  The rapid growth of online advertising has fueled the growth of ad-blocking
software, such as new ad-blocking and privacy-oriented browsers or browser
extensions. In response, both ad publishers and ad networks are constantly
trying to pursue new strategies to keep up their revenues. To this end, ad
networks have started to leverage the Web Push technology enabled by modern web
browsers.
  As web push notifications (WPNs) are relatively new, their role in ad
delivery has not been yet studied in depth. Furthermore, it is unclear to what
extent WPN ads are being abused for malvertising (i.e., to deliver malicious
ads). In this paper, we aim to fill this gap. Specifically, we propose a system
called PushAdMiner that is dedicated to (1) automatically registering for and
collecting a large number of web-based push notifications from publisher
websites, (2) finding WPN-based ads among these notifications, and (3)
discovering malicious WPN-based ad campaigns.
  Using PushAdMiner, we collected and analyzed 21,541 WPN messages by visiting
thousands of different websites. Among these, our system identified 572 WPN ad
campaigns, for a total of 5,143 WPN-based ads that were pushed by a variety of
ad networks. Furthermore, we found that 51% of all WPN ads we collected are
malicious, and that traditional ad-blockers and malicious URL filters are
remarkably ineffective against WPN-based malicious ads, leaving a significant
abuse vector unchecked.
