How will Stack Exchange ensure security of adverts?

Question

I have absolutely no problem with the principle of proper adverts (i.e. Adverts that are relevant to the audience, and only appearing in the small sidebar like existing ones etc.) however the concern I have is the same one Joe H articulates in his response to the Meta post regarding the new advertising model.

The problem with allowing advertisers to "own" space on a page is that they could serve anything there, from adverts through to malware. There are numerous examples of adverts on sites considered secure ending up serving fairly malicious payloads, and a far as attackers go, sites like SE with a huge footprint are great targets.

This is what we call a Watering Hole Attack, where you identify where your targets go and catch them there. For example, if I wanted to compromise magento in some way, having adverts on the magento.se site would give me the opportunity to attack magento developers, and magento e-commerce sites!

The info SE sends to the advertiser doesn't concern me - this seems to protect the user's privacy well - but other than trusting the advert provider to fully vet every advert served, is there anything SE is doing to gain assurance over adverts?

This example described at arstechnica shows how attackers can stealthily hijack advert space, with seemingly innocuous JavaScript combined with code steganographically hidden in pixels in the banner ad.

Answer 1

We don't give clients keys to just upload whatever they want for two reasons, and this is one of them. The other reason is that we need to check every creative for not just security, but also relevancy.

So if something gets on to our CDN for Adzerk to put into rotation, it's because an employee put it there.

We have a small handful of trusted partners (think ginormous companies that have been doing business with us for quite a while) that we allow to run creatives that they host elsewhere, but we still have to approve the creative, and there's a strong understanding that they're not allowed to change it unless they let us know.

Monitoring of all of this is still a tedious and manual process, but a necessary cost of doing business when you actually care about your users. We're looking into several possible things that we could use in order to automate that, leaning in the direction of building something ourselves.

But there's never a point when a client can just arbitrarily run something without us approving it, and we're in control of the ads we show. That makes us pretty darn safe by way of comparison with others, however making sure we stay safe and find ways of being even more secure in this regard is a perennial endeavor; you're never quite really 'done'.