How a Massive Ad Fraud Scheme Exploited Android Phones to Steal Millions

It's a known fact that the digital advertising industry is rifled with lies and overpromised goals. Everyone knows it, or at least suspects it, but there doesn't seem to be a way out. One third of web traffic is fraudulent. Google tries to track it and remove it from the bottom line but what the rest of the industry does is uncertain.

As for your conclusion you can see it another way. If fraud disappears perhaps ads efficiency rates would also drop. Because ad fraud isn't only about ads that never show to their indented audience. A lot of times is about fraudulent clicks. So while you think your ad had a 2% CTR in reality it could be half that. You can never know who actually clicks on your ads. What you can know and measure is the conversion, aka how many actually bought your product. But if your product isn't sold online, like say packaged consumer products which are sold in super markets and all you aim with advertising is brand awareness you can't even track that. So you're siphoning millions to a black hole and you just pray that your analytics data are correct. Chances are, they aren't but no one will bother telling you. So eventually you might start seeing less ads because companies will realize there's no reason to keep their budgets at current levels.

And then there is the fact that there are a lot of actors involved in fraud, either directly or indirectly. Take video ads for example which have a higher CPM. It's in the platform's interest, aka the publisher, to produce as much views as possible to pocket the money. It's not like the fraud is performed from some shady character who lives in the underground. A lot of the times it's the networks themselves who will try to rob clients from their money.

Bottom line, there are a lot of angles to this issue.

Based on the article it seems to be pure software emulating interaction between the apps and i guess the APIs.

1. record all network interaction going out of your MRAID adapter, from your few, actual users.

2. replace timestamp and userIDs fields on the network requests you will replay with Math.random()

3. Profit!

Seems pretty simple and banal to me.

#2 is true but not exactly for the reason you specify, basically every company I've ever dealt with has an advertising budget, they spend it and they monitor how much they spend and how sales change based on that (and ad types and ad channels etc). If you have ever seen an advertisement for a Data Scientist at an online retailer this is what they will do, day in and day out.

As long as the revenue gain (and resulting margin) is more than the advertising spend, it is a winning strategy. Meanwhile, every ad network has a 'beta' value which is the ratio of ad spend to revenue increase, ad networks with a low beta either have more fraud or they are hitting the wrong demographic, either way dollars are shifted away from that network to one with a higher beta.

A simple ad system shows an ad in an app or page, and when you click on it, sends a request off to the ad server which causes some ad credit (money) to change hands - the advertised company gets charged for a click, intermediaries get a cut, and the app or site owner gets their share.

Unsurprisingly, a site owner is heavily incentivized to click on their own ads, or have others click on them, in order to pay themselves. To avoid this the ad server will want to check that the click came from a real human. They can check by IP (e.g. clicks coming from AWS boxes are probably fraud, excessively fast clicks are rejected, etc.); by user activity (monitoring mouse clicks, keyboard entries, dwell time, and a host of other factors); and by statistical measures (is the ad statistically likely to be clicked on by the source, based on e.g. language, prior ad preferences, etc.)

The news article makes it sound like the bot owners are gathering usage data to simulate real human behavior, which they can then pass off as being real human inputs prior to clicking an ad. Of course, one wonders why they don’t just instruct these millions of phones to click on ads directly (e.g. in the background), which would give them access to a huge legitimate pool of IP addresses.