xSwag

Surely it should ask for his consent prior to doing so?

With CPA + FB traffic on such a large scale, one could easy make $50k+ in a week with multiple CPA networks.

Yup. http://news.ycombinator.com/unban?ip=ipaddress

I'm always happy to see that none of you guys participated in this whole fake views fiasco but there are a few things that need to be mentioned about this.

-Earlier this year a flaw was discovered in the mobile section of the site which provided videos through rtsp. Unlike the main desktop version of the site, the mobile section did not record individual IP addresses per view. For example someone could rent a VPS (gigabit connection) and keep hitting the url for the rtsp stream and +1 the view every time. You didn't even have to download/stream the video fully, just send it a GET request.

-Upon discovering this various services such as ViewTornado popped up, the "hack" was only shared by a few people at the time who dominated the "most viewed" section of Youtube for a few week and gained a lot of subscribers, which was the only way to make money [1].

-After the glitch was released on various public blackhat forums everybody had access to it, for a few days there was a lot of disruption with the mobile section of youtube (indirect ddos).

To combat this Youtube has added additional protection. There were also other glitches that affected the desktop version of the website which have now also been patched. Furthermore, if you analyse Youtube http packets you will see that every few seconds it makes a request to the youtube servers while you watch a video. This is done to prevent "botting" and to better evaluate viewer engagement (eg how long the viewer watched the video before closing). Apparently, this statistic now also a vital component in the ranking of the videos.

[1] Contrary to popular HN belief, fake views did not directly generate revenue for the culprits. However, the popularity gained from the fake views (front page features, most viewed today etc) did generate a fair amount of revenue and exposure for the culprits.

What? Using tor to run botnets is nothing new[1]

Edit: Apparently it's the same guy...[2]

[1] http://www.reddit.com/r/IAmA/comments/sq7cy/iama_a_malware_c...

[2] http://threatpost.com/en_us/blogs/tor-powered-botnet-linked-...

Full disclosure: I frequent private "blackhat" forums and although I do not participate in these activities, I blog about them anonymously. Furthermore, I know a few people (online) who do stuff similar to this with CPA content lockers, so I'll try and give you an educated guess. In general the average conversion rate in the TV show/live content is around 0.5-3% depending on the quality of traffic.

Now, as you can see from Google Trends[1] some of these get very popular and trend once pretty much every year. In the second comparison, I've compared the search terms with a term I know is definitely popular to get relative popularity of the terms [2]. Comparing these two terms I can get an idea of the amount of traffic these website would get in the time period. I would estimate that the "big spammers" would easily get around 250k-500k uniques from multiple sources (spamming, mass advertising, social media, botnets etc).

Assuming they get paid $2 every signup, and have a conversion rate of 1.5% with 300k uniques, it would bank them around $9k, of course I'm only talking about the big guys here who have done this for a long time.

In general, I would say that the following is correct:

Upper quartile average: $1-3k per day for a few days

Lower quartile average: $50-60 per day for a few days

Quick edit: It should also be noted that for these live games over 95% of the traffic will be from the USA hence the large profits.

---------

[1]http://www.google.com/trends/explore#q=Iowa%20vs%20Michigan%...

[2]http://www.google.com/trends/explore#q=Iowa%20vs%20Michigan%...

>I still do not understand how it makes them money

When I saw this post the page had 404d. However, the page was still active in the Google cache[1]

It is not just Github being targeted, a lot of other large websites with user generated content are also being spammed with this content[2][3]

The spammers are linking the content to blogspot blogs so that they can: 1. hide the referrer from their affiliate program (to prevent getting banned for spamming) 2. to utilize the temp increase in search engine rankings 3. save money on domains for one-off usage

Since the "live stream" is just a one-off game that will only be popular/trending for 1-3 days in which period the spammers will use a lot of macro scripts/bots to spam these websites. Believe it or not, even a "nofollow" link can give you an advantage in search rankings. They spam them to death in the "popular period" and then bank money from the affiliate program[4]

[1]http://webcache.googleusercontent.com/search?q=cache%3Ahttps... [2]http://shine.yahoo.com/author-blog-posts/watch-38-enjoy-flor... [3]http://webcache.googleusercontent.com/search?q=cache%3Awww.f... [4]http://www.officialtvstream.com.es/passport/signup.php?price...

>Because nobody had taken the time to reverse engineer it

You can very easily get the raw file using Wireshark. Ever heard of protocol analysis? You don't need to reverse engineer anything to get the file.

Also, just as an additional note: it is not just Russia doing this. Countries where extradition is not an option generally tend to have the largest amount of cyber crime. The list includes China[1], Germany[4], Russia, Japan[3] and France[2]. People in these countries generally target Americans, since USA has the second largest amount of internet users (245,203,319) [5] and has one of the highest GDP in the world[6]. Recently a security firm investigated a Facebook virus called KoobFace and found out its Russian authors, however, they were unable to prosecute them due to Russian Laws[7]

[1]http://www.gov.cn/english/laws/2005-09/22/content_68710.htm

[2]http://www.legifrance.gouv.fr/content/download/1958/13719/ve...

[3]http://www.moj.go.jp/ENGLISH/information/loe-01.html

[4]http://www.gesetze-im-internet.de/englisch_gg/englisch_gg.ht...

[5]http://www.internetworldstats.com/list2.htm

[6]http://exploredia.com/list-of-countries-by-gdp-2012/

[7]http://nakedsecurity.sophos.com/koobface/

Nope all over this article.

>If you want to buy a botnet, it'll cost you somewhere in the region of $700

Very vague.

>ZeuS source code: $200-$500

Nope, total bullshit. It is widely available. [1]

>SOCKS bot (to get around firewalls): $100

Nope. "Socks bot" refers to the ability to convert an infected computer into a SOCKSv5 proxy

>Unintelligent exploit bundle: $25

This refers to exploit packs, which is obfuscated software sold on these boards that contain unpatched 0day exploits. Exploit packs are worthless after a week, unless updated since all the vulnerabilities (apart from Java[2]). They're available for free.

[1]http://www.multiupload.co.uk/P8QUNF4YJN

[2]http://www.theregister.co.uk/2012/08/30/oracle_knew_about_fl...

Just guessed the domain name, since they won't be using .com or .net anymore: http://me.ga/ redirects to that page, I hope that is the domain that they use since its pretty short.

Did you not do your a-levels? Why not try an access course? Surely this is not the position you would like to be in? For university, the only subject you really need for CompSci/IT courses is Mathematics (+further maths for oxbridge/imperial/warwick). Why don't you do that? It will help you learn fundamentals + land you much better jobs

3.2M now, never seen it so high.

Yeah, now that I think about it, this is probably the best way to go about doing this since I did spend a fair amount of my time building the website.

If you don't mind, I would be very much interested in what the profit margin was on these sales. In addition, what was the procedure of contacting and collaborating with the manufacturers?

Similar story here, although I'm happy I got had this unpleasant experience with my first big website and learnt not to use them ever again.

This was my first website, over 2 years it had around 80M impressions and then suddenly, one day, everything gone. I was actually planning to drop out of school to continue with it as I had days where I was making $500-600 per day. Took a critical hit and the site actually fell through due to it. Fortunately, it happened before I dropped out and I'm happy about that, I try to avoid all ad networks now and try for private sponsors.

Anybody know how much? Congrats!

Nothing new, a worm similar to this called LilyJade got a few million installs (using crossrider - a cross-browser extension thing) by spamming users facebook effectively bypassing csrf because they can read the webpage and spreading itself and banking the spammers a few hundread thousand dollars with CPA (survey scams - "please do this survey to unlock the content")

setu.ps

Joeycfan, buddy, you've been hellbanned for almost 1,000 days ever since your comment here: http://news.ycombinator.com/item?id=1000770

Logout and refresh the page, you will not see your comment here

Quick translation from Gizmodo[1]:

"We have hacked you because your lack of support of Syrian government and militant groups backed by that government. Al Jazeera has been spreading lies. We're compelled to do so on behalf of the Syrian people."

[1]http://gizmodo.com/5940345/al+jazeera-gets-the-crap-hacked-o...

I checked the source, it just contains an image embed, no exploit kits. Nothing to worry about!

Did they "pwn" the servers or change the DNS?

I'm tempted to get some tickets because I've always wondered what RMS talks are like, I'd imagine that they'd be rather critical but I wonder how the audience generally reacts to his somewhat controversial views

I don't think that HTTP headers are enough and feel that setting csrf tokens is the best approach to this. My reasoning behind this is that there are a lot of privacy plugins[1] that people use that interfere with the headers and using referer header is even worse because a lot of websites have redirection vulnerabilities eg if you want to be returned to the page you were at after logging into a website the url would be something like login.php?url=/page/id , a lot of websites do not sanatize this which would render this useless. It is also not an option for some websites that must have a function like this, a prime example of this is Youtube[2] which uses csrf token (hidden fields) in forms to mitigate this issue.

[1] - http://www.ghostery.com [2] - http://www.youtube.com/redirect?q=http://youtube.com/page

I would be very much interested in this. Infact, I wouldn't even mind paying a fee as long as your tutorials are more interesting then what I would read in a high level book

Essentially a million dollar company in two years, impressive!

Mandatory signup is enabled because the website is aimed towards the not so well known lets players as it helps them get noticed, the concept of the website is the users follow games as opposed to one person playing one video game. Users need to be following games to have content in their feed. Also, the website is currently in beta stage where features are still being added and bugs are still being fixed (its essentially a MVP) which is why its not yet opened or advertised to the general public. Furthermore, its also to reduce load as its currently on a very low spec server.

The only place I mentioned the website is /r/letsplay. You can see the thread here: http://www.reddit.com/r/letsplay/comments/xptph/hey_rletspla...

While OPs statement might apply to single player video games where there is just one generic campaign. I feel the need to mention that this is not the case with all games, specially sandbox games such as Minecraft and multiplayer games such as Starcraft and Call of Duty along with a ton of other games.

Let's Play videos are great for the gaming industry, specially indie game developers. For example, Minecrafts success was partially due to all the Lets Play videos that were created on Youtube. Its essentially free publicity for video games. The prime example of this would be Seananners[1] who made a video that currently has 1.5M views. In addition, Lets Play videos allow players to preview the game before they buy it to get to know the game and see if its worth purchasing. A trailer is not always enough.

Disclaimer: I launched a website dedicated to Lets Plays 2 days ago (http://commentato.rs)

[1]http://www.youtube.com/watch?v=3bAMaNYrJ4o

The kudos thing looks similar to the one used in the svbtle network