I see how this might be possible as the ads are loaded via javascript, but the javascript running the ads should be owned by Spotify, not the advertising company, that should just be an image file. Somebody please correct me if I'm wrong.
On another note, this statement "Some of them do not even require user action to be able to cause harm." makes me trust this even less. If the ad is opening a new browser window, that browser window is sandboxed. Sure it can ask the user to take an action, but it can't take an action on behalf of the user.
Anybody else have insights on this?
Google "drive-by download" and see how that is precisely what can happen. https://en.wikipedia.org/wiki/Drive-by_download
" Any download that happens without a person's knowledge, often a computer virus, spyware, malware, or crimeware.[1]
Drive-by downloads may happen when visiting a website, viewing an e-mail message or by clicking on a deceptive pop-up window:"
Personally I would never trust that anything browser related is truly sandboxed. If that were the case, why would I need anti malware scanners and tools?
This is, by the way, another reason why I use adblock and noscript. So that when I visit a site for the first time, nothing active element related will automatically run. So, in this case, even if the ads from spotify open my webbrowser and a tap to a malicious site, I would just close it and be done with it. It is still weird why an ad should have the ability to call an open url command at all.
Didn't the desktop apps use to bundle an embedded flash player before? I can't remember but it wouldn't have surprised me if they did.
Wonder what kind of html5/js engine they use for ads these days. (not that it matters, they are all swiss cheese security-wise, especially so if they aren't tracking upstream daily. If you think the sandbox is foolproof, well, just have a look at chromeos - time since last webpage-to-persistent-root exploit is currently about: 6 days https://googlechromereleases.blogspot.no/2016/09/stable-chan... )
It is in fact real.
>it's still puzzling something like this can actually happen.
I think the interesting thing is that its the default browser. If the ads were in an embedded trident or gecko frame, would something like window.open open the default browser?
