Hackers Make $5M a Day by Faking 300M Video Views • Hacker News Board

Re: Hackers Make $5M a Day by Faking 300M Video Views

#111

Post by japaw » Tue, Dec 20, 2016, 9:00 PM UTC

yeezyseezy wrote: post #86

nightbrawler wrote: post #59

Earlier quoted context omitted.

Here's an awesome technical writeup about MethBot: http://go.whiteops.com/rs/179-SQE-823/images/WO_Methbot_Oper...

The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

> The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

>

On page 19 in the The Methbot Operation report they state that ‘White Ops detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.’

I have personally never heard about JavaScript reflection before, but it appear to be a debug method for one object to dump information or data about another object.

Maybe the White Ops software loaded some JavaScript that was able to dump much of its environment and send it back to White Ops?

Re: Hackers Make $5M a Day by Faking 300M Video Views

#112

Post by notoriousOIT » Tue, Dec 20, 2016, 9:12 PM UTC

phkahler wrote: post #7

>> those bots "watched" as many as 300 million video ads a day, with an average of $13.04 per faked view. Who on earth pays that kind of price to have someone watch their ad video? Serious question.

It's a CPM man. Not per view.

CPM = Cost Per Thousand Impressions (not views)

Re: Hackers Make $5M a Day by Faking 300M Video Views

#113

Post by notoriousOIT » Tue, Dec 20, 2016, 9:16 PM UTC

intrasight wrote: post #78

I'm not involved in ad tech, but am curious - isn't the easy solution for the advertiser to only show ads on sites that they pre-approve?

They do whitelist. MethBot was faking URLs though so it's hard for platforms to detect that in milliseconds. This goes to the IP level at this point with that list posted online.

Our company is already getting asked to provide full reports by IP address to see how far this goes.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#114

Post by notoriousOIT » Tue, Dec 20, 2016, 9:17 PM UTC

jlebrech wrote: post #61

coming from forbes who are playing 2 videos at once and you don't know which ad you're watching or on which tab it comes from.

Yeah....

The 300x250 un-muted video in the upper left really irks me big time.

Garbage publishers are garbage.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#115

Post by lsv1 » Tue, Dec 20, 2016, 9:44 PM UTC

The article doesn't explain how they made money, you need a relationship with SSPs and Exchanges to make requests and monetize the impression, even if you're just sending firing tracking pixels for creative view or complete, etc.

So how did these people make money? Are they for hire? Did they offer services to spoof the publisher domain and make revenue out of thin air, taking a cut from the pub?

Re: Hackers Make $5M a Day by Faking 300M Video Views

#116

Post by jondubois » Tue, Dec 20, 2016, 10:11 PM UTC

I wouldn't be surprised if someone told me that 95% of all ad clicks are fake.

I think I only clicked on an ad once in the past 10 years; it was because my mouse was about to fall off the edge of the table and, in my moment of panic, I accidentally pressed the left button.

Thankfully, my other hand saved the day with a swift 'Ctrl + W' movement.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#117

Post by intrasight » Tue, Dec 20, 2016, 10:17 PM UTC

notoriousOIT wrote: post #113

intrasight wrote: post #78

I'm not involved in ad tech, but am curious - isn't the easy solution for the advertiser to only show ads on sites that they pre-approve?

They do whitelist. MethBot was faking URLs though so it's hard for platforms to detect that in milliseconds. This goes to the IP level at this point with that list posted online. Our company is already getting asked to provide full reports by IP address to see how far this goes.

Got it. So preventing domain spoofing would solve this problem. Who's job is that?

Re: Hackers Make $5M a Day by Faking 300M Video Views

#118

Post by Lord_Zero » Tue, Dec 20, 2016, 10:31 PM UTC

geocar wrote: post #15

Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to. It was discovered years ago because: * Their IP stack was acting like Linux[1] * Their flash player said "I'm Linux…

I dont suppose I can install that with NPM eh?

Re: Hackers Make $5M a Day by Faking 300M Video Views

#119

Post by ctrl_freak » Tue, Dec 20, 2016, 10:37 PM UTC

lsv1 wrote: post #115

The article doesn't explain how they made money, you need a relationship with SSPs and Exchanges to make requests and monetize the impression, even if you're just sending firing tracking pixels for creative view or complete, etc. So how did these people make money? Are they for hire? Did they offer services to spoof the publisher domain and make revenue out of thin air, taking a cut from the pub?

I'm wondering this too. I used to work at a DSP and we had to deal with a lot of clickfraud. Typically it took the form of: a shady publisher which has somewhat legitimate content and has a relationship with one or more SSPs. Then the publisher goes to "traffic growth" sites like cpmbux.com, and purchases fake traffic. Those fake traffic sites own botnets which they leverage to generate the fake impressions on those publisher's websites. Because there's this separation between the two parties, even if the publisher gets shut down by the SSP for engaging in clickfraud (there's still plausible deniability), the fake traffic site can continue marketing themselves to other not so by-the-book publishers.

I'm not sure if it's a similar arrangement here. The linked report makes it sound like they own the publisher sites too, but it's hard for me to fathom how they could maintain "legitimate" relationships with SSPs when they're funnelling out millions of dollars per day. It goes without saying that it's much harder to fake your way through the financial system.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#120

Post by conductr » Tue, Dec 20, 2016, 11:01 PM UTC

24gttghh wrote: post #108

conductr wrote: post #107

There is some talk of prosecution of these hackers. Does anyone else disagree with that?? Personally, I feel that a publisher of technology is responsible for ensuring there are no "holes". If someone finds a hole and pokes around and uses it for any reason, it should not be criminal. If I found a way to methodically purchase all the pieces to win McDonald's monopoly game, would that be criminal fraud? Or would it be…

By that logic, one could argue shoplifting is permissible if the store doesn't have video cameras on every inch of the establishment.

I see your point. And I know I am basically arguing against active laws. However, I feel it should work different here. You're building a tool that basically says 1) send clicks 2) get paid. That's your tool, nobody made you build it, if you wanted to be safe - find your own clicks. In my view, it's your responsibility to ensure any clicks you pay for are valid. If they are invalid, it amounts to your partner broke the service TOS/AUP. In which case, I see a case for civil damages sure but not criminal.

To counter with another analogy. Robbing a casino, criminal. Counting cards, severely frowned upon but not criminally illegal. When you create a system that users can game to their advantage, you are responsible for enforcing your rules - it doesn't (or shouldn't) make it a crime when your rules are broken.