Malicious ads or just simple error messages?

Question

I was looking at a WebSocket issue when I noticed these two error messages as I loaded Stack Overflow. I was using a Windows 7 machine running Google Chrome.

Blocked a frame with origin "http://view.atdmt.com" from accessing a frame with origin "http://stackoverflow.com". Protocols, domains, and ports must match.

 

"Blocked a frame with origin "http://view.atdmt.com" from accessing a frame with origin "http://c.betrad.com". Protocols, domains, and ports must match."

Were these ads trying to escape their area or was it just a simple mistake from one of their scripts? Are these ads malicious because they were trying to access cross domain scope with their scripts?

Edit

I was able to reproduce this several times. The path I took was to click "Ask Question" on Meta Stack Overflow. Type in a few things to satisfy the 15 character requirement (not sure if the text part mattered) and then I clicked on "main". The ad was present, and so were the errors, the HTML shown in my answer, and the scrips loaded.

I must have got lucky in the reproduction, because after about 11 refreshes I was able to get the Windows Azure ad to show up on stackoverflow.com. Along with the ad were the errors.

The URL that I copied by right clicking on the ad itself was

http://clk.atdmt.com/go/451838910/direct;ai.337359372;ct.1/01

Answer 1

This is a legitimate Microsoft ad. Atdmt.com and Betrad.com are ad or ad tracking agencies that Microsoft works with. The error is probably just the result of mashing these things together in a not-so-smart way. We will reach out to Microsoft about fixing the error message.

Our ad policy allows using third-party ad servers to deliver ads we have approved, but forbids third-party cookies or accessing private user data. So Microsoft is allowed to serve their images / scripts from their own ad server (or an ad agency's), but they can't embed a third-party cookie in our pages. All third-party ads are placed in an iframe to keep them from accessing the rest of the page.

Answer 2

Some have indicated that this code is malicious in the form of malware or spyware. I am not certain if that is true or not. However, here is the path that it takes to mature into the error message I originally documented in the question.

First, adzerk is loaded in the Stack Overflow page through a script tag in the <div id="sidebar">. Indeed all of this action takes place in the sidebar.

<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>

Once ados is present, it then produces an iframe and a div, among a few other things. The iframe is what is in question though.

<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">

This iframe then contains a set of nested iframes. This is where the malicious (or accidental) scripting takes place. The first item inside of the "ados_frame" iframe is this:

<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>

It starts to go downhill from here, as a host of scripts are loaded. Inside of that block you can see the call to doubleverify. You can see a call to atdmt. And what isn't initially obvious is the nested calls which exist in the next iframe. A slough of scripts are loaded after this. For example:

<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>

However, my main point lies above.

this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...

Is a line of code loaded by the sidebar through adzerk. This frame then continues on a very questionable path leading to the errors noted in the question.

Out of curiosity, I followed the links which were trying to force redirection. It led me to here

http://www.windowsazure.com/en-us/solutions/mobile/?WT.mc_id=AzureBG_US_Display_StackOverflow_Q3_GrSP_MobileV2D_MobServ

And a genuine offer for a free trial of Windows Azure. I understand some people may not trust Microsoft, but I would doubt they would place anything malicious in their ads and have not seen any negative affects of the errors or visiting the link.