23

I was looking at a WebSocket issue when I noticed these two error messages as I loaded Stack Overflow. I was using a Windows 7 machine running Google Chrome.

Blocked a frame with origin "http://view.atdmt.com" from accessing a frame with origin "http://stackoverflow.com". Protocols, domains, and ports must match.

 

"Blocked a frame with origin "http://view.atdmt.com" from accessing a frame with origin "http://c.betrad.com". Protocols, domains, and ports must match."

Were these ads trying to escape their area or was it just a simple mistake from one of their scripts? Are these ads malicious because they were trying to access cross domain scope with their scripts?

Edit

I was able to reproduce this several times. The path I took was to click "Ask Question" on Meta Stack Overflow. Type in a few things to satisfy the 15 character requirement (not sure if the text part mattered) and then I clicked on "main". The ad was present, and so were the errors, the HTML shown in my answer, and the scrips loaded.

I must have got lucky in the reproduction, because after about 11 refreshes I was able to get the Windows Azure ad to show up on stackoverflow.com. Along with the ad were the errors.

The URL that I copied by right clicking on the ad itself was

http://clk.atdmt.com/go/451838910/direct;ai.337359372;ct.1/01

Advertisement view

29
  • 1
    Looks like malware to me. Sep 6, 2013 at 20:16
  • @ShaWizDowArd - So you agree then, they are malicious. This originated from an ad in stackoverflow, not from my machine.
    – Travis J
    Sep 6, 2013 at 20:18
  • 5
    Something is tracking you... en.wikipedia.org/wiki/Atdmt and betrad's domain leads to evidon.com
    – Bart
    Sep 6, 2013 at 20:19
  • 3
    No, it's not from Stack Overflow. It's spyware installed on your machine as part of other program. From what I was able to find, it's used to steal your cookies and originated from something called "Atlas Solution". Sep 6, 2013 at 20:19
  • This is a result of a stackoverflow script. Let me find the exact line of code then. It is more than likely a result of googles ad scripting.
    – Travis J
    Sep 6, 2013 at 20:23
  • 23
    No it's not. That script is injected by the spyware. Please do some research before throwing accusations. Believe me, Stack Exchange won't co-operate with such things. Sep 6, 2013 at 20:23
  • 1
    @ShaWizDowArd - I would be willing to believe it were spyware if it happened anywhere else. I ran malware bytes and nothing came back. There is unfortunately no evidence to support that this is on my machine. Of another 30 sites polled none produced these error messages. I was not accusing stackoverflow or stackexchange of running malicious code, more that the ads themselves contain third party code which could be malicious. I am willing to run any suggested tools to provide evidence this is on my machine only.
    – Travis J
    Sep 6, 2013 at 20:32
  • 11
    OK... maybe this will convince you it got nothing to do with Stack Overflow? Maybe it's not happening on other sites because they don't block frames like Stack Overflow does, exactly for that reason. (So spyware won't steal your Stack Overflow cookie) Sep 6, 2013 at 20:34
  • 2
    @ShaWizDowArd - And maybe the fact that stackoverflow loads any script that pays money to adzerk.com will convince you that some of that content can be malicious.
    – Travis J
    Sep 6, 2013 at 20:41
  • 1
    @TravisJ I have seen no request to either site, ever, on SO, and my adblock is off on stack exchange. Sep 6, 2013 at 20:42
  • Update: I do see some requests to adzerk, but no error messages or requests to atdmt Sep 6, 2013 at 20:44
  • 2
    adzerk is just the messenger, the companies behind the ads pay directly to Stack Overflow, which does not use things like Google Ads or any other third party advertising. Sep 6, 2013 at 20:53
  • 1
    @ShaWizDowArd - I was able to reproduce this issue. Only on stackoverflow. I am trying to trace the first call to the script. The related script seems to either be from adzerk or cdn.sstatic.net. The potentially malicious code is prefaced with a cdn sub domain.
    – Travis J
    Sep 6, 2013 at 20:55
  • @TravisJ what ad appears when the error message does? Sep 6, 2013 at 20:59
  • 2
    @ShaWizDowArd @bart @Jan - Please see the answer listed below. This is not on my machine. It is generated by inline html on the stackoverflow page itself.
    – Travis J
    Sep 6, 2013 at 21:56

2 Answers 2

19

This is a legitimate Microsoft ad. Atdmt.com and Betrad.com are ad or ad tracking agencies that Microsoft works with. The error is probably just the result of mashing these things together in a not-so-smart way. We will reach out to Microsoft about fixing the error message.

Our ad policy allows using third-party ad servers to deliver ads we have approved, but forbids third-party cookies or accessing private user data. So Microsoft is allowed to serve their images / scripts from their own ad server (or an ad agency's), but they can't embed a third-party cookie in our pages. All third-party ads are placed in an iframe to keep them from accessing the rest of the page.

15

Some have indicated that this code is malicious in the form of malware or spyware. I am not certain if that is true or not. However, here is the path that it takes to mature into the error message I originally documented in the question.

First, adzerk is loaded in the Stack Overflow page through a script tag in the <div id="sidebar">. Indeed all of this action takes place in the sidebar.

<script>
    var ados = ados || {};ados.run = ados.run || [];
    ados.run.push(function() {
        ados_add_placement(22,8277,"adzerk1716529536",17).setZone(45) ;
    });
</script>

Once ados is present, it then produces an iframe and a div, among a few other things. The iframe is what is in question though.

<div class="everyonelovesstackoverflow adzerk-vote" id="adzerk1716529536">
<iframe id="ados_frame_adzerk1716529536_81029" frameborder="0" scrolling="no" height="250" width="220">

This iframe then contains a set of nested iframes. This is where the malicious (or accidental) scripting takes place. The first item inside of the "ados_frame" iframe is this:

<script>
    new function() {
        this.rand = Math.floor((Math.random() + "") * 1000000000000);
        this.dvparams = 'ctx=1842468&cmp=1844697&plc=451838910&sid=451838910';
        this.dvregion = '0';
        this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click=" frameborder="0" scrolling="no" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" allowtransparency="true" width="220" height="250">\
            <scr'+'ipt language="Javascr'+'ipt" type="text/javascr'+'ipt">\
                document.write(\'<a href="http://clk.atdmt.com/CNT/go/451838910/direct/01/" target="_blank"><img src="http://view.atdmt.com/CNT/view/451838910/direct/01/"/></a>\');\
            </scr'+'ipt></iframe>';
            this.altsrc = '<style>\
                    .container {\
                        border: 1px solid #3b599e;\
                        overflow: hidden;\
                        filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=\'#315d8c\', endColorstr=\'#84aace\'); /* For Internet Explorer */\
                        background: -webkit-gradient(linear, left top, left bottom, from(#315d8c), to(#84aace)); /* For WebKit browsers */\
                        background: -moz-linear-gradient(top,  #315d8c,  #84aace); /* For Firefox 3.6+ */ \
                    }\
                    .cloud {\
                        color: #fff;\
                        position: relative;\
                        font: 100% "Times New Roman", Times, serif;\
                        text-shadow: 0px 0px 10px #fff;\
                        line-height: 0;\
                    }\
                </style>\
                <scr'+'ipt type="text/javascr'+'ipt">\
                    function cloud(){\
                        var b1 = "<div class=\\"cloud\\" style=\\"font-size: ";\
                        var b2 = "px; position: absolute; top: ";\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"34px; left: 28px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 10px;\\">.<\\/div>");\
                        document.write(b1+"300px; width: 300px; height: 300"+b2+"46px; left: 50px;\\">.<\\/div>");\
                        document.write(b1+"400px; width: 400px; height: 400"+b2+"24px; left: 20px;\\">.<\\/div>");\
                    }\
                    function clouds(){\
                        var top = [\'-80\',\'80\',\'240\',\'400\'];\
                        var left = -10;\
                        var a1 = "<div style=\\"position: relative; top: ";\
                        var a2 = "px; left: ";\
                        var a3 = "px;\\"><scr'+'ipt type=\\"text/javascr'+'ipt\\">cloud();<\\/scr'+'ipt><\\/div>";\
                        for(i=0; i<8; i++)\
                        {\
                            document.write(a1+top[0]+a2+left+a3);\
                            document.write(a1+top[1]+a2+left+a3);\
                            document.write(a1+top[2]+a2+left+a3);\
                            document.write(a1+top[3]+a2+left+a3); \
                            if(i==4)\
                            {\
                                left = -90;\
                                top = [\'0\',\'160\',\'320\',\'480\'];\
                            }\
                            else left += 160;\
                        }\
                    }\
                </scr'+'ipt>\
                <div class="container" style="width: 220px; height: 250px;">\
                    <scr'+'ipt type="text/javascr'+'ipt">clouds();</scr'+'ipt>\
                </div>';

        this.callbackName = '__dvredirect_callback_' + this.rand;
        var thisRedirect = this;
        window[this.callbackName] = function () { return thisRedirect; };

        var src = 'http://rtbcdn.doubleverify.com/bsredirect5.js?callback=' + this.callbackName;
        document.write('<scr' + 'ipt src=' + src + '></scr' + 'ipt>');
    }
</script>

It starts to go downhill from here, as a host of scripts are loaded. Inside of that block you can see the call to doubleverify. You can see a call to atdmt. And what isn't initially obvious is the nested calls which exist in the next iframe. A slough of scripts are loaded after this. For example:

<script type="text/javascript" src="http://c.betrad.com/surly.js#;ad_w=300;ad_h=250;coid=343;nid=11908;check_container=true;ecaid=451838910;"></script>

However, my main point lies above.

this.tagsrc = '<iframe src="http://view.atdmt.com/CNT/iview/451838910/direct/01?click="...

Is a line of code loaded by the sidebar through adzerk. This frame then continues on a very questionable path leading to the errors noted in the question.

Out of curiosity, I followed the links which were trying to force redirection. It led me to here

http://www.windowsazure.com/en-us/solutions/mobile/?WT.mc_id=AzureBG_US_Display_StackOverflow_Q3_GrSP_MobileV2D_MobServ

And a genuine offer for a free trial of Windows Azure. I understand some people may not trust Microsoft, but I would doubt they would place anything malicious in their ads and have not seen any negative affects of the errors or visiting the link.

3
  • Have you done this on a clean machine? Sep 7, 2013 at 5:31
  • @DeerHunter - I just tried from my surface pro at home. It is running win8 chrome. Amusingly it was the first ad that came up when I clicked "main" from meta here. This ad produced an error set of 3, all with the same text "Blocked a frame with origin "view.atdmt.com" from accessing a frame with origin "stackoverflow.com". Protocols, domains, and ports must match.". I wonder if there is a rep barrier for seeing the "try azure" ad. The ad doesn't show for you on stackoverflow?
    – Travis J
    Sep 7, 2013 at 5:53
  • Travis: I have a regex-based adblocker on. I don't see any ads :) Sep 7, 2013 at 6:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .