Skip links

Ad-blocking browser extension actually adds ads, say Imperva researchers

Security vendor Imperva’s research labs have found a browser extension that claims to block ads, but actually injects them into Chrome or Opera.

A post from Imperva staffers Johann Sillam and Ron Masas names an extension called AllBlock as the culprit.

The extension does block ads, they write. But it also runs a background script that injects a snippet of JavaScript code into every new tab that users open.

That code snippet talks to remote servers and downloads a payload that Imperva claims is connected to operators of an ad-injection scam.

That scam, Silland and Masas observe, pipes in ads other than those from legitimate sources that would otherwise appear on a web page. Some of those ads include affiliate links – whoever is behind this extension could be skimming commissions from netizens that click on injected ads.

Google has often said it takes the security of Chrome extensions seriously, and vets them to stop all sorts of naughtiness. It looks like those processes have not worked brilliantly on this occasion – even though this scheme has the potential to rob Google of revenue. Opera’s fateful decision to offer compatibility with Chrome extensions means it gets smeared by association.

Imperva has some issues, too. As The Register read its post to compile this story, we noticed that offers to install software called “Cyber Security Leader”. The company’s site also includes a Chatbot that creates notifications in a Chrome tab.

It’s not just bad actors that mess with browsers. ®

Update: Imperva’s been in touch to explain that it has “created a chrome application for the website, which allows users to install the homepage as an app either on their desktop or their mobile device.”

The firm claims the application is innocuous and “lets the user browse previously visited pages even if they are offline and creates efficiencies by improving the overall load time of each page.”