{"id":14394,"date":"2019-01-22T11:10:03","date_gmt":"2019-01-22T19:10:03","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2019\/01\/22\/news-8146\/"},"modified":"2019-01-22T11:10:03","modified_gmt":"2019-01-22T19:10:03","slug":"news-8146","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/01\/22\/news-8146\/","title":{"rendered":"Browser push notifications: a feature asking to be abused"},"content":{"rendered":"

Credit to Author: Pieter Arntz| Date: Tue, 22 Jan 2019 18:03:05 +0000<\/strong><\/p>\n

\u201cI\u2019m seeing a lot of ads popping up in the corner of my screen, and the Malwarebytes scan does not show there is anything wrong. It says my computer is clean. So what’s happening?\u201d<\/p>\n

Our support team runs into questions like this regularly, but the volume seems to be increasing lately. In most of these cases, it helps to look at the \u201cNotification permissions\u201d of the browser displaying this annoying behavior. A good cleansing in that department might be just what you need to get rid of those \u201cpop-ups.\u201d<\/p>\n

The problem is that the messages users are seeing are not pop-ups at all, but in fact \u201cpush notifications,\u201d often referred to as simply “notifications.” We understand that naming them differently doesn’t make them any less annoying. But it does change our classification of such messages.<\/p>\n

\"not<\/a><\/p>\n

Some notifications are not simple advertisements, but rather misleading messages about the safety of your computer.<\/p>\n<\/div>\n

What are these notifications?<\/h3>\n

From the Mozilla Developer pages<\/a>:<\/p>\n

\n

The Notifications API lets a web page or app send notifications that are displayed outside the page at the system level; this lets web apps send information to a user even if the application is idle or in the background. This article looks at the basics of using this API in your own apps.<\/p>\n<\/blockquote>\n

What we can learn from this is that the notifications can originate from a website or from an app. We are going to focus on the case where a website is causing the problem. Any app showing you commercial messages outside of a browser window would get detected as adware by Malwarebytes, so these would not escape a scan.<\/p>\n

However, website notifications can be displayed outside the browser window. Wait, what’s<\/em> the difference between notifications and pop-ups again? A pop-up is a new browser window or tab, whereas notifications are more like tooltips. They are messages that are independent from any open websites.<\/p>\n

Notifications show the domain from which they originate, so that could clue you in on the answer to another important question, which is:<\/p>\n

How did I get them?<\/h3>\n

To receive browser notifications, a user must have first allowed them. In Firefox, the dialog to allow them looks like this:<\/p>\n

\"Firefox<\/a><\/p>\n

While that seems pretty straightforward, there are trickier sites that use a bit of social engineering to get you to allow their notifications.<\/p>\n

\"social<\/a><\/p>\n

The website visitors are led to believe that they have to click \u201cAllow\u201c to see the video. In fact, if they click the \u201cAllow\u201d button, they will be redirected to another website, sometimes asking yet again to allow notifications, but meanwhile their clicking has allowed this site to show them notifications. And, mind you, the site does not have to be open in the browser for the notifications to pop up. As you can see, the fact that you are allowing notifications is a bit less clear in the Chrome prompt than it is in Firefox.<\/p>\n

How do I disable them?<\/h3>\n

There are some options for disabling notifications. You can disable them altogether or you can disable notifications for specific domains, by removing them from your \u201cAllow\u201d list. You can even add them to your \u201cBlocked\u201d list.<\/p>\n

\"example<\/a><\/p>\n

For every browser, the notifications look slightly different and the methods to disable them are slightly different as well. To make them easier to find, I have split them up by browser.<\/p>\n

Chrome<\/h3>\n

To completely turn off notifications, even from an extension:<\/p>\n