Feature Articles

Blocking Ad-Blockers on Websites Has Backfired Predictably

The internet, as many lawmakers, entrepreneurs, and lawyers have discovered to their sorrow, is not a place that is easily governed by rules. Shutting down a service you don’t like only means that within days, a dozen competing entities will grow up to fill the gap. Remember how shutting down Napster only led to the proliferation of services like Kazaa, LimeWire, and BitTorrent? Remember the decade-long game of whack-a-mole that the European Union played with The Pirate Bay? Remember how there are now roughly twenty darknet markets replacing The Silk Road?

Trying to shut down something on the internet that you dislike is akin to shooting arrows into the ocean—it just makes you look dumb. With that in mind, here’s the latest silly thing that organizations are trying to deep-six: Ad-Blockers. Companies such as The Economist are now using a tool called PageFair in order to prevent users from using AdBlock on their websites.

From a certain point of view, the widespread adoption of ad-blocking software must look extremely hypocritical. Companies have got to make money, after all, but users demand that their content should be free. Using advertisements to support revenue is a perfectly legitimate way of making money. Although I use AdBlock personally, I make sure to whitelist the sites that I visit most often. (Though I don’t actually click on any of the ads.)

People who block ads, however, have a perfectly legitimate complaint. Ads, especially flash-based ads, are often a vector for malware. They’re also annoying—have you ever had to sit through a thirty-second video in order to get to an article that takes thirty seconds to read? That’s just bad practice. Lastly, many people struggle with a slow internet connection, and with some websites loading as many as fifty ads and trackers on a single page, ads just add insult to injury in terms of page load times.

Some companies are striking back at the ad blocker trend. Even AdBlocker itself allows what it deems “acceptable ads” to be automatically whitelisted by the service. More nefariously, it appears that companies such as Google have straight-up bribed ad-block in order to keep their ads on the internet. Even more nefariously still, it appears that companies such as the Economist have resorted to using a program called PageFair as an ad-blocker-blocker.

So, here’s why using PageFair is a stupid decision. First of all, here’s a real shocker: PageFair got hacked. For about 90 minutes on October 31st, five hundred sites using PageFair tricked their users into downloading a program called Nanocore. Nanocore was actually designed as a reputable program—its used by systems administrators to remotely fix and patch computers. However, Nanocore is also quite popular with hackers as a way to infect computers. Once a computer is infected with Nanocore, every aspect of its operations—including attached peripherals like your printer and webcam—can be controlled remotely. Obviously, this is a bad problem to have.

Here’s where it gets even worse. This is the advisory notice that the Economist published subsequent to the PageFair hack. Notice how their advice to consumers doesn’t actually describe the type of malware that infected them? That’s bad. Even though in most cases RAT Trojans such as Nanocore can be detected and removed by run-of-the-mill antivirus software, they can cause a lot of damage very quickly. Attackers had free reign of infected computers a full three days before their access was cut off. Releasing a notification like this without telling users the specific risks to their personal data is extremely irresponsible.

Lastly, there’s the staggering irresponsibility of using a product like this without telling anyone. Although the breach wasn’t connected to the PageFair technology itself—their site indicates that a spear-phishing attack got the ball rolling—the fact that a single point of failure was able to compromise users on over five hundred sites is simply ludicrous.

The Economist, and other PageFair users have just proved the point of everyone who uses ad-blockers in the first place. The point is that ads on the internet are extremely broken.  As stated, they slow down the user experience, they are annoying and difficult to get rid of, and they are vectors for malware. Trying to punish people who opt out of this experience is absolutely the wrong idea.

Andrew Sanders

Andrew is a writer and editor based out of New England. He specializes in technology and information security.