In order to study CSP (Content Security Policy), I implemented it on https://www.thinvent.in
After a lot of tweaking and tinkering, I was able to make it work. I then used uriports.com to keep track of CSP violations. Here are some URLs that were blocked and their source JS files.
URL: https://gjtrack.ucweb.com/collect?uc_param_str=*<=*&appid=*&e_c=*&pg=*&jsver=*&domain=*&slotId=*&e_a=*&_t_=*
URL: https://plugin.ucads.ucweb.com/api/mediation/info?uc_param_str=*&slotId=*&jsver=*&__t=*
JS: https://ucads-cdn.ucweb.com/ltjs/3.3.0/ltjs.js
FRAME: https://ucads-cdn.ucweb.com:1:20895
For a moment I thought thinvent.in had been compromised. Then I noticed that the UA in 100% of these reports was "UC Browser (Android)". So UC Browser, that somehow touts itself as a secure browser, is inserting JS and iFrames into web pages, then using pixels to track what people are viewing. How sinister is that?
The comic thing is that while the browser is up to these shenanigans, it is simultaneously also religiously submitting all CSP reports with its own violations to website owners. Sweet.
I learn something new today. If you have a website of any meaning, you should implement CSP and HSTS to prevent such man in the middle attacks. On thinvent.in I am using CSP to block yoast.com from gathering data from our visitor's browsers.
A note on demographics: I see that most visitors with the UC Browser were coming to JTBS pages. This means they are unemployed or self employed, and looking for self employment.
After a lot of tweaking and tinkering, I was able to make it work. I then used uriports.com to keep track of CSP violations. Here are some URLs that were blocked and their source JS files.
URL: https://gjtrack.ucweb.com/collect?uc_param_str=*<=*&appid=*&e_c=*&pg=*&jsver=*&domain=*&slotId=*&e_a=*&_t_=*
URL: https://plugin.ucads.ucweb.com/api/mediation/info?uc_param_str=*&slotId=*&jsver=*&__t=*
JS: https://ucads-cdn.ucweb.com/ltjs/3.3.0/ltjs.js
FRAME: https://ucads-cdn.ucweb.com:1:20895
For a moment I thought thinvent.in had been compromised. Then I noticed that the UA in 100% of these reports was "UC Browser (Android)". So UC Browser, that somehow touts itself as a secure browser, is inserting JS and iFrames into web pages, then using pixels to track what people are viewing. How sinister is that?
The comic thing is that while the browser is up to these shenanigans, it is simultaneously also religiously submitting all CSP reports with its own violations to website owners. Sweet.
I learn something new today. If you have a website of any meaning, you should implement CSP and HSTS to prevent such man in the middle attacks. On thinvent.in I am using CSP to block yoast.com from gathering data from our visitor's browsers.
A note on demographics: I see that most visitors with the UC Browser were coming to JTBS pages. This means they are unemployed or self employed, and looking for self employment.