0x6f0

I remember when bing used to do this on their mobile site, it would load then I would go to tap on the search box to focus my cursor and just as I was about to do that it would pop in an ad for their mobile app. Then I would have to close out of the play store and get back to actually searching.
Now it seems that protonmail is doing something similar in that I navigate to their mobile site, wait for it to load. Once it's loaded I go to tap the menu icon and just before I do the pop in for their app appears and again off to the play store I go.


I'm not sure though is this considered a dark pattern? But, whatever it is, does this actually end up benefiting them? Do more people end up installing their apps? And if more people do install their app, what is the benefit for them? Is it to save bandwidth or are they able to track their users more closely? If it's the later, why would a company based on privacy and security want or need more information about their users?

A more in depth look at what I did when checking out the PornHub popunder. I don't know that I went about things in the right manner it's what I did. Also, I want to note that I did all the analysis using an ubuntu virtual box with chrome installed.
First, I opened the site and clicked around until I experienced a popunder, that didn't take long but I did notice that it wasn't showing me another one. At this point I knew that they were somehow tracking that one had already been shown one. So I went to take a look at the cookies, but I noticed at that point that they were keeping things in local storage. So I reset those values and tried browsing again and sure enough another popunder. I continued with this process a couple more times just to see if anything would change but everything remained the same.
At this point I decided to start digging into the source to see what I could find. Right away I saw this juicy looking bit on top

var puTargetURLvalue = localStorage.getItem('puTargetURL'); but I didn't see any place where it was used right away plus I still needed to find where the other 2 local storage variables were stored. So I started poking around at some of the scripts but there were a total of 24. To me this seemed to be a lot and not something I really wanted to dig through manually, so I created a quick python script using BeautifulSoup to download all the JavaScript. Now with all the scripts stored locally I was able to search through all of them easily. I quickly found where everything was being set and then used. I didn't really want to keep clicking around pornhub so I began creating a little sandbox with these scripts. I'm going to go over this process now.
As I mentioned searching for puTargetURL above I'll keep searching for it now. To do this I ran this in the same directory as all the scripts.
grep -rnw '.' -e 'puTargetURL'

In the screenshot I can now see that I can start looking in application.js, it was minified so I took some time to make it more readable. I tried using a couple beautification tools but none of them seemed to be able to handle it, with these I ended up with a lot of errors each time. Anyway, after making it more readable I was able to see an init function initPopUnderLinks I thought this looked interesting and wanted to look for this next; but first I wanted to finish looking at the rest of this file.
From the screenshot there's a few interesting things, the first thing I noticed were the classes where the popover click event was getting attached. At this point I can start creating my sandbox html and create div's with the following classes (.menuSection, .videoWrapper, .logoWrapper, .pagination) and make a link within each of those. And then oh! I totally missed it a Math.ceil call and what exactly is it doing? Looking at it, it is checking if the pop_under_initial_date localstorage variable is already set and if it is how long ago. It seems that if it was set more then 28800 milliseconds (8 hours, unless I'm confused) ago they will show us another popunder.
One last thing to note here, I didn't realize until later but the addEventHandler function wraps and implements addEventListener in this case it gets passed 2 parameters, one is the element it should listen to and the other is the event it should listen for.
So now let me look for the init function in the other files and hopefully get a better feel for what's going on.
grep -rnw '.' -e 'initPopUnderLinks'
Running this I see that the function is called from footer.js, from looking through this file I can see that a lot of information is stored in varObj_footer so I'll make a note that I want to look at that later.

I guess I don't fully understand what exactly they're doing here but they seem to be checking if the browser supports localstorage and then calling the 2 init functions from application.js which adds the listeners if needed.
Before continuing to setup my sandbox page, I decided to have another look at the pornhub page for the varObj_footer object:
After looking at it; that it looked pretty interesting and that trafficJunkyurl sitting down there looked suspect; maybe I should have a look for that getting used somewhere.
grep -rnw '.' -e 'trafficJunkyurl'

Hmm, popunder-build.js why hadn't I noticed that before? Anyway, it seems to be building the URL that will open in the popunder tab. Now it's time, let me finish building the sandbox page and see if it works.
Let me recap my sandbox page, I needed those div's with those classes specified in application.js. I'll need jquery (2.0.3) is what they are using, jquery cookie, and the page seems to be using mg_utils to check the browser and to set the event listeners. Finally I'll need application.js, popunder-build.js, and footer.js.
At this point I'm feeling pretty good that I have something together that's testable but nervous that it won't work at all. So I open it in the browser and oh no; the console is complaining that there's a missing function isAndroid, what the? Where did I miss that? So I go back and have a quick look for it, but I can't seem to find any obvious signs of it anywhere. Hmm, at this point I just want to get it working so I decide to fake it. I see that mg_utils returns a boolean using this MG_Utils.browser.isAndroidMobileDevice; so I quickly wrap it in the function isAndroid and move on. Finally here :-D first click (tap) and everything goes according to plan, well..almost anyway. The new tab didn't redirect it just stayed on the current page of the original tab. What did I miss this time? Oh yeah that bit of javascript from the very beginning. I put that on the top of my sandbox page, clear the localstorage variables and try again. Awesome! Everything is working so now I'm ready to dig into what's actually happening.
For this part, I know that I'm looking for click events. So I used chrome dev tools to set an event listener breakpoint (on the sources tab look for event listener breakpoints). In there I decided to look for click events; by setting this chrome will automatically pause execution whenever one of these events fire. So now let me try this again.

This time I can see that it pauses on application.js line 1, column 782 (I decided to use the minified version for testing). The script checks that it hasn't already shown me a popunder and in this case it hasn't so it continues on and checks the browser type and phone type again, in this case I have it set to chrome and android so it continues on to the else clause and stores the current window location in o, then opens a new window and stores that in t. From there it replaces the location of the new tab with the current location of the original tab. Next it updates the original tabs location to the trafficjanky url, they use some regex to get the url setup from it's stored format. Finally the localstorage variable puTargetURL that was set earlier is used to redirect the new tab to the page that the user (me in this case) actually wanted, it used the bit of javascript I showed at the begining of the post to redirect on the actual new tab page as it can't be done from the original tab.

Conclusion

In conclusion the whole thing is really simple in operation if not very annoying. However, whoever came up with this; they are ridiculously clever and I'm very impressed that they were able to come up with this. Also, I see parts of the application.js looking for FireFox. The code looks much simpler but I think I'll take the time to check that out and see exactly how it works. I don't know if that will be worthy of a post though.

Super Minimal Example

I setup a very stripped down version that uses these concepts, it works on Chrome 61.0.3163.100 for linux (I was running on Ubuntu). Feel free to check out the minimal demo code here.
I hope everyone found this useful and also if you happen to have answers to my questions above or just know of a better way to go about this, please let me know in the comments below or any other contact method. I'd really appreciate it.

What better place to find shady practices that wouldn't be tolerated on more mainstream websites than porn sites. In this case we'll check out PornHub and how they use popunders to display ads that may lead to malware? In the cases I found during my research it lead to an android app, I haven't yet finished my analysis of the app. Also of note, I only looked at the mobile site and using chrome on Android. Although this also seems to happen on the full size site but from my very brief look at it; it uses a different method. Looks more like the Chrome 60 live0verflow reverse engineering video.

Let's take a closer look at what happens in the mobile version of the site.

• First it looks for the useragent and checks if it's chrome, from there it checks to see if it's on Android mobile.
  
• They attach the on click listener to the links on four different elements of the page. These happen to be places where someone would tap to navigate the site or to watch a video.
  
• After clicking on the link the pop under code fires and sets a local storage variable "puTargetURL" which keeps track of what the user is doing and or going.
  
• Next it opens a new tab and sends it to the path stored in the variable in the above step.
  
• Meanwhile underneath the original tab is sent to an ad url that is stored in varObj_footer.trafficJunkyurl.
  
  • This is the page I was describing in the introduction that when clicked on sent me to a suspicious looking Android app. People can also be seen asking about these ads on reddit that contain messages of having illegal stuff on your phone or computer and the FBI or some other agency being on the way to arrest you for it if you don't use their app to remove it immediately.
• If the user was navigating to a new page they might not notice anything because it happens so fast. However, if the user was going to play a video they might notice something isn't right because they'll have to tap the play button again.
  
• They seem to only show the pop under once per session, they track this by setting a couple localstorage variables.
  
• after a pop under is shown 2 new local storage variables are set
  
  • pop_under_already_shown - this is a boolean value
  • pop_under_initial_date - the date in the form "Fri Oct 06 2017 08:30:47 GMT-0400 (EDT)"

If you were expecting a more in depth technical analysis, I apologize. I did really dig into the code to find what was going on but nothing was obfuscated so it was relatively straight forward to find what was going on. During this analysis I did stumble on some obfuscated code so I will probably check that out next. I found a post saying that rarbg[.]to also has popunders, so I think I might give that a look too.