Hackers Make $5M a Day by Faking 300M Video Views • Hacker News Board

Re: Hackers Make $5M a Day by Faking 300M Video Views

#121

Post by kelvin0 » Tue, Dec 20, 2016, 11:26 PM UTC

jstandard wrote: post #101

kuschku wrote: post #81

Earlier quoted context omitted.

> In the end, what actual change do you think would be enacted by companies who wish to advertise their products being the victim of fraud? They stop advertising through the web, and we can get rid of the ad-driven startup bubble, and get rid of most ads on the web in general.

I often see the argument that we should "get rid of most ads on the web in general", but have yet to see a reasonable proposal for what replaces that in a way that works for companies wanting to reach consumers with their products. To play devil's advocate, it would be a huge loss to society if advertisements were no longer viable due to constant fraud. Information would flow a lot less freely because then content pr…

I agree, Ads in theory do help connect people or businesses to services and products they might need/want ...

But, it becomes a race to the bottom, and it is to be expected that every business will want more eyeballs on its products and try to outdo their competitors. The collateral damage of this advertisement frenzy is with people who are bombarded and overstimulated by product placement and a relentless marketing machine. Consumers become skeptic and dulled by the efforts and advertising becomes the pain in the a it is now.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#122

Post by didntt » Wed, Dec 21, 2016, 1:03 AM UTC

baybal2 wrote: post #103

hnguy4 wrote: post #91

Earlier quoted context omitted.

I am a developer with these types of skills, but was mainly testing for a pet project scraping data. What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club?

>What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club? Bot detection, ad auditing, antifraud systems

I reversed engineered (out of curiosity) the JS/AS code of > 10 solutions of this nature. Wrote bypasses for many (locally, for fun). How do you make whitehat 100K+/day with these skills?

Re: Hackers Make $5M a Day by Faking 300M Video Views

#123

Post by didntt » Wed, Dec 21, 2016, 1:09 AM UTC

geocar wrote: post #37

fsaintjacques wrote: post #29

Earlier quoted context omitted.

Can we have a spamhaus for ad fraud? * list of botnet infected IPs participating in ad fraud * list of offending/incompetent SSP blindly accepting forged requests

> Can we have a spamhaus for ad fraud? There are a lot of vendors in this space now, offering various kinds of "spamhaus"-type solutions. They're all crap because they operate blacklists of various kinds to keep their customers dependent. The ideal scenario is for ad networks/SSPs to implement the anti-fraud technology themselves, however getting there from here is difficult: The first ad network to go clean will be…

>Yahoo purchased a company who was selling video ads that were muted using uncommon AS3 mixer controls.

Thanks for the code above. What was the company name? never heard of it.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#124

Post by codeddesign » Wed, Dec 21, 2016, 1:15 AM UTC

baybal2 wrote: post #103

hnguy4 wrote: post #91

Earlier quoted context omitted.

I am a developer with these types of skills, but was mainly testing for a pet project scraping data. What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club?

>What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club? Bot detection, ad auditing, antifraud systems

Absolutely. As a lead dev for a video ad company, I can tell you that we pay big money for skilled security and anti fraud guys.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#125

Post by bitexploder » Wed, Dec 21, 2016, 2:29 AM UTC

hnguy4 wrote: post #90

yeezyseezy wrote: post #86

Earlier quoted context omitted.

The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

Yeah was curious about this as well.

In truth they were likely exploiting a vulnerability in MethBot. Similar to XSS only server side. The legality of this, if my suspicion is correct is highly dubious, so they kept the details low key.

I imagine somewhere in MethBots virtual DOM emulation they got sloppy and ran code (JS) from the server. Using metaprogramming plus some output they could predict they could use runtime reflection and inspect server side JS object.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#126

Post by untog » Wed, Dec 21, 2016, 3:56 AM UTC

japaw wrote: post #111

yeezyseezy wrote: post #86

Earlier quoted context omitted.

The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

> The part that confused me is when they claim to have obtained MethBot source code, but never mention how. > On page 19 in the The Methbot Operation report they state that ‘White Ops detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.’ I have personally never heard about JavaScript reflection before, but it appear…

I don't know more than anyone else about this particular situation, but I can imagine how JS reflection works. Something like:

    let test = function() { return "hello";}
    test.toString()

returns

    "function() { return "hello";}"

It's not too difficult to imagine that pairing that with some JS parsing would allow you to slowly crawl your way around an app and gather the app structure. Crazy, and fascinating idea.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#127

Post by downandout » Wed, Dec 21, 2016, 4:23 AM UTC

They actually got some of this article wrong. These guys didn't create 6,000 domains. They spoofed 6,000 different premium domains in the referer that they sent to the ad networks. A list of the fake referrers they had their bot send is here [1] and the domains are here [2]. They didn't own these domains; they simply told their bot to use one of the 250K or so URLs on one of these 6K premium domains (including domains like nbc.com, nytimes.com, etc) as the referrer, which is set by the browser.

The more concerning part is that it didn't raise any red flags on the ad exchanges that some random corporation was getting paid to display ads on nbc.com and nytimes.com etc. That part makes no sense to me. They also managed to purchase blocks of IPV4 addresses in the names of major residential ISPs such as Comcast. That part had to be an inside job.

[1] http://methbot.s3-website-us-east-1.amazonaws.com/URLs.txt

[2] http://methbot.s3-website-us-east-1.amazonaws.com/domains.tx...

Re: Hackers Make $5M a Day by Faking 300M Video Views

#128

Post by jstandard » Wed, Dec 21, 2016, 5:37 AM UTC

kelvin0 wrote: post #121

jstandard wrote: post #101

Earlier quoted context omitted.

I often see the argument that we should "get rid of most ads on the web in general", but have yet to see a reasonable proposal for what replaces that in a way that works for companies wanting to reach consumers with their products. To play devil's advocate, it would be a huge loss to society if advertisements were no longer viable due to constant fraud. Information would flow a lot less freely because then content pr…

I agree, Ads in theory do help connect people or businesses to services and products they might need/want ... But, it becomes a race to the bottom, and it is to be expected that every business will want more eyeballs on its products and try to outdo their competitors. The collateral damage of this advertisement frenzy is with people who are bombarded and overstimulated by product placement and a relentless marketing…

It isn't just in theory but also in practice do ads connect people with products. Actual transactions are happening from real people clicking ads and companies are realizing real returns on marketing dollars spent.

"Getting rid of most online ads" doesn't remove a business' need to connect with consumers in the most effective, lowest cost way possible. It also doesn't change a news agency's need to get paid for the content it creates.

I'm not disputing that digital advertising can get out of hand. Malicious ads are bad. Ads with dark UX patterns are bad. We likely have different definitions of "bad ads".

However, if it's the number of ads you're concerned about, you generally have a choice to pay to remove them to continue consuming the content you're interested in or product which you are using.

I still don't see how your original comment about criminals defrauding businesses out of their money and inflating the cost/risk of advertising somehow puts everyone in a better place.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#129

Post by kuschku » Wed, Dec 21, 2016, 8:58 AM UTC

jstandard wrote: post #128

kelvin0 wrote: post #121

Earlier quoted context omitted.

I agree, Ads in theory do help connect people or businesses to services and products they might need/want ... But, it becomes a race to the bottom, and it is to be expected that every business will want more eyeballs on its products and try to outdo their competitors. The collateral damage of this advertisement frenzy is with people who are bombarded and overstimulated by product placement and a relentless marketing…

It isn't just in theory but also in practice do ads connect people with products. Actual transactions are happening from real people clicking ads and companies are realizing real returns on marketing dollars spent. "Getting rid of most online ads" doesn't remove a business' need to connect with consumers in the most effective, lowest cost way possible. It also doesn't change a news agency's need to get paid for the c…

What actual purpose do ads fulfill?

Do they help you in making any decision in what to buy? No, they just mislead you, because you don't end up buying the best product, but the one that spent the most marketing dollars, meaning the product where the price is inflated the most (as, ifthey didn't pay for marketing, you could have gotten it cheaper).

Instead, you should make your decisions on what to buy based on independent product tests.

Such as the tests from Stiftung Warentest — subscribing to their tests is the best decision you could do, as they constantly test all types of products in comparison tests, you get the results in a nice readable matrix per category, and can directly see which is the best product for your use case. (Same with similar tests in other newspapers, comparing a hundred different types of headphones, or child seats for the car, or banana juices, etc).

Advertising is harmful because it means the market is not a well-working free market anymore, as the buyers don't buy the best product anynore, but the one with the highest marketing budget.

Re: Hackers Make $5M a Day by Faking 300M Video Views

#130

Post by geocar » Wed, Dec 21, 2016, 9:05 AM UTC

untog wrote: post #126

japaw wrote: post #111

Earlier quoted context omitted.

> The part that confused me is when they claim to have obtained MethBot source code, but never mention how. > On page 19 in the The Methbot Operation report they state that ‘White Ops detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.’ I have personally never heard about JavaScript reflection before, but it appear…

I don't know more than anyone else about this particular situation, but I can imagine how JS reflection works. Something like: let test = function() { return "hello";} test.toString() returns "function() { return "hello";}" It's not too difficult to imagine that pairing that with some JS parsing would allow you to slowly crawl your way around an app and gather the app structure. Crazy, and fascinating idea.

If WhiteOps did that, they didn't need to. A nodejs vm escape was sufficient to get process.mainModule.require and from there, it's game over.