Banner ads on CNN.com contain keyloggers

Sites bemoan ad blockers but then take no responsibility for the ads that are shown. That needs to change - it’s not like print advertising.

Lots of speculation here, not much analysis, even from lazy gits like me.<p>Chrome web inspector kindly gives the &quot;Initiator&quot; for every request. In this case it&#x27;s cnn-header-second.min.js. Load that, and Chrome again kindly detects minified JS and offers to pretty-print it.<p>The context here appears to be some kind of ad console tool, added by CNN, not by an ad. The relevant function is at <a href="https:&#x2F;&#x2F;pastebin.com&#x2F;EwgPAM6T" rel="nofollow">https:&#x2F;&#x2F;pastebin.com&#x2F;EwgPAM6T</a><p>It&#x27;s a bit obfuscated&#x2F;minified, and they don&#x27;t seem to have a non-minified version available, so it&#x27;s not clear exactly what functionality this is enabling.<p>Either way, not really a keylogger if it&#x27;s not capturing all keystrokes and shipping them off somewhere.

This is a prime example of how people so easily accept a headline shared on some news authority to be truth. Even the bright minds at hacker news are duped - just look at all the discussion happening here with the assumption the headline is correct.<p>The guy who tweeted this jumped to a conclusion, naively shared his discovery, then let it perpetuate leaving numerous victims of an erroneously altered world-view.

The point stands, but that&#x27;s not really a keylogger. It&#x27;s a library to manage keyboard inputs. Of course, it could also send all key info somewhere externally too.

I&#x27;m skeptical that this is a) from a banner ad and not from operation of the site b) a full blown keylogger and not a library included that is used for something like a photo gallery (that may have ads in it)

Scripts from the ad should be iframed no? Doesn&#x27;t make sense that an ad could run arbitrary JS within the same browsing context as the host.

It appears to be getting the keypress.js library from ssl.cdn.turner.com. Not clear if the data is being exfiltrated, though, just by looking at that tweet.

&gt;ssl.cdn.turner.com<p>Obviously bullshit. That&#x27;s CNNs CDN, not a &quot;banner ad&quot;. This guy did not put in the least bit of effort to verify his claims.<p>The script is included in <a href="https:&#x2F;&#x2F;edition.cnn.com&#x2F;.a&#x2F;2.103.4&#x2F;js&#x2F;cnn-header-second.min.js" rel="nofollow">https:&#x2F;&#x2F;edition.cnn.com&#x2F;.a&#x2F;2.103.4&#x2F;js&#x2F;cnn-header-second.min....</a>

This is getting upvoted without getting the context.

Here&#x27;s what is actually being run<p><a href="http:&#x2F;&#x2F;dmauro.github.io&#x2F;Keypress&#x2F;" rel="nofollow">http:&#x2F;&#x2F;dmauro.github.io&#x2F;Keypress&#x2F;</a>

How likely is this to be due to accessibility (ie. keyboard-only users) vs. keylogging?

I would suggest their &quot;lite&quot; [1] version. It is compatible with addons like NoScript, uMatrix, uBlock, Canvas Fingerprint Defender, CSS Exfil Protection, Privacy Settings and Self Destructing Cookies. I am using FF 52 ESR. Some of these addons may not work in 58+.<p>They could improve their HTTP header settings a bit. [2]<p>[1] - <a href="https:&#x2F;&#x2F;lite.cnn.io&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lite.cnn.io&#x2F;</a><p>[2] - <a href="https:&#x2F;&#x2F;securityheaders.com&#x2F;?q=https%3A%2F%2Fcnn.com%2F&amp;followRedirects=on" rel="nofollow">https:&#x2F;&#x2F;securityheaders.com&#x2F;?q=https%3A%2F%2Fcnn.com%2F&amp;foll...</a>

Iframed banner ads <i>can’t</i> log keystrokes outside their frame, browsers don’t allow that. And no site in their right mind would include ads that aren’t iframed.<p>A keylogger would be possible if there was some kind of zero day exploit, but this isn’t that, it sound like the tweeter didn’t do their due diligence. I’m curious how someone gets as far as looking through the minified JavaScript without knowing the browser doesn’t allow that, obviously(?), otherwise all your passwords and information would have been compromised long ago.

as someone who claims they are a programmer and researcher... you would think they would have done some more research on this and also have common sense to know that this isn&#x27;t a keylogger.

Things like this make me happy that uMatrix exists.

What could an advertiser good to track with key logging? Password to their... CNN account??

CNN, like the vast majority of news sites, is best viewed with javascript disabled. Pages load 10X faster, scrolling is not jumpy, the CPU doesn&#x27;t go crazy, and text reads just as well. It is hands down a much improved user experience.

It&#x27;s not CNN. It&#x27;s ads.<p>Advertising has ruined every medium it has ever touched. It will ruin the web. It is only a matter of time. It did not destroy ancient network television overnight. It did not destroy cable tv overnight.<p>The last time I saw cable tv a few years back, it had become so bad that after a long run of ads, they would then put bugs and walk on people right over the content of the show you were watching. Sometimes obscuring important content within that show.

cross domain script blocking should be enforceable in all browsers

press shift-control-z on cnn.com and you will get what this supposed keylogger is (hint - its not a keylogger or comgin from an ad) but merely a cnn internal tool..

Dearest Ad Industry,<p>This is why we run ad blockers. Since you won&#x27;t regulate your industry, we&#x27;re fixing the problem for you.<p>Love,<p>The Rest of the World.

I’ve noticed CNN has had a crap ton of redirect ads recently...