Taming the World’s Largest Trojan Horse

on YouTube ↗30m

" summary

Explains that JavaScript ad tech delivers 10 trillion ad impressions in 2017 and $110B for display, built from ad tags, hosted tag libraries, iframes, cookies and tracking pixels that chain through dozens of vendors; shows tools like an OpenX tag container blocking HTML cookie writes and a Chrome extension “ad footprint” that measures 36 requests and 12s slot loads; documents malvertising like Coinhive miners up 300% and a newspaper homepage with 1,665 tags from 114 vendors.

AI-written summary · about

" chapters (11)

1. 0:00Introduction
2. 1:16Digital Advertising
3. 4:15Digital Display
4. 6:27Digital Display Numbers
5. 7:32Trojan Horse
6. 9:50Part 1 Construction
7. 11:42Part 2 Construction
8. 13:57Part 3 Debugging
9. 15:32Part 2 Whats Coming Through
10. 19:42The Solution
11. 24:22Thoughts

" related talks

• 16mBeyond the surface: uncovering hidden threats in online adsMohamed Elgendi · Ad-Filtering Dev Summit 2025
• 48mMillion Browser BotnetJeremiah Grossman, Matt Johanssen · AppSec California 2014
• 54mModern Malvertising and Malware web-based exploit campaignsJames Pleger · AppSecUSA 2015
• 55mModern Malvertising ...Arian Evans · AppSec California 2015
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 35mHow the Web Tangled ItselfMartin Johns, Ben Stock, Marius Steffens, Michael Backes · 26th USENIX Security Symposium (USENIX Security '17)
• 57mSecurityPatrick Hamann, Yan Zhu, Mike West, J. Alex Halderman, Henrik Rydberg, Dan Appelquist, Virginie Galindo · Edge Conference 2015
• 45mThe evil friend in your browserAchim D Brucker · OWASP BeNeLux Day 2017