AdGuard Blog: EasyList is in trouble and so are many ad blockers

[Gandalf_The_Grey]

Content source

https://adguard.com/en/blog/easylist-filter-problem-help.html

What happened​

A couple of weeks ago EasyList maintainers saw a huge spike in traffic. The overall traffic quickly snowballed from a couple of terabytes per day to 10-20 times that amount. The source of that dramatic surge, it turned out, were Android devices from India. This whole situation rang a bell with us, because last year we had to grapple with the very same problem. Last November, our bandwidth usage shot up through the roof for no good reason. After investigating the issue, we found out that two apps with ad-blocking functionality were abusing our servers.

What happened to us bears a striking resemblance to what is now crippling EasyList:

1. There’s an open source Android browser (now seemingly abandoned) that implements ad-blocking functionality.
2. This browser is forked by a couple of other browsers that are very popular in India.
3. The problem is that this browser has a very serious flaw. It tries to download filters updates on every startup, and on Android it may happen lots of times per day. It can even happen when the browser is running in the background.

When we encountered a similar problem last year, we found a simple solution: block the undesired traffic from these apps. Even so, we continue to serve about 100TB of “Access Denied” pages monthly!

EasyList is hosted on Github and proxied with CloudFlare. Unfortunately, CloudFlare does not allow non-enterprise users use that much traffic, and now all requests to the EasyList file are getting throttled.

EasyList tried to reach out to CloudFlare support, but the latter said they could not help. Moreover, serving EasyList actually may violate the CloudFlare ToS.

It’s unclear what EasyList should do now. It is a community project supported by volunteers, and it cannot afford to pay for the enterprise CloudFlare plan. Should they start accepting donations for their invaluable work to fund hosting? This is easier said than done. They can change the domain name, but it is a rather painful procedure that will affect many other open source projects that rely on EasyList (and there are literally hundreds if not thousands).

If you’re a security researcher and can help find these Android browsers that DDoS EasyList and AdGuard filters, your help would be greatly appreciated. Last time we found two such browsers and contacted developers, but the issue was not resolved and even got worse, so probably there are more out there. Look for the ones that constantly download one of these three files:

• https://easylist.to/easylist/easylist.txt
• https://filters.adtidy.org/extension/ublock/filters/2_without_easylist.txt
• https://filters.adtidy.org/extension/ublock/filters/11.txt

EasyList is in trouble and so are many ad blockers

One of the world’s most popular ad blocking filter lists, EasyList, has run into a serious issue that threatens to tank it, as well as many open-source projects that rely on it. See if this affects you personally, and how you can help.

adguard.com

 

[TedCruz]

EasyList is in trouble and so are many ad blockers

One of the world’s most popular ad blocking filter lists, EasyList, has run into a serious issue that threatens to tank it, as well as many open-source projects that rely on it. See if this affects you personally, and how you can help.

adguard.com

Well crap! As soon as they start accepting funding then it offers a precedent to *permit* those companies that fund the list. I. E. Offer lighter filtering to those who fund it. Also known as lobbying in the government circles.

And this is why we can't have nice things.

 

[Gandalf_The_Grey]

And interesting comment on Wilders:

This does not affect uBO any more.

The file assets.json has been changed some time ago, so that the problematic URL is no longer the first one tried.

As Reddit user /u/DrTomDice said:

The article is at best needlessly alarmist, and at worst a deceptive and misleading attempt to imply that AdGuard is the product to use to avoid the "problem" with EasyList. For example, per the article:

AdGuard re-hosts all filter lists on its own servers, so if you use our apps or browser extensions this problem doesn’t affect you directly.

I would have expected a more professional and accurate article from AdGuard. Not one that spreads FUD and panic, and/or misrepresents the situation to sell its own products.
Very disappointing.

µBlock, a lean and fast blocker

BTW, I believe I asked this before but is there any way to make some kind of rule that will block the blank spaces on The Street website? To clarify,...

www.wilderssecurity.com

 

[TedCruz]

And interesting comment on Wilders:

µBlock, a lean and fast blocker

BTW, I believe I asked this before but is there any way to make some kind of rule that will block the blank spaces on The Street website? To clarify,...

www.wilderssecurity.com

Well I like the assessment, but it got me worried. Yeah Yeah I know sky is falling. What worries me is Yes the Alarmist nature of the blog which means that they are attempting to garner more business....it's all good...that how businesses work! However, stacksocial is having their Family lifetime plan for $16, that's 9 lifetime Lic for $16...ummm how do you sustain operations with that sale?

 

[Freki123]

...ummm how do you sustain operations with that sale?

Good question, I hope with the sale of DNS and VPN services (lately). But they sell the adblocker lifetime since at least 2014 every now and then (so I'm hopeful they know what they do).

 

[SeriousHoax]

Well I like the assessment, but it got me worried. Yeah Yeah I know sky is falling. What worries me is Yes the Alarmist nature of the blog which means that they are attempting to garner more business....it's all good...that how businesses work! However, stacksocial is having their Family lifetime plan for $16, that's 9 lifetime Lic for $16...ummm how do you sustain operations with that sale?

The issue Adguard described is real, but they probably exaggerated a bit more and also the reddit user who commented also exaggerated on his part thinking that they only posted it to make more people use Adguard. I think they posted in mainly because they had an almost exact same issue last year. That's why they shared their take on this.
Adgaurd has been selling lifetime license for a long time, so don't think they are going to go away anytime soon. Now more so because of MV3 which would make some users move to Adguard Desktop. They probably still sell lifetime license because not enough people buy their yearly subscription products, and they are trying to attract more users.

 

[Stopspying]

..As soon as they start accepting funding then it offers a precedent to *permit* those companies that fund the list........

Similar to what Adblock and Ghostery have done in the past, which soiled their reputations.

And interesting comment on Wilders:

µBlock, a lean and fast blocker

BTW, I believe I asked this before but is there any way to make some kind of rule that will block the blank spaces on The Street website? To clarify,...

www.wilderssecurity.com

Well I like the assessment, but it got me worried. Yeah Yeah I know sky is falling. What worries me is Yes the Alarmist nature of the blog which means that they are attempting to garner more business....it's all good...that how businesses work! However, stacksocial is having their Family lifetime plan for $16, that's 9 lifetime Lic for $16...ummm how do you sustain operations with that sale?

I believe that AdGuard are regularly guilty of exagerating claims that might gain more sales, they of course are not the only business that does this. Some of their email 'news' stories really should be tajen with a pinch of salt IMO. I actually think they have a really good product that could survive on subscriptions without resorting to these measures. However, as mentioned above Adguard can regularly be found at similar low prices for very good deals, many of them multiple lisence ones, as can their VPN product, I've not seen their DNS availabkl at simliar low prices. I think they could probably survive without resorting to such low price sales via StackSocial etc

I wonder if the Easylist DDOS attack is being routed via Indian Android phones using those browsers on behalf of certain ad serving businesses. A sort of bot attack against an organisation that fights against their business methods.