How a Massive Ad Fraud Scheme Exploited Android Phones to Steal Millions
buzzfeednews.com
buzzfeednews.com
Some don't need as much of it (e.g., Google), but quite literally saying "there's fraud in my online traffic" is like saying "there's tomato sauce in my spaghetti". It's quite literally such a normal thing that I've become immune to even getting roused by it (and remember, again, I work to find ad-fraud daily).
Does this make it right? No, absolutely not. But is this ever going to change, absolutely not. Too many people are making too much money from this. Just you try to tell an L2 that they can't hit their Q4 Revenue OKR because "we're doing something really immoral by allowing fraud".
Don't make me laugh XD
There's no scarcity in available email addresses. If your security depends on people not being able to register new emails, you've already lost.
This is a well-documented feature that has many legitimate uses. If you're trying to stop fraud, clip any gmail addresses after the +. For example, I believe Facebook does this.
I've never had any compliance issues with any other advertising network.
Google works hard to keep the ecosystem healthy because it's good for their long-term interests. But of course, their systems are not perfect.
https://www.statista.com/statistics/266210/number-of-availab...
37% fraud-rules breaking rate is pathetic. Maybe they should spend time vetting these things before allowing malware-infested spyware out into the "ecosystem."
Probably the main people getting stiffed are the publishers who are offering real traffic, and getting a smaller share of dollars relative to the incremental value they deliver.
edit: I should rephrase, this sounds hostile. I know there is wide work in influencing people to buy stuff when influenced in person. The interpersonal dynamics are widely studied. I also know, that chumming content and goating works to gather more views, but that can only be turned into a ROI by people paying for ads to serve those viewers. There is also the segment of ads, which offer a discount, but what about all the rest? Does banner or clip advertisement actually provide a measurable return of investment? Does online advertisement offer brand recognition, and does it provide a ROI? Are the adverse effects studied, so that people actively despise brands for offensive ads? What are the going rates for views and reactions to online advertisement vs traditional marketing?
In short, what is the state of the art of research into online advertisement?
The schemes mentioned in articles like this are almost exclusively targeted at brand marketers. My guess is the problem lies in the way that large brands incentivize the people running their campaigns, because the technology exists to knock out the vast majority of this type of fraud. Companies like Coke hire ad firms that send them reports about impressions, and they are thus incentivized to not pay attention to traffic quality, and just maximize impressions. That has to be the problem, because just my internal traffic quality tools that I have written would have shutdown ad delivery on the sites sending such obviously bad traffic within a few clicks from each referrer - and I don't claim to have written the most sophisticated filter out there. There are many ways to do reality checks on traffic, on a per-referrer basis, and cut out much of this stuff. Webview traffic (the kind being taken advantage of here) is among the easiest to detect.
As to your question about measuring ROAS it's simple for performance marketers. Take your ad spend and compare it to revenue. I'm not sure that brand marketers have a reasonable way of determining ROAS, either online or in the physical world. I suppose they could take brand recognition surveys and compare before/after a given campaign, but that is hardly an exact science.
I had this presentation a few months ago: https://www.slideshare.net/mobile/gregak/if-youre-not-measur... I would be interested to know what you think.
The importance of being able to figure out what actually led to conversions is not lost on me though. One unique technology I created allows us to do something that I have never seen anyone else in the online marketing world do: track conversions back to the initial click and ad campaign, even if someone just texts, emails, or uses an instant messenger to send the URL to a friend. So let's say someone visits the site, sees that the offer isn't for them but texts it to a friend. A month later, that friend finally gets around to looking at it, but decides it isn't for them either but knows someone else who might be interested, and they email it to someone else, who ultimately converts. We can track that conversion and all the steps in between back to the initial click and attribute it to the initial ad campaign, which gives us a much better sense of what each ad campaign is actually producing. The technology also lets us create custom Facebook audiences of anyone that has shared a link from the site - regardless of how they shared - text, email, Facebook - doesn't matter. We can then customize campaigns to encourage those people to share again.
What you describe is certainly interesting. I guess you are building a graph of unique IDs, with each shared URL containing the ID of the parent as a query param or something like that?
I initially wrote this system so that I could retarget through Facebook ads people that had previously shared viral news articles, but now we have found great applications for it in ecommerce and lead gen as well.
https://developers.facebook.com/docs/marketing-api/audiences... - see "External Identifiers"
But what does it have to do with the ad fraud?
We know possible targets try to scam the system, this article shows so. We know, that certain parts of advertisements are trying to sell stuff to people they dont need. As naive as it sounds, most advertisement isnt there to inform us of stuff we dont know of and would want to buy if we knew. And if you pay people to make other people act against their own interests, it is not unreasonable, that they would do the same to the people hiring them. And not just the same, but alot more. I think its only reasonable to assume, that professional scammers would not just try to scam the people, they are payed to scam, but also the people who pay them in the first place, who offer a much larger payout.
Why wouldnt advertising agencies not put alot more effort in convincing potential customers of their own, that they need their advertisement, then trying to influence the potential customers of their customers on the abstract level of brand awareness.
If brand awareness is not a matter of ROI but bullshit and just a matter of triggering interpersonal marketing mechanisms. "Your competition is spending this amount on" brand awareness and all the other true and tested mechanisms. Marketing your advertisement services to companies for brand awareness sounds like just another sales gig. And one where the methods are true and tested. Be it selling used cars or selling you your appearal as your image or selling the concept of creating a brand throguh digital ads.
Lobbying works for a reason in politics. My question was, if there is a reason to not assume the same for online banner marketing for brand awareness.
Thank you for your keywords, i will look them up.
Booking Holdings, for example, spent $4.1 billion dollars in 2017 on performance advertising. This would generally mean they had an ROI target (e.g., each dollar of spend should return $1.2 in revenue). The method of measuring this would generally come from an agreement between the marketing team and the finance team — it might require some assumptions on things like LTV or the value of certain actions, but the finance team would be major participants in determining this value.
There's no way Booking or similar massive advertisers are spending billions of dollars without a very very clear POV on the return they're receiving.
I think a lot of the "state of the art" that you're asking for won't be shared with the public by these companies.
In fact, a huge reason Booking is so successful is because their sites convert at a higher rate than their competitors (which they themselves attribute to an early and maniacal focus on A/B testing), and thus they are able to bid more for travel-related search terms on Google as each click is worth more to them. It's pretty easy for them to track what percentage of Google AdWords click-throughs result in a completed booking.
Brand advertising, though, has much fuzzier metrics, and the incentives for brand advertisers is to show that they have a larger impact than they actually do.
Unless you're a large premium publisher like say a NYT, a Techcrunch, or even a Forbes, more of your traffic probably wont be real, and you have little to no control over that. The online ad/traffic buying game is so mind-blowingly convoluted, you can be a small publisher (foo.com), having your site spammed, and what little revenue you've made via your supply completely wiped out (i.e., clawed back by your upstream partner - even large publishers don't operate by themselves), and your reputation takes a hit.
The main people getting stiffed are the web users, and the advertisers. But it doesn't seem like either of them care enough about it to do something that can have a lasting effect
So yes I totally think that current bonus for add fraudster is not helping a "new John Gruber" to emerge.
Its why I don't feel bad using ad blockers: I subsidise your shitty commercials anyway.
These guys just send a bunch of emails using known leaked accounts, and a few of these people are going to be scared because they reuse the same password. Since they ask for bitcoin, anyone can see the transactions of their wallets: roughly $6-12,000 USD each attempt.
The risk-reward ratio is ridiculously low, I guess that's the same with ad fraud. Companies would fight a company-sized rat, but not thousands of rat-sized companies.
1. It has been a vector for viruses / malware / cryptocoin mining
2. It tracks users activities on the internet without their knowledge to form a picture of their 'online personality'
3. It can invade a users privacy by keeping records of personal and / or intimate details of their online activities
4. It often uses more bandwidth than the content of the site it's on
5. auto-play videos
6. unexpected audio
7. As per rayvy's comment "everyone does fraud"
As the Joker said "this town needs an enema".
Given that "all the smartest people in the world work for advertising" it's a remarkable collective of all kinds of failure. And yet it continues to make a shit-ton of money because it's pretty much the only game in town.
What's the alternative? Word-of-mouth? That requires a product that's good and useful both now and into the future; not a fad. The growth-rate can also be glacial for a long initial phase, which needs commitment and passion from it's developers and management over the long term.
I can't see any revolution on the horizon though. It's going to take an impossibly sized critical mass of society to protest, and given the number of people still on Facebook... 'Brands' aren't going to stop advertising for fear of competitors getting more eyeballs.
I'm going to start an advertising company called Raypenpillidge Sleepwell.
Footnote: Point #3 is separate to point #2 because tracking and privacy invasion should be considered separately - tracking could be done more openly with user consent which would mean the level of privacy invasion could be chosen by the user.
From the article:
>The revelation of this scheme shows just how deeply fraud is embedded in the digital advertising ecosystem, the vast sums being stolen from brands, and the overall failure of the industry to stop it.
And, more relevant:
>Pixalate’s latest analysis of in-app fraud found that 23% of all ad impressions in mobile apps are in some way fraudulent.
Now, if the numbers are correct and 23% of ad impressions is fraudulent, it should mean that either:
1) the firms/brands/whatever that are paying for these ads cannot measure with a sufficient degree of accuracy the results of these ads
2) they perfectly know that more than 1/5 of their ads expense is having "null" results but overall they are ok to spend the 100% price for less than 80% "real" impressions
If the first hypothesis is true there is some incompetence around, if the second, it's business as usual.
I believe more likely the #2 to be true, and since the companies/brands/etc. insist on it, this 20-25% "surcharge" is a "standard" of sorts.
So,hypothetically , if these frauds would be completely eradicated and the companies would continue to invest the same amount of money in ads, we are doomed to see 20-25% more ads than we do now.
Don't ad companies charge fees as a function of spend? The chumps in this chain are (a) shareholders and (b) the managers hiring the agencies.
(Counterfactual: if this spend is that useless, it should be possible to start a competitor that focuses on high-ROI advertising.)
Exactly! And that's where online ads, user tracking, online-to-offline came in. The whole reason why it gained so much traction in the past 20 years is that it began to offer better tracking and results than other forms of advertising.
If Google (or Facebook, or anyone else) stands still and lets fraudsters abuse their ad networks, the return on their ads will drop, opening space for their competitors.
So controlling ad-serving quality is a competitive advantage.
And the increased flow of ad money to online ads proves you wrong.
I wish corporations would be so forward looking, but they are mostly short-sighted, worrying about the next quarters results.
I recently saw a comment (can't remember where) from someone involved in an advertising startup ostensibly focused on serving unintrusive ads with accurate reporting, and the response has been overwhelmingly positive: ad buyers expressed profound relief at seeing ad metrics that actually made sense.
I don't think we can make too many assumptions about how spending would change if ad metrics were actually accurate, simply because the current metrics are so bad, and the impressions so fraudulent, that the current ad spending is largely uninformed. If the metrics were accurate, ad buyers might very well end up spending less while getting more for their money, because they can suddenly make informed decisions.
That, or they cram even more ads onto their sites to compensate, and users throw up ad blockers or go elsewhere.
If A$ = B impressions = C clicks = D sales then the amount of fraud is irrelevant it's just a question of A$ = D sales from the advertisers perspective.
As for your conclusion you can see it another way. If fraud disappears perhaps ads efficiency rates would also drop. Because ad fraud isn't only about ads that never show to their indented audience. A lot of times is about fraudulent clicks. So while you think your ad had a 2% CTR in reality it could be half that. You can never know who actually clicks on your ads. What you can know and measure is the conversion, aka how many actually bought your product. But if your product isn't sold online, like say packaged consumer products which are sold in super markets and all you aim with advertising is brand awareness you can't even track that. So you're siphoning millions to a black hole and you just pray that your analytics data are correct. Chances are, they aren't but no one will bother telling you. So eventually you might start seeing less ads because companies will realize there's no reason to keep their budgets at current levels.
And then there is the fact that there are a lot of actors involved in fraud, either directly or indirectly. Take video ads for example which have a higher CPM. It's in the platform's interest, aka the publisher, to produce as much views as possible to pocket the money. It's not like the fraud is performed from some shady character who lives in the underground. A lot of the times it's the networks themselves who will try to rob clients from their money.
Bottom line, there are a lot of angles to this issue.
As long as the revenue gain (and resulting margin) is more than the advertising spend, it is a winning strategy. Meanwhile, every ad network has a 'beta' value which is the ratio of ad spend to revenue increase, ad networks with a low beta either have more fraud or they are hitting the wrong demographic, either way dollars are shifted away from that network to one with a higher beta.
But for the legit publishers, they’re all getting 80% of what they should have been earning. That’s less legit content for consumers.
Nope. Advertisers would charge their clients 20-25% more to serve us ads. Digital ads are like real estate - every available piece gets rented out at some price, because otherwise it'll sit empty and make no money instead. The only question is what price is market-clearing: quantity of ads served is completely irrelevant.
Its not quite the same as fraud, since offline you can always argue about brand-building even among non-customers, but the end result is the same, money spent on ads that won't result in spend.
If you want to check your own device if you have any apps that contain the code used by this botnet, the latest release of our AppBrain Ad Detector app will scan for it. It's available on Google Play here: https://play.google.com/store/apps/details?id=com.appspot.sw...
Ad networks. Various products from financial institutions. Cryptocurrencies. Heck, even app stores (as a developer, if your app was sold to somebody and Apple/Google’s system was simply broken and somehow they made their cut but you didn’t, how would you even know?).
At a certain point, it sure seems that people rely on popularity as proof of proper functionality (i.e. “lots of people seem to use this just fine” = “nothing can go wrong”). In reality, we should be expecting a lot more: asking harder questions, demanding more proof of activities, expecting extremely reliable support, etc. And frankly, a lot of these things should have open-source implementations to make it even easier to ensure that they work the way they claim to.
So the fraudsters essentially did what Google is best at -- tracking and making 'use' of the information.
Every ad viewed by a bot is one less attempt at adversarially influencing a human against their will.
It probably required tremendous amounts of writing ability, knowing the subject matter, spending hours and hours of research, being familiar with the industry, etc. Doesn't see this much these days. Too bad a lot of journalism died in 2008/2009 when journalists lost their jobs and newspapers were either bought by big players or simply went out of business.
The real problem is using stupid methods to identify real users. This adversarial run is reaching it's end state, and you can't tell apart humans from machines there.
Unsurprisingly, a site owner is heavily incentivized to click on their own ads, or have others click on them, in order to pay themselves. To avoid this the ad server will want to check that the click came from a real human. They can check by IP (e.g. clicks coming from AWS boxes are probably fraud, excessively fast clicks are rejected, etc.); by user activity (monitoring mouse clicks, keyboard entries, dwell time, and a host of other factors); and by statistical measures (is the ad statistically likely to be clicked on by the source, based on e.g. language, prior ad preferences, etc.)
The news article makes it sound like the bot owners are gathering usage data to simulate real human behavior, which they can then pass off as being real human inputs prior to clicking an ad. Of course, one wonders why they don’t just instruct these millions of phones to click on ads directly (e.g. in the background), which would give them access to a huge legitimate pool of IP addresses.
1. Why don't they just show the ads to real users?
2. If the real users don't really get to see the ads, isn't this a win for everyone (except advertisers)?
(I'm not saying I agree with their practices, but just trying to think how they rationalize their moral decisions).
Anyone shed light on this? How does one website use another website's SSL cert?
But will it successfully connect?
2. replace timestamp and userIDs fields on the network requests you will replay with Math.random()
3. Profit!
Seems pretty simple and banal to me.
Isn't this _why_ you'd need domain expertise? Random User IDs would be detectable - a French user suddenly clicking on English ads and following East Coast time would be a red flag.
if I send a bid to google with a random browser id, it will assign a new user on the spot (we wont be lucky to match a valid user as in your example) and all goes on normally.