5 ms·
Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol d
by geocar 10y ago
Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to.
It was discovered years ago because:
* Their IP stack was acting like Linux[1]
* Their flash player said "I'm Linux"
* Their user agent said other things (random user agents)
* Their DNS traffic was going UK, but the hosts were coming out of the US
[1]: http://geocar.sdf1.org/browser-verification.html http://geocar.sdf1.org/browser-verification.html
- fsaintjacques 10y agoCan we have a spamhaus for ad fraud? * list of botnet infected IPs participating in ad fraud * list of offending/incompetent SSP blindly accepting forged requests
- geocar 10y ago> Can we have a spamhaus for ad fraud? There are a lot of vendors in this space now, offering various kinds of "spamhaus"-type solutions. They're all crap because they operate blacklists of various kinds to keep their customers dependent. The ideal scenario is for ad networks/SSPs to implement the anti-fraud technology themselves, however getting there from here is difficult: The first ad network to go clean will be at a significant (fiscal) disadvantage. I'd like to get in touch with anyone ad network/SSP that wants to go first. > lists of botnet infected IPs participating in ad fraud This won't be enough. A popular "audience extender" is to use an iframe containing your site as an ad tag, and run it on your display network. Unless you have been using an ad blocker for the last ten years (and maybe even then), it's very likely your IP address has been used in ad fraud. > lists of offending/incompetent SSP blindly accepting forged requests Google facilitates an enormous amount of ad fraud, but media buyers have to buy from Google because nobody else sells Google search ads (except, I suppose, the injection people...) Yahoo purchased a company who was selling video ads that were muted using uncommon AS3 mixer controls. I think a much shorter list would be the media suppliers that don't have ad fraud on them and don't facilitate ad fraud. You'll find such a list below.
- bryanrasmussen 10y agoI upvoted you because of your helpful list.
- eis 10y agoHm I can't seem to see any list. Where is it?
- fsaintjacques 10y agoI almost replied like you did; the joke is that there is no such list.
- B1FF_PSUVM 10y ago()
- deleted 10y ago[deleted]
- 0x0 10y agoDo you have any more information about the as3 mixer controls?
- geocar 10y agoSure. var st:SoundTransform = new SoundTransform(1.0); st.leftToLeft = st.leftToRight = 0.0; st.rightToLeft = st.rightToRight = 0.0; SoundMixer.soundTransform = st; Mutes the audio, but if a VPAID component naively checks: SoundMixer.soundTransform.volume they will get 1.0. Most don't even bother checking though.
- kieranr 10y agoI don't understand ad networks enough to grasp how fraudulent ad inventory works, but as this article shows - you can make a killing exploiting it.. As is stands, is there any sort of compliance measure (or regulatory body) to monitor/prevent ad fraud in these networks?
- Eridrus 10y ago> It was discovered years ago And yet they're still active with the same tech stack.
- acveilleux 10y agoThey only have to do the very minimum to recover from detection. The incentive is for them to keep the largest possible bag of tricks ready to deploy every time they get a dip in revenue due to fraud detection to milk the fraud. Besides, most of the countermeasure takes the form of javascript to be executed by the client, since the fraudsters control the client, they can alter the operating environment of the fraud detection as needed.
- geocar 10y agoI don't think that's quite right. When three-letter television companies will buy an audience extender from one of these shady guys rather than tell the advertiser that they don't have as much traffic as they projected, you don't really even need to worry about detection. There exist passive techniques powerful enough to really map these kinds of actors out thoroughly, however the industry has been reticent to stop it because everyone from Viacom to Google has facilitated ad fraud, and there's this fear that stopping things too abruptly will cause advertisers to lose faith in this (still nascent) $60 billion dollar industry (US numbers).
- tlrobinson 10y agoGiven the complexity and quirks of modern browser engines it seems like it should be pretty easy to detect this type of custom "browser".
- geocar 10y agoMost anti-ad fraud vendors can't do the IP packet analysis trick since they use ELB to help control their costs/scale. All the other techniques require JavaScript and/or AS3 and are thus subject to modification by these kinds of sophisticated attackers. The only real way to do JavaScript in these cases is to change it often enough and run enough parallel versions that the attacker cannot keep up.
- baybal2 10y agoAah, they were doing it for the last 10 years or so. People who are serious into botting have software that basicaly runs the browser in a vm. The level of programming skill in the "industrial scale botting" community is high. Top tier botters can easily get into +$100k club if they were doing whitehat stuff.
- hnguy4 10y agoI am a developer with these types of skills, but was mainly testing for a pet project scraping data. What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club?
- baybal2 10y ago>What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club? Bot detection, ad auditing, antifraud systems
- didntt 10y agoI reversed engineered (out of curiosity) the JS/AS code of > 10 solutions of this nature. Wrote bypasses for many (locally, for fun). How do you make whitehat 100K+/day with these skills?
- nightbrawler 10y agoHere's an awesome technical writeup about MethBot: http://go.whiteops.com/rs/179-SQE-823/images/WO_Methbot_Operation_WP.pdf http://go.whiteops.com/rs/179-SQE-823/images/WO_Methbot_Oper...
- yeezyseezy 10y agoThe part that confused me is when they claim to have obtained MethBot source code, but never mention how.
- hnguy4 10y agoYeah was curious about this as well.
- bitexploder 10y agoIn truth they were likely exploiting a vulnerability in MethBot. Similar to XSS only server side. The legality of this, if my suspicion is correct is highly dubious, so they kept the details low key. I imagine somewhere in MethBots virtual DOM emulation they got sloppy and ran code (JS) from the server. Using metaprogramming plus some output they could predict they could use runtime reflection and inspect server side JS object.
- japaw 10y ago> The part that confused me is when they claim to have obtained MethBot source code, but never mention how. > On page 19 in the The Methbot Operation report they state that ‘White Ops detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.’ I have personally never heard about JavaScript reflection before, but it appear to be a debug method for one object to dump information or data about another object. Maybe the White Ops software loaded some JavaScript that was able to dump much of its environment and send it back to White Ops?
- untog 10y ago
- gwu78 10y agoSpeaking of DNS, one of the sdf nameservers you are using is very slow or non-responsive: ns-a.sdf.org It reminds me of ns.cnet.com
- Lord_Zero 10y agoI dont suppose I can install that with NPM eh?