“));var g=y[n.size_id].split(“x”).map((function(e){return Number(e)})),f=(0,i.Z)(g,2);m.width=f[0],m.height=f[1]}m.rubiconTargeting=(Array.isArray(n.targeting)?n.targeting:[]).reduce((function(e,r){return e[r.key]=r.values[0],e}),{rpfl_elemid:l.adUnitCode}),r.push(m)}else(0,a.logError)(“Rubicon: bidRequest undefined at index position:”.concat(s),t,e);return r}),[]).sort((function(e,r){return(r.cpm||0)-(e.cpm||0)}))},getUserSyncs:function(e,r,t,i){if(!A&&e.iframeEnabled){var n={};return t&&(“boolean”==typeof t.gdprApplies&&(n.gdpr=Number(t.gdprApplies)),”string”==typeof t.consentString&&(n.gdpr_consent=t.consentString)),i&&(n.us_privacy=encodeURIComponent(i)),n=Object.keys(n).length?”?”.concat((0,a.formatQS)(n)):””,A=!0,{type:”iframe”,url:”https://”.concat(x.syncHost||”eus”,”.rubiconproject.com/usync.html”)+n}}},transformBidParams:function(e,r){return(0,a.convertTypes)({accountId:”number”,siteId:”number”,zoneId:”number”},e)}};function _(e,r){var t;return t=e.params.referrer?e.params.referrer:r.refererInfo.page,e.params.secure?t.replace(/^http:/i,”https:”):t}function j(e){var r,t=document.getElementById(e.adUnitCode);(r=t.querySelector(“div[id^=’google_ads’]”))&&r.style.setProperty(“display”,”none”),function(e){var r=e.querySelector(“script[id^=’sas_script’]”),t=r&&r.nextSibling;t&&”iframe”===t.localName&&t.style.setProperty(“display”,”none”)}(t);var i=e.renderer.getConfig();e.renderer.push((function(){window.MagniteApex.renderAd({width:e.width,height:e.height,vastUrl:e.vastUrl,placement:{attachTo:t,align:i.align||”center”,position:i.position||”append”},closeButton:i.closeButton||!1,label:i.label||void 0,collapse:i.collapse||!0})}))}function k(e,r){var t=e.params;if(“video”===r){var i=[];return t.video&&t.video.playerWidth&&t.video.playerHeight?i=[t.video.playerWidth,t.video.playerHeight]:Array.isArray((0,s.Z)(e,”mediaTypes.video.playerSize”))&&1===e.mediaTypes.video.playerSize.length?i=e.mediaTypes.video.playerSize[0]:Array.isArray(e.sizes)&&e.sizes.length>0&&Array.isArray(e.sizes[0])&&e.sizes[0].length>1&&(i=e.sizes[0]),i}var n=[];return Array.isArray(t.sizes)?n=t.sizes:void 0!==(0,s.Z)(e,”mediaTypes.banner.sizes”)?n=I(e.mediaTypes.banner.sizes):Array.isArray(e.sizes)&&e.sizes.length>0?n=I(e.sizes):(0,a.logWarn)(“Rubicon: no sizes are setup or found”),function(e){var r=[15,2,9];return e.sort((function(e,t){var i=r.indexOf(e),n=r.indexOf(t);return i>-1||n>-1?-1===i?1:-1===n?-1:i-n:e-t}))}(n)}function C(e,r,t){var i={user:{ext:{data:f({},e.params.visitor)}},site:{ext:{data:f({},e.params.inventory)}}};e.params.keywords&&(i.site.keywords=(0,a.isArray)(e.params.keywords)?e.params.keywords.join(“,”):e.params.keywords);var n=(0,a.mergeDeep)({},e.ortb2||{},i),c=(0,s.Z)(e.ortb2Imp,”ext”)||{},d=(0,s.Z)(e.ortb2Imp,”ext.data”)||{},p=(0,s.Z)(e,”ortb2Imp.ext.gpid”),l={user:[4],site:[1,2,5,6]},m={user:”tg_v.”,site:”tg_i.”,adserver:”tg_i.dfp_ad_unit_code”,pbadslot:”tg_i.pbadslot”,keywords:”kw”},v=function(e,r,i){var n=!(arguments.length>3&&void 0!==arguments[3])||arguments[3],c=function(e,r,t){return”data”===r&&Array.isArray(e)?e.filter((function(e){return e.segment&&(0,s.Z)(e,”ext.segtax”)&&l[t]&&-1!==l[t].indexOf((0,s.Z)(e,”ext.segtax”))})).map((function(e){var r=e.segment.filter((function(e){return e.id})).reduce((function(e,r){return e.push(r.id),e}),[]);if(r.length>0)return r.toString()})).toString():”object”===(0,o.Z)(e)&&!Array.isArray(e)||void 0===e?void 0:Array.isArray(e)?e.filter((function(e){if(“object”!==(0,o.Z)(e)&&void 0!==e)return e.toString();(0,a.logWarn)(“Rubicon: Filtered value: “,e,”for key”,r,”: Expected value to be string, integer, or an array of strings/ints”)})).toString():e.toString()}(e,i,r),d=m[i]&&n?””.concat(m[i]):”data”===i?””.concat(m[r],”iab”):””.concat(m[r]).concat(i);t[d]=t[d]?t[d].concat(“,”,c):c};r===u.Mk?([“site”,”user”].forEach((function(e){Object.keys(n[e]).forEach((function(r){“site”===e&&”content”===r&&n[e][r].data?v(n[e][r].data,e,”data”):”ext”!==r?v(n[e][r],e,r):n[e][r].data&&Object.keys(n[e].ext.data).forEach((function(r){v(n[e].ext.data[r],e,r,!1)}))}))})),Object.keys(d).forEach((function(e){“adserver”!==e?v(d[e],”site”,e):”gam”===d[e].name&&v(d[e].adslot,name,e)})),p&&(t.p_gpid=p),t[“tg_i.pbadslot”]&&delete t[“tg_i.dfp_ad_unit_code”]):(Object.keys(c).length&&(0,a.mergeDeep)(t.imp[0].ext,c),p&&(t.imp[0].ext.gpid=p),(0,a.mergeDeep)(t,n))}function I(e){return(0,a.parseSizesInput)(e).reduce((function(e,r){var t=parseInt(y[r],10);return t&&e.push(t),e}),[])}function Z(e){var r,t,i,n,d=arguments.length>1&&void 0!==arguments[1]&&arguments[1];return r=e,t=void 0!==(0,s.Z)(r,”mediaTypes.”.concat(u.pX)),i=void 0!==(0,s.Z)(r,”mediaTypes.”.concat(u.Mk)),n=”object”!==(0,o.Z)((0,s.Z)(r,”params.video”)),i&&n&&(t=!1),t&&n&&(0,c.N)(r,”params.video”,{}),t?-1===[“outstream”,”instream”].indexOf((0,s.Z)(e,”mediaTypes.”.concat(u.pX,”.context”)))?void(d&&(0,a.logError)(“Rubicon: mediaTypes.video.context must be outstream or instream”)):k(e,”video”).length<2?void(d&&(0,a.logError)(“Rubicon: could not determine the playerSize of the video”)):(d&&(0,a.logMessage)(“Rubicon: making video request for adUnit”,e.adUnitCode),”video”):0===k(e,”banner”).length?void(d&&(0,a.logError)(“Rubicon: could not determine the sizes for banner request”)):(d&&(0,a.logMessage)(“Rubicon: making banner request for adUnit”,e.adUnitCode),”banner”)}function O(e){var r=!1,t=[“asi”,”sid”,”hp”];return e.nodes?((r=e.nodes.reduce((function(e,r){return e?t.every((function(e){return r.hasOwnProperty(e)})):e}),!0))||(0,a.logError)(“Rubicon: required schain params missing”),r):r}function w(e,r){return”rp_schain”===e?”rp_schain=”.concat(r):””.concat(e,”=”).concat(encodeURIComponent(r))}var A=!1;(0,d.dX)(h),window.pbjs.installedModules.push(“rubiconBidAdapter”)}},function(e){e.O(0,[6866],(function(){return r=40060,e(e.s=r);var r}));e.O()}]);
(self.pbjsChunk=self.pbjsChunk||[]).push([[2972],{54834:function(o,e,n){var t=n(71002),i=n(64358),d=n(92797),r=n(51039),a=n(15164),u=n(34516),c=(0,a.df)({moduleName:”pubCommonId”,gvlid:u.$P}),l=”cookie”,s=”html5″,f=”_pubcid_optout”,m=”PublisherCommonId”;function g(o,e){if(e===l)return c.getCookie(o);if(e===s&&c.hasLocalStorage()){var n=c.getDataFromLocalStorage(“”.concat(o,”_exp”));if(!n)return c.getDataFromLocalStorage(o);if(new Date(n).getTime()-Date.now()>0)return c.getDataFromLocalStorage(o)}}function v(o,e){return function(n){“function”==typeof e&&e(),n(o)}}function p(o){var e=arguments.length>1&&void 0!==arguments[1]?arguments[1]:””;if(o){var n=(0,i.parseUrl)(o);n.search.id=encodeURIComponent(“pubcid:”+e);var t=(0,i.buildUrl)(n);return function(){(0,i.triggerPixel)(t)}}}function I(){return!!(c.cookiesAreEnabled()&&g(f,l)||c.hasLocalStorage()&&g(f,s))}var b={name:”sharedId”,aliasName:”pubCommonId”,gvlid:u.$P,decode:function(o,e){if(!I())return(0,i.logInfo)(” Decoded value PubCommonId “+o),{pubcid:o};(0,i.logInfo)(“PubCommonId decode: Has opted-out”)},getId:function(){var o=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},e=arguments.length>2?arguments[2]:void 0;if(I())(0,i.logInfo)(“PubCommonId: Has opted-out”);else{if(!r.VP.getCoppa()){var n=o.params,d=void 0===n?{}:n,a=d.create,u=void 0===a||a,c=d.pixelUrl,l=e;if(!l){try{“object”===(0,t.Z)(window[m])&&(l=window[m].getId())}catch(o){}l||(l=u&&(0,i.hasDeviceAccess)()?(0,i.generateUUID)():void 0)}return{id:l,callback:v(l,p(c,l))}}(0,i.logInfo)(“PubCommonId: IDs not provided for coppa requests, exiting PubCommonId”)}},extendId:function(){var o=arguments.length>0&&void 0!==arguments[0]?arguments[0]:{},e=arguments.length>2?arguments[2]:void 0;if(I())return(0,i.logInfo)(“PubCommonId: Has opted-out”),{id:void 0};if(r.VP.getCoppa())(0,i.logInfo)(“PubCommonId: IDs not provided for coppa requests, exiting PubCommonId”);else{var n=o.params,t=void 0===n?{}:n,d=t.extend,a=void 0!==d&&d,u=t.pixelUrl;if(a)return u?{callback:p(u,e)}:{id:e}}},domainOverride:function(){for(var o,e,n=document.domain.split(“.”),t=”_gd”.concat(Date.now()),i=0;i
(self.pbjsChunk=self.pbjsChunk||[]).push([[2599],{70789:function(e,r,t){var n=t(71002),i=t(4942),o=t(89062),a=t(64358),u=t(24679),d=t(14699),c=t(3193),p=t(15164);function s(e,r){var t=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);r&&(n=n.filter((function(r){return Object.getOwnPropertyDescriptor(e,r).enumerable}))),t.push.apply(t,n)}return t}function l(e){for(var r=1;r
(self.pbjsChunk=self.pbjsChunk||[]).push([[4579],{98709:function(r,e,t){var n=t(64358),o=t(48928),i=t(92797),d=”unifiedId”,u={name:d,gvlid:21,decode:function(r){return r&&”string”==typeof r.TDID?{tdid:r.TDID}:void 0},getId:function(r){var e=r&&r.params||{};if(e&&(“string”==typeof e.partner||”string”==typeof e.url)){var t=e.url||”https://match.adsrvr.org/track/rid?ttd_pid=”.concat(e.partner,”&fmt=json”);return{callback:function(r){var e={success:function(e){var t;if(e)try{t=JSON.parse(e)}catch(r){(0,n.logError)(r)}r(t)},error:function(e){(0,n.logError)(“”.concat(d,”: ID fetch encountered an error”),e),r()}};(0,o.h)(t,e,void 0,{method:”GET”,withCredentials:!0})}}}(0,n.logError)(“User ID – unifiedId submodule requires either partner or url to be defined”)}};(0,i.Bx)(“userId”,u),window.pbjs.installedModules.push(“unifiedIdSystem”)}},function(r){r.O(0,[6866],(function(){return e=98709,r(r.s=e);var e}));r.O()}]);
(self.pbjsChunk=self.pbjsChunk||[]).push([[9039],{83806:function(e,r,n){var t=n(4942),i=n(44925),o=n(20265),u=n(64358),d=n(35706),a=n(14699),s=n(24679),p=[“bids”,”bidderRequestId”,”auctionId”,”bidderCode”];function c(e,r){var n=Object.keys(e);if(Object.getOwnPropertySymbols){var t=Object.getOwnPropertySymbols(e);r&&(t=t.filter((function(r){return Object.getOwnPropertyDescriptor(e,r).enumerable}))),n.push.apply(n,t)}return n}function f(e){for(var r=1;r
(self.pbjsChunk=self.pbjsChunk||[]).push([[9215],{4192:function(e,n,t){t.d(n,{HQ:function(){return c},Pv:function(){return u},UR:function(){return i}});var r=t(64358),o=t(20265),i={growthCodeId:{getValue:function(e){return e.gc_id},source:”growthcode.io”,atype:1,getUidExt:function(e){var n=(0,r.pick)(e,[“h1″,”h2″,”h3″]);if(Object.keys(n).length)return n}},trustpid:{source:”trustpid.com”,atype:1,getValue:function(e){return e}},intentIqId:{source:”intentiq.com”,atype:1},naveggId:{source:”navegg.com”,atype:1},justId:{source:”justtag.com”,atype:1},pubcid:{source:”pubcid.org”,atype:1},tdid:{source:”adserver.org”,atype:1,getUidExt:function(){return{rtiPartner:”TDID”}}},id5id:{getValue:function(e){return e.uid},source:”id5-sync.com”,atype:1,getUidExt:function(e){if(e.ext)return e.ext}},ftrackId:{source:”flashtalking.com”,atype:1,getValue:function(e){var n=””;return e&&e.ext&&e.ext.DeviceID&&(n=e.ext.DeviceID),n},getUidExt:function(e){return e&&e.ext}},parrableId:{source:”parrable.com”,atype:1,getValue:function(e){return e.eid?e.eid:e.ccpaOptout?””:null},getUidExt:function(e){var n=(0,r.pick)(e,[“ibaOptout”,”ccpaOptout”]);if(Object.keys(n).length)return n}},idl_env:{source:”liveramp.com”,atype:3},lipb:{getValue:function(e){return e.lipbid},source:”liveintent.com”,atype:3,getEidExt:function(e){if(Array.isArray(e.segments)&&e.segments.length)return{segments:e.segments}}},britepoolid:{source:”britepool.com”,atype:3},dmdId:{source:”hcn.health”,atype:3},lotamePanoramaId:{source:”crwdcntrl.net”,atype:1},criteoId:{source:”criteo.com”,atype:1},merkleId:{atype:3,getSource:function(e){var n;return null!=e&&null!==(n=e.ext)&&void 0!==n&&n.ssp?””.concat(e.ext.ssp,”.merkleinc.com”):”merkleinc.com”},getValue:function(e){return e.id},getUidExt:function(e){return e.keyID?{keyID:e.keyID}:e.ext?e.ext:void 0}},netId:{source:”netid.de”,atype:1},IDP:{source:”zeotap.com”,atype:1},hadronId:{source:”audigent.com”,atype:1},quantcastId:{source:”quantcast.com”,atype:1},idx:{source:”idx.lat”,atype:1},connectid:{source:”verizonmedia.com”,atype:3},fabrickId:{source:”neustar.biz”,atype:1},mwOpenLinkId:{source:”mediawallahscript.com”,atype:1},tapadId:{source:”tapad.com”,atype:1},novatiq:{getValue:function(e){return e.snowflake},source:”novatiq.com”,atype:1},uid2:{source:”uidapi.com”,atype:3,getValue:function(e){return e.id}},deepintentId:{source:”deepintent.com”,atype:3},admixerId:{source:”admixer.net”,atype:3},adtelligentId:{source:”adtelligent.com”,atype:3},amxId:{source:”amxdt.net”,atype:1},publinkId:{source:”epsilon.com”,atype:3},kpuid:{source:”kpuid.com”,atype:3},imppid:{source:”ppid.intimatemerger.com”,atype:1},imuid:{source:”intimatemerger.com”,atype:1},connectId:{source:”yahoo.com”,atype:3},qid:{source:”adquery.io”,atype:1},dacId:{source:”impact-ad.jp”,atype:1},”33acrossId”:{source:”33across.com”,atype:1,getValue:function(e){return e.envelope}},tncid:{source:”thenewco.it”,atype:3},gravitompId:{source:”gravito.net”,atype:1},cpexId:{source:”czechadid.cz”,atype:1},oneKeyData:{getValue:function(e){if(e&&Array.isArray(e.identifiers)&&e.identifiers[0])return e.identifiers[0].value},source:”paf”,atype:1,getEidExt:function(e){if(e&&e.preferences)return{preferences:e.preferences}},getUidExt:function(e){if(e&&Array.isArray(e.identifiers)&&e.identifiers[0]){var n=e.identifiers[0];return{version:n.version,type:n.type,source:n.source}}}}};function a(e,n){var t=i[n];if(t&&e){var o={};o.source=(0,r.isFn)(t.getSource)?t.getSource(e):t.source;var a=(0,r.isFn)(t.getValue)?t.getValue(e):e;if((0,r.isStr)(a)){var c={id:a,atype:t.atype};if((0,r.isFn)(t.getUidExt)){var u=t.getUidExt(e);u&&(c.ext=u)}if(o.uids=[c],(0,r.isFn)(t.getEidExt)){var s=t.getEidExt(e);s&&(o.ext=s)}return o}}return null}function c(e){var n=[],t=function(t){if(e.hasOwnProperty(t))if(“pubProvidedId”===t)n=n.concat(e.pubProvidedId);else if(Array.isArray(e[t]))e[t].forEach((function(e,r,o){var i=a(e,t);i&&n.push(i)}));else{var r=a(e[t],t);r&&n.push(r)}};for(var r in e)t(r);return n}function u(e){var n=[];return e.filter((function(e){return(0,r.isPlainObject)(e.idObj)&&Object.keys(e.idObj).length})).forEach((function(e){Object.keys(e.idObj).forEach((function(t){(0,o.Z)(e,”config.bidders”)&&Array.isArray(e.config.bidders)&&(0,o.Z)(i,t+”.source”)&&n.push({source:i[t].source,bidders:e.config.bidders})}))})),n}},34727:function(e,n,t){var r,o,i,a,c,u,s,d=t(71002),l=t(34614),f=t(3193),g=t(52021),p=t(78640),m=t(51039),y=t(5644),v=t(92797),b=t(4192),h=t(15164),I=t(64358),E=t(20265),w=t(96475),O=t(7563),D=t(68792),k=t(17673),j=t(26372),S=t(99128),x=t(38196),P=”User ID”,A=”cookie”,U=”html5″,C={name:”_pbjs_userid_consent_data”,expires:30},R=”_pbjs_id_optout”,T=(0,h.eA)(“userid”),V=!1,_=[],Z=[],q=[],F=function(){return null==s&&(s=(0,S.V6)()),s};function N(e){return F().fork().renameWith((function(n){return[“userId.mod.”.concat(n),”userId.mods.”.concat(e,”.”).concat(n)]}))}function L(e){var n=”function”==typeof e.submodule.domainOverride?e.submodule.domainOverride():null,t=e.config.storage.name;return function(e,r,o){T.setCookie(t+(e||””),r,o,”Lax”,n)}}function G(e,n){var t=e.config.storage;try{var r=new Date(Date.now()+864e5*t.expires).toUTCString(),o=(0,I.isPlainObject)(n)?JSON.stringify(n):n;if(t.type===A){var i=L(e);i(null,o,r),”number”==typeof t.refreshInSeconds&&i(“_last”,(new Date).toUTCString(),r)}else t.type===U&&(T.setDataInLocalStorage(“”.concat(t.name,”_exp”),r),T.setDataInLocalStorage(t.name,encodeURIComponent(o)),”number”==typeof t.refreshInSeconds&&T.setDataInLocalStorage(“”.concat(t.name,”_last”),(new Date).toUTCString()))}catch(e){(0,I.logError)(e)}}function z(e){var n,t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:void 0,r=t?””.concat(e.name,”_”).concat(t):e.name;try{if(e.type===A)n=T.getCookie(r);else if(e.type===U){var o=T.getDataFromLocalStorage(“”.concat(e.name,”_exp”));””===o?n=T.getDataFromLocalStorage(r):o&&new Date(o).getTime()-Date.now()>0&&(n=decodeURIComponent(T.getDataFromLocalStorage(r)))}”string”==typeof n&&”{“===n.trim().charAt(0)&&(n=JSON.parse(n))}catch(e){(0,I.logError)(e)}return n}function W(e){var n={consentString:””,gdprApplies:!1,apiVersion:0};return e&&(n.consentString=e.consentString,n.gdprApplies=e.gdprApplies,n.apiVersion=e.apiVersion),(0,I.cyrb53Hash)(JSON.stringify(n))}function B(e,n){n=F().fork().startTiming(“userId.callbacks.total”).stopBefore(n);var t=(0,I.delayExecution)((function(){clearTimeout(o),n()}),e.length);e.forEach((function(e){var n=N(e.submodule.name).startTiming(“callback”).stopBefore(t);try{e.callback((function(t){t?(e.config.storage&&G(e,t),e.idObj=e.submodule.decode(t,e.config),ce(e.idObj)):(0,I.logInfo)(“”.concat(P,”: “).concat(e.submodule.name,” – request id responded with an empty value”)),n()}))}catch(t){(0,I.logError)(“Error in userID module ‘”.concat(e.submodule.name,”‘:”),t),n()}e.callback=void 0}))}function H(e,n){[e].some((function(e){return!Array.isArray(e)||!e.length}))||e.forEach((function(e){e.bids&&(0,I.isArray)(e.bids)&&e.bids.forEach((function(e){var t=function(e,n){return Array.isArray(e)&&e.length&&n?e.filter((function(e){return!e.config.bidders||!(0,I.isArray)(e.config.bidders)||(0,l.q9)(e.config.bidders,n)})).filter((function(e){return(0,I.isPlainObject)(e.idObj)&&Object.keys(e.idObj).length})).reduce((function(e,n){return Object.keys(n.idObj).forEach((function(t){e[t]=n.idObj[t]})),e}),{}):{}}(n,e.bidder);Object.keys(t).length&&(e.userId=t,e.userIdAsEids=(0,b.HQ)(t))}))}))}var J,Q={};function M(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:X()||[],n=c&&e.find((function(e){return e.source===c}));if(n&&”string”==typeof(0,E.Z)(n,”uids.0.id”)){var t=n.uids[0].id.replace(/[W_]/g,””);if(t.length>=32&&t.length<=150)return t;(0,I.logWarn)(“User ID – Googletag Publisher Provided ID for “.concat(c,” is not between 32 and 150 characters – “).concat(t))}}var K=(0,S.g3)(“userId”,(function(e,n){var t=this,o=arguments.length>2&&void 0!==arguments[2]?arguments[2]:{},i=o.delay,c=void 0===i?D.Z.timeout:i,u=o.getIds,s=void 0===u?oe:u;D.Z.race([s().catch((function(){return null})),c(a)]).then((function(){H(n.adUnits||(0,p.R)().adUnits,r),F().join((0,S.Bf)(n.metrics),{propagate:!1,includeGroups:!0}),e.call(t,n)}))}));function Y(){return function(e){return Array.isArray(e)&&e.length?e.filter((function(e){return(0,I.isPlainObject)(e.idObj)&&Object.keys(e.idObj).length})).reduce((function(e,n){return Object.keys(n.idObj).forEach((function(t){e[t]=n.idObj[t]})),e}),{}):{}}(r)}function X(){return(0,b.HQ)(Y())}function $(e){return(0,b.HQ)(function(e,n){if(!Array.isArray(e)||!e.length)return{};var t=e.filter((function(e){var t;return(0,I.isPlainObject)(e.idObj)&&Object.keys(e.idObj).length&&(null===(t=b.UR[Object.keys(e.idObj)[0]])||void 0===t?void 0:t.source)===n}));return(0,I.isEmpty)(t)?[]:t[0].idObj}(r,e))[0]}function ee(e,n,t){return J().then((function(){var r={};if((0,I.isFn)(t)){(0,I.logInfo)(“”.concat(P,” – Getting encrypted signal from custom function : “).concat(t.name,” & source : “).concat(e,” “));var o=t(e);r[e]=o?ne(o):null}else{var i=$(e);(0,I.logInfo)(“”.concat(P,” – Getting encrypted signal for eids :”).concat(JSON.stringify(i))),(0,I.isEmpty)(i)||(r[i.source]=!0===n?ne(i):i.uids[0].id)}return(0,I.logInfo)(“”.concat(P,” – Fetching encrypted eids: “).concat(r[e])),r[e]}))}function ne(e){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:1,t=””;if(1===n)t=”object”===(0,d.Z)(e)?window.btoa(JSON.stringify(e)):window.btoa(e);return””.concat(n,”||”).concat(t)}function te(){if((0,I.isGptPubadsDefined)()){window.googletag.encryptedSignalProviders=window.googletag.encryptedSignalProviders||[];var e=f.vc.getConfig(“userSync.encryptedSignalSources”);if(e){var n=e.registerDelay||0;setTimeout((function(){e.sources&&e.sources.forEach((function(e){var n=e.source,t=e.encrypt,r=e.customFunc;n.forEach((function(e){window.googletag.encryptedSignalProviders.push({id:e,collectorFunction:function(){return ee(e,t,r)}})}))}))}),n)}else(0,I.logWarn)(“”.concat(P,” – ESP : encryptedSignalSources config not defined under userSync Object”))}}function re(){var e=(arguments.length>0&&void 0!==arguments[0]?arguments[0]:{}).submoduleNames,n=arguments.length>1?arguments[1]:void 0;return J({refresh:!0,submoduleNames:e}).then((function(){return n&&(0,I.isFn)(n)&&n(),Y()}))}function oe(){return J().then((function(){return Y()}),(function(e){return e===Q?Promise.resolve().then(oe):((0,I.logError)(“Error initializing userId”,e),D.Z.reject(e))}))}var ie=(0,v.z3)(“sync”,(function(e,n){return{userIdModules:e,hasValidated:n&&n.hasValidated}}),”validateGdprEnforcement”);function ae(e,n,t,r){if(e.config.storage){var o,i=z(e.config.storage),a=!1;if(“number”==typeof e.config.storage.refreshInSeconds){var c=new Date(z(e.config.storage,”last”));a=c&&Date.now()-c.getTime()>1e3*e.config.storage.refreshInSeconds}!i||a||r||!function(e,n){return null!=e&&e===W(n)}(t,n)?o=e.submodule.getId(e.config,n,i):”function”==typeof e.submodule.extendId&&(o=e.submodule.extendId(e.config,n,i)),(0,I.isPlainObject)(o)&&(o.id&&(G(e,o.id),i=o.id),”function”==typeof o.callback&&(e.callback=o.callback)),i&&(e.idObj=e.submodule.decode(i,e.config))}else if(e.config.value)e.idObj=e.config.value;else{var u=e.submodule.getId(e.config,n,void 0);(0,I.isPlainObject)(u)&&(“function”==typeof u.callback&&(e.callback=u.callback),u.id&&(e.idObj=e.submodule.decode(u.id,e.config)))}ce(e.idObj)}function ce(){var e=arguments.length>0&&void 0!==arguments[0]?arguments[0]:Y();if(e&&c){var n=M((0,b.HQ)(e));n&&((0,I.isGptPubadsDefined)()?window.googletag.pubads().setPublisherProvidedId(n):(window.googletag=window.googletag||{},window.googletag.cmd=window.googletag.cmd||[],window.googletag.cmd.push((function(){window.googletag.pubads().setPublisherProvidedId(n)}))))}}function ue(e,n,t){var r=arguments.length>3&&void 0!==arguments[3]&&arguments[3];return F().fork().measureTime(“userId.init.modules”,(function(){if(!n.length)return[];var o=function(){var e=[],n=!1;T.localStorageIsEnabled()&&(e.push(U),T.getDataFromLocalStorage(R)&&((0,I.logInfo)(“”.concat(P,” – opt-out localStorage found, storage disabled”)),n=!0));T.cookiesAreEnabled()&&(e.push(A),T.getCookie(R)&&((0,I.logInfo)(“”.concat(P,” – opt-out cookie found, storage disabled”)),n=!0));return new Set(n?[]:e)}();if(!(n=n.filter((function(e){return!e.config.storage||o.has(e.config.storage.type)}))).length)return(0,I.logWarn)(“”.concat(P,” – no ID module is configured for one of the available storage types:”),Array.from(o)),[];var i=ie(n,t),a=i.userIdModules;if(!i.hasValidated&&!(0,k.h)(t))return(0,I.logWarn)(“”.concat(P,” – gdpr permission not valid for local storage or cookies, exit module”)),[];var c=function(){try{return T.getCookie(C.name)}catch(e){(0,I.logError)(e)}}();!function(e){try{var n=new Date(Date.now()+864e5*C.expires).toUTCString();T.setCookie(C.name,W(e),n,”Lax”)}catch(e){(0,I.logError)(e)}}(t);var u=a.reduce((function(e,n){return N(n.submodule.name).measureTime(“init”,(function(){try{ae(n,t,c,r),e.push(n)}catch(e){(0,I.logError)(“Error in userID module ‘”.concat(n.submodule.name,”‘:”),e)}return e}))}),[]);return u.length&&function(e){var n=(0,I.getPrebidInternal)().setEidPermissions;”function”==typeof n&&(0,I.isArray)(e)&&n((0,b.Pv)(e))}(u),u.forEach(se.bind(null,e)),u}))}function se(e,n){for(var t=!1,r=0;r
(self.pbjsChunk=self.pbjsChunk||[]).push([[6635],{63273:function(e,t,n){var r=n(64358),i=n(20265),o=n(14699),d=n(24679),a=n(15164),c=n(55975),s=n(3193),u=”prebid”,p=”vidazoo”,g=”1.0.0″,l=9e5,b=36e5,v=”vidSid”,f=”vdzwopt”,h={britepoolid:1,criteoId:1,id5id:1,idl_env:1,lipb:1,netId:1,parrableId:1,pubcid:1,tdid:1,pubProvidedId:1},I=”wsid_”+parseInt(Date.now()*Math.random()),m=(0,a.df)({gvlid:744,bidderCode:p});function C(){try{return(0,r.parseUrl)(window.top.document.URL,{decodeSearchAsString:!0}).search}catch(e){return””}}function S(){return”https://”.concat(arguments.length>0&&void 0!==arguments[0]?arguments[0]:u,”.cootlogix.com”)}function y(e){return e.cId||e.CID||e.cID||e.CId||e.cid||e.ciD||e.Cid||e.CiD}function D(e){return e.pId||e.PID||e.pID||e.PId||e.pid||e.piD||e.Pid||e.PiD}function w(e,t,n,o,d){var a,s,u=e.params,w=e.bidId,q=e.userId,x=e.adUnitCode,A=e.schain,_=e.mediaTypes,k=e.auctionId,O=e.transactionId,T=e.bidderRequestId,M=e.bidRequestsCount,z=e.bidderRequestsCount,F=e.bidderWinsCount,P=u.ext,j=u.bidFloor,L=function(e){var t=arguments.length>1&&void 0!==arguments[1]?arguments[1]:”_”,n=e.length,r=0,i=0;if(n>0)for(;i
(self.pbjsChunk=self.pbjsChunk||[]).push([[608],{39595:function(e,r,i){var n=i(4942),t=i(20265),s=i(64358),a=i(14699),d=i(24679),o=i(35706),u=i(34614),c=”https://player.sync.viewdeos.com/outstream-unit/2.01/outstream.min.js”,p=”outstream”,f=”display”,v={code:”viewdeosDX”,aliases:[“viewdeos”],gvlid:924,supportedMediaTypes:[d.pX,d.Mk],isBidRequestValid:function(e){return!!(0,t.Z)(e,”params.aid”)},getUserSyncs:function(e,r){var i=[];function n(r){var n=r.cookieURLs,t=r.cookieURLSTypes||[];Array.isArray(n)&&n.forEach((function(r,n){var s=t[n]||”image”;!e.pixelEnabled&&”image”===s||!e.iframeEnabled&&”iframe”===s||i.push({type:s,url:r})}))}return(e.pixelEnabled||e.iframeEnabled)&&(0,s.isArray)(r)&&r.forEach((function(e){e.body&&((0,s.isArray)(e.body)?e.body.forEach((function(e){n(e)})):n(e.body))})),i},buildRequests:function(e,r){return{data:m(e,r),bidderRequest:r,method:”GET”,url:”https://ghb.sync.viewdeos.com/auction/”}},interpretResponse:function(e,r){var i=r.bidderRequest;e=e.body;var n=[];return(0,s.isArray)(e)?(e.forEach((function(e){n=(0,s.flatten)(n,l(e,i))})),n):l(e,i)}};function l(e,r){var i=!e||!(0,s.isArray)(e.bids),n=[];if(i){var a=e&&e.ext&&e.ext.message?”: “.concat(e.ext.message):””,o=”in response for “.concat(r.bidderCode,” adapter “).concat(a);return(0,s.logError)(o),n}return e.bids.forEach((function(e){var i=(0,u.cx)(r.bids,(function(r){return r.bidId===e.requestId}));if(0!==e.cpm&&-1!==i){var s=r.bids[i],a=function(e,r,i){var n={requestId:e.requestId,creativeId:e.cmpId,height:e.height,currency:e.cur,width:e.width,cpm:e.cpm,netRevenue:!0,mediaType:r,ttl:3600,meta:{advertiserDomains:e.adomain||[]}};if(r===f)return Object.assign(n,{ad:e.ad});Object.assign(n,{vastUrl:e.vastUrl}),r===p&&Object.assign(n,{mediaType:”video”,adResponse:e,renderer:b(e.requestId,i)});return n}(e,function(e){var r=(0,t.Z)(e,”mediaTypes.video”),i=(0,t.Z)(e,”mediaTypes.video.context”);return r?i===p?p:d.pX:f}(s),s.params);n.push(a)}})),n}function m(e,r){var i,a,o,u,c,p,v={domain:(0,t.Z)(r,”refererInfo.page”)};(0,t.Z)(r,”gdprConsent.gdprApplies”)&&(v.gdpr=1,v.gdpr_consent=(0,t.Z)(r,”gdprConsent.consentString”)),(0,t.Z)(r,”bidderRequest.uspConsent”)&&(v.us_privacy=r.uspConsent);for(var l=0,m=e.length;l
})(),pbjs.processQueue();
What went wrong when scammers figured out how to impersonate legitimate senders
Trust is currency in our online world, and the links we establish between trusted parties enable everything from secure websites, to crypto platforms, to the software updates you install on your phone. The value we place in it is exactly what makes violating that trust so appealing to ne’er-do-wells and all the scammy operators hoping to make an illegitimate buck off you.
Back at the start of June, we had the opportunity to check out one of the latest tricks baddies were up to that abused existing trust-based systems — in this case, the blue checkmark Gmail just started showing in your inbox to indicate a verified sender. While that should only appear on messages coming from authenticated businesses and institutions, scammers had devised a trick that seemingly let them squeeze past this test, displaying the blue checkmark despite not originating from the business in question. Let’s take a look at what went wrong, how it was abused, and what’s being done to fix things.
How this is all supposed to work
Email is one of the oldest ways to communicate online, and as such, it’s been tackling abuse for decades. That’s led to the design and implementation of numerous systems intended to add robust authentication. One of the biggies there is DMARC, or Domain-based Message Authentication, Reporting and Conformance, which builds upon Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) systems in order to prevent spoofing and ensure that the name in an email’s from: field is actually the person who sent it.
Gmail also uses VMC, or a Verified Mark Certificate, to indicate sender legitimacy. This one is essentially a digital attestation of something that’s been legally trademarked — letting us establish brand identity. That’s then used as the basis for BIMI, the Brand Indicators for Message Identification — the system that ultimately is responsible for showing a company’s icon next to its messages in your inbox.
When all this is properly configured, emails from authenticated organizations will display the company logo, as well as feature the blue “verified” checkmark. At least, that’s how it’s supposed to work. So how did this all go so spectacularly wrong?
Wherein we lose all faith in checkmarks
Cybersecurity engineer Chris Plummer noticed something was up when he spotted emails in his Gmail inbox from some suspicious-looking addresses… yet nonetheless included the real company’s logo and featured the blue checkmark. As you can see in the example here shared below, while this message does appear to come from a UPS.com account (spoiler: it didn’t really), the gibberish subdomain and account should immediately jump out at anyone with even a passing interest in online security as strongly suggestive of spoofing.
As we detailed in our earlier coverage, Plummer reported this to Google only to have his bug submission initially rejected on the basis that this was somehow Gmail’s intended behavior. After social media helped raise this vulnerability’s profile a bit, Google ultimately reconsidered that and acknowledged that this justified a closer look.
This past week, the company began sharing some insight into how this was possible. Speaking with Cyberscoop, Google summarized the issue as “a third-party security vulnerability allowing bad actors to appear more trustworthy than they are.” The core of this seems to be the coexistence of the dual SPF and DKIM authentication methods, and how BIMI behaves when one passes, but not the other.
Since UPS trusted Microsoft to send emails on its behalf, when Gmail saw the incoming message that a scammer directed through a Microsoft server, this was viewed as a legit, BIMI-compliant way for a UPS email to arrive — even despite the presence of that garbage-sounding spoofed subdomain.
As another security researcher, Jonathan Rudenberg, explained on Mastodon, as a consequence of the way that Gmail implemented BIMI, a message with a valid SPF check but a mismatched DKIM certificate would still be treated as legitimate. By taking advantage of misconfigured mail servers run by companies using BIMI, it was possible to abuse whitelist policies and convince a remote server to pass a message along as if it originated from the spoofed domain — all while seeming to support BIMI authentication.
In this case, Microsoft email servers were outed as making this attack possible. Christoph Dary shares how this works with our example: Since UPS trusted Microsoft to send emails on its behalf, when Gmail saw the incoming message that a scammer directed through a Microsoft server, this was viewed as a legit, BIMI-compliant way for a UPS email to arrive — even despite the presence of that garbage-sounding spoofed subdomain. And rather than looking further back down the chain of which systems the email had passed through, and whether it failed any earlier validation attempts, if the most recent test looked good to Gmail, that’s apparently all it took to trigger the checkmark to appear.
Let’s just never use email again
This all seems pretty bad, considering how relatively easy it appears to just utterly bypass what’s supposed to be a reliable indicator of the trust you should have in a message’s sender. And if you were thinking, “well no way would I be fooled by that fake-ass UPS email,” check out what Jonathan Rudenberg was able to accomplish after a little investigation:
There is no way your average email user — or honestly, even someone with a relatively advanced eye for spam — would think twice about the authenticity of that sender. So what are supposed to do, just give up on email? Assume it’s all possibly fake? Thankfully, solutions are already being implemented.
One of the most immediately impactful has been UPS removing Outlook as an authorized mail server in its SPF record, preventing this specific attack. But what about all the other myriad organizations out there with similarly misconfigured records?
Google has basically decided not to trust SPF alone when doing DMARC checks, and instead will require the use of DKIM, which is being promoted as robust against this type of vulnerability. Enforcement of that change should already be underway.
Maybe the most frustrating thing to come out of all of this has been shining a light on just how fragile and compartmentalized email authentication is right now. Disparate systems are cobbled together, reliant on each other to do their jobs, but lacking necessary understanding about how all those parts are making the decisions they do.
When a problem actually does emerge, as it did here, the parties involved need to be resistant to taking the “well, my part works, the problem must be your part, and I can’t be bothered to investigate” stance. Even now, the group behind BIMI sounds almost dismissive of the whole incident, saying that it “illustrates a long-standing, and well-known, issue with SPF, one that predates BIMI and even DMARC.” If issues like these are known, the parties involved need to be proactively resolving them (rather than waiting for hackers to take notice), if we’ve got any hope of feeling confident in the trust we share online.
