Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fraudulent Advertising on Facebook

medium.com

Post reply on HN
Print view View original

21–30 of 100 posts

Re: Fraudulent Advertising on Facebook

#21

Post by DrScump »

Oh, and it gets worse in the shameless-clickbait category.

I've see frequently (and have documented) numerous cases of ads implying that a famous person has died (e.g. Sly Stallone, The Rock, Lamar Odom, Colin Kaepernick), luring clicks for details.

But what really disgusts me is the "Suggested Post" mechanism. In the past week alone, I've had "Suggested Posts" from people selling obviously counterfeit merchandise and sites that claim to be the "Official NHL/NBA/MLB Store", when they are not. And these include plain text that should be simple to parse and check, if they cared. (A more complicated strategy to catch is when the bogus claims are only in text within the ad image, like the oft-posted phony Ray-Ban Official Site.)

And Facebook (and especially the ad network who made the ad) makes money for every sucker served.

Re: Fraudulent Advertising on Facebook

#22

Post by DrScump »

shivsta wrote: post #20
Lxr wrote: post #11

Earlier quoted context omitted.

Facebook is already getting their own data from clicks, why support competitors' data-gathering services?

If they don't support it, advertisers won't use the platform

That assumes, of course, that the underlying paying customer is even aware how the network is luring its clicks.

Re: Fraudulent Advertising on Facebook

#23

Post by mevile »

GeneralMayhem wrote: post #8
davedx wrote: post #7

Earlier quoted context omitted.

He clearly states that security is about raising the bar as high as you can. You can't build a bulletproof system, but you can make systems that are not trivial to game.

Redirecting based on client IP is trivial for anyone with sufficient resources to have put together that ESPN clone in the first place.

Facebook could obviously detect the HTTP redirect.

Re: Fraudulent Advertising on Facebook

#24

Post by raverbashing »

Animats wrote: post #5
Lxr wrote: post #2

Why is there even a separate field for "Display Link", is there a reason this can't be parsed from the actual URL (like HN)?

Because the actual URL is often some metrics or ad-billing service which is supposed to redirect to the target. This is quite common on Google as well as on Facebook.

Then the possible check would be simply for FB to follow the original link and see if it matches the display link after the redirect from the tracker

But of course they won't do that.

Re: Fraudulent Advertising on Facebook

#27

Post by radicalbyte »

madeofpalk wrote: post #13
sleazebreeze wrote: post #4

Considering that Facebook lets you set the display domain separately from the actual link domain, this behavior seems entirely intentional. Convincing people to click on ads (by lying wholesale, in this case) is a crucial element of Facebook's business model. This does seem like they're trading long-term trust for short-term profits - users will click on fewer and fewer sponsored posts as the number of deceitful post…

I think the case for this is to be robust for the many legitimate ways that online marketers use ads and create landing pages. Often marketing platforms (like Hubspot or whatever) lets you create multiple landing pages which might all be on a subdomain(s) to rather than handing full control of the root domain to the platform. In these cases, you wouldn't want pages.ctvnews.com to appear as the display domain. Also no…

I think you're right.

It looks like Facebook host a lot of ads themselves, so I guess that advertisers use URL shorteners as a way to verify click throughs from Facebook.

For unsophisticated advertisers (i.e. with no referrer log analysis) I guess it's pretty easy and effective.

Re: Fraudulent Advertising on Facebook

#29

Post by legulere »

GeneralMayhem wrote: post #6

Not to defend Facebook for not doing their due diligence, but this article is really underselling the complexity of the problem. The pseudocode given: if (display_domain == landing_page_domain) { approve_ad = true; }else{ approve_ad = false; } is, for one thing, not robust against cloaking (if malicious advertisers see the request coming from a Facebook IP, they might actually redirect to the displayed domain).

Like you say it could be circumvented, but facebook doesn't try even that (the blog author tried it himself/herself and didn't need any circumvention techniques)
Post reply on HN