d.png

Domain: http://expressen.se/

Ok, here is a update to you about http://expressen.se/:
Very rarely there is a full screen video that pops up and you need to click it away 😉
Looks like this:

Screenshot:
https://cdn-standard2.discourse.org/uploads/brave/optimized/1X/e0a187b3fed58405d5a83825249293ead2043926_1_690x349.jpg

The intermittency sounds like a campaign delivery pattern (some cases, ads may not be available to serve, so the issue is not reproduced in every instance).

Checking on:

• Regional blocklist settings for the area that this was reported from.
• Investigating network traffic from the US to attempt to reproduce.

[lukemulks]

For: http://www.expressen.se

I've been able to reproduce, and determine the root cause (at least in the US).

Expressen is using a 1p request system. Some 3p ads are getting thru, which I've been able to block the majority of using these rules:

||biowebb-data.s3.amazonaws.com^$script,image,domain=expressen.se
||richmetrics.com^$script,image,domain=expressen.se
||adtomafusion.net^$script,image,domain=expressen.se
||ld1.lpbeta.com^$script,image,domain=expressen.se
||glimr.io^$script,image,domain=expressen.se

This rule prevented their embedded ad video player from loading video ads:
||csp.screen9.com^$script,image,domain=expressen.se

@Jacalz can you do me a favor and attempt the following, and let me know if you're able to reproduce. The problem is that half of these ads are 1st party, and not a threat, but some are. It's hard for me to gauge all the inventory being served as I'm in the US, so if you can check in your browser it should help.

1. Enter about:adblock your browser URL bar
2. At the bottom of the window, there is a Custom Filters field, can you please paste the following block of text in that field:

||biowebb-data.s3.amazonaws.com^$script,image,domain=expressen.se
||richmetrics.com^$script,image,domain=expressen.se
||adtomafusion.net^$script,image,domain=expressen.se
||ld1.lpbeta.com^$script,image,domain=expressen.se
||csp.screen9.com^$script,image,domain=expressen.se
||glimr.io^$script,image,domain=expressen.se

3. Refresh the about:adblock page.
4. Go to http://www.expressen.se/ in a new tab, and let me know if you're still seeing ads. Can you try refreshing several times to see if you're able to reproduce?

I'm going to include some of the dev tools steps in Community for you to try in case the above rules don't work.

I'm going to check out the other domains as well, but we're getting close with Expressen.se from the looks of things, I have not been able to repro after the rules above were applied (so far)

Thanks!
Luke

[lukemulks]

Expressen.se has been investigated, tested and has a PR submitted in adblock-lists (with the help of @Jacalz - thanks!)

Expressen.se adblock-lists issue: brave/adblock-lists#6
Expressen.se adblock-lists PR: brave/adblock-lists#7

Checklist for this issue:

• expressen.se
• aftonbladet.se

[lukemulks]

Update - found an additional item on aftonbladet.se that has been added to the issue and pr noted above in adblock-lists.

Also discovered that the same ad implementation is in place on both domains, so appended the fliter rules to include both and am seeing the issue resovled on both domains.

going to close this issue here, and will track any changes required in: brave/adblock-lists#6