It should come as no surprise to anyone involved in the digital advertising ecosystem that fraudsters are always looking for new methods to target users with sophisticated digital attacks. As soon as innovative new ways of engaging with users are developed, cyber criminals aren’t far behind with a method for exploiting these innovations, particularly when there’s money to be made. Now, as push notification ads grow in popularity, a new threat to user security that capitalises on the push notification flow itself has arrived: push lockers.

Upon identifying these push notification specific lockers, between February and March AdSecure saw a 563% increase in the detection of browser locker attacks, and at the time of writing this article, we have protected our partners from more than 20 unique push lockers in under 24 hours.

What is a push notification ad?

Push notification ads are simple clickable messages, accompanied by a small image, that are delivered to desktop browsers or mobile devices, but only once a user has consented to receiving them. This is a key point, as the users have agreed to see the ads, leaving the perception that they are less intrusive than traditional formats, and develop a higher level of engagement from the user.

Push notifications work by displaying an initial permission request — managed by the browser —  when a user is visiting a site for the first time. Once the user agrees to receive these push notifications, they will receive them based on the frequency set out by the publisher. Should a user opt not to see push notifications, the browser logs this choice as well, and they won’t be asked to subscribe to them again.

What is a push locker?

The push notification format, while relatively new, is growing in popularity within the online marketplace for all the reasons mentioned previously: users have to opt-in to see them at all, and with that consent comes a higher rate of engagement. Brands using push notifications are seeing increased click through rates, and just as marketers are seeing the clear benefits the format provides, cyber criminals are becoming wise to the potential for driving malicious campaigns straight to users screens. What has developed out of these sinister intentions is a new form of browser locker specifically designed around the natural behaviour of a push ad.

How do push lockers work?

When you make the choice to opt-in, or out, of receiving push notifications on a particular site, the browser manages the request and saves the choice. However, it’s the way the browser saves this choice — either by domain, or subdomain — that can expose the user to trouble. What happens if you opt out, but the website redirects you automatically to another subdomain? Can you guess what’s coming? This allows the user to be prompted again to accept the push notification. So naturally, you decline this new request, and then you’re sent to yet another subdomain and asked again, and again, and again. Suddenly you are trapped in an endless looping push notification nightmare, and escape can only be had by giving in and “consenting” to receive the push notification.

Incredibly annoying, right? But this is tame compared to what other push lockers are capable of.

What type of push lockers has AdSecure encountered?

Since first discovering this new form of attack, our development team went on the hunt, uncovering various types of push lockers. In one particularly sophisticated case, users clicking somewhere on the page other than the buttons to allow or block the push would cause the browser to switch to full screen mode, preventing the user from doing anything else until they accepted the push notification, which in turn leads them to a scam offer, or the forced download of malware, or similar security threat. In a separate case, we encountered a push locker that kept users locked on the consent page until they accepted the push, all the while quietly mining cryptocurrencies in the background. Those who opted in were then redirected to a new offer page which also launched the cryptocurrency miner, leaving the user with no safe option to take.

When this type of push locker is implemented on a mobile browser, the entire device is rendered useless for the owner, again until they are forced to consent. In all cases, the looping push notification locks the user into an action they absolutely do not want to take, and puts them at severe risk of exposure to exploit flaws or other security breaches.

What is the solution?

The relative speed at which push lockers have appeared on the scene has caught some ad verification providers off guard. They either weren’t aware of the problem quickly enough, or they aren’t using the modern technology needed to detect push lockers with any degree of consistency and precision.

Push lockers are sophisticated and pernicious, and in order to catch them early and often, the scanning technology being used needs to be based on the most modern browser technology available. This is one of the reasons AdSecure — with a crawler powered by Chrome — was the first ad verification provider to uncover these looping push notifications, and continues to be the only provider catching them at high frequency, and a strong level of precision.

As more publishers and ad platforms begin to work with the push notification ad format, push locker attacks will spread across the digital ads landscape. Make sure your partners are working with an ad verification provider that has the resources and the knowledge needed to track down push lockers and keep them from hurting digital users.

AdSecure empowers ad platforms & publishers to take back control of their ad quality by providing constant detection & notification for ad security, compliance, and quality issues within the digital ad supply chain.

To learn more about how AdSecure is driving a safer digital world for everyone, contact us today.