7 ms·
Two Cybercrime Rings and Eight Defendants Indicted for Digital Advertising Fraud
- JumpCrisscross 8y ago> the FBI executed seizure warrants to sinkhole 23 internet domains Sinkhole?
- AnimalMuppet 8y agoRoute them to nowhere. In particular, route them not to servers controlled by the criminals.
- dsl 8y agoActually they get routed to servers operated by security companies that log incoming connections. This information is then shared with internet providers and corporations to help disinfect the end users machines that are trying to coordinate with the botnet.
- kyleandrew 8y agoInteresting. Do they need a warrant for this? It doesn't sound like it since they mentioned working with "private sector partners."
- tptacek 8y ago> the FBI executed seizure warrants to sinkhole 23 internet domains
- vermilingua 8y agoDo they call up customers telling them their computer has been infected with a virus? I am suddenly terrified that some non-zero percentage of those spam calls may actually be legit, and that I may need to treat every one of them as authentic (until they ask for teamviewer).
- meowface 8y agoYes, you may certainly receive a call or email. I've been on both the sending and receiving end of those while working infosec at different companies.
- imjk 8y agoIt's defined in the second paragraph: "The FBI, working with private sector partners, redirected the internet traffic going to the domains (an action known as “sinkholing”) in order to disrupt and dismantle these botnets."
- inetknght 8y ago> the defendants leased more than 650,000 Internet Protocol (“IP”) addresses That's... a not-insignificant number of IPs to have. I wonder how many different blocks were used and across which RIRs?
- ryan-c 8y agoIt was actually well over 800k. Here's a list - note that many have been reassigned: http://methbot.s3-website-us-east-1.amazonaws.com/IPs-CIDR.txt http://methbot.s3-website-us-east-1.amazonaws.com/IPs-CIDR.t...
- cal5k 8y agoApparently we're in sync around our use of ellipses to simulate dramatic pause.
- deleted 8y ago[deleted]
- _eht 8y agoI am curious if we'll actually see any extradition from any of the involved countries.
- gcb0 8y agoyou mean you want to know if advertising fraud is a crime in those countries and the us agencies will work with the agencies overseas? extradiction is the circus for the media and to please the lynching calling folks, not the justice.
- qaq 8y agoI would imagine Estonia will cooperate as US is pretty much the only reason Russia is not taking it over.
- celticninja 8y agoThat bit will already be sewn up. They would not arrest if they didn't think they could extradite, they would wait until their next holiday and grab them there.
- nyc_pizzadev 8y ago"Ad Network #1 rented more than 1,900 computer servers housed in commercial datacenters in Dallas...spoofing more than 5,000 domains...leased more than 650,000 IP addresses...$7 million in ad fraud" "Ad Network #2 carried out another digital ad fraud scheme...botnet...more than 1.7 million infected computers...download fabricated webpages...$29 million in ad fraud"
- cal5k 8y agoThe most interesting part for me: "Furthermore, the defendants leased more than 650,000 Internet Protocol (“IP”) addresses, assigned multiple IP addresses to each datacenter server, and then fraudulently registered those IP addresses to make it appear that that the datacenter servers were residential computers belonging to individual human internet users who were subscribed to various residential internet service providers." That's... really smart. A lot of companies use services like MaxMind to do this. I wonder how difficult it is to get a GeoIP data correction request approved: https://support.maxmind.com/geoip-data-correction-request/ https://support.maxmind.com/geoip-data-correction-request/
- xfitm3 8y agoGoing back to 2005 or so leasing and announcing entire CIDR prefixes was pretty popular for spammers. A /19 would run you about 8k/m and I assume maxmind updates are included in the cost. I have no citation for this, but SORBS and friends blacklisted /24 by default. If you had enough servers you could send enough email to turn a profit before your /24 was blacklisted. Only until you got to SORBS level 3 was your prefix blocked. Of course they would delist you for 2000/day.
- nradov 8y agoScamming at that level requires so much skill and hard work that you have to wonder why they don't start a legitimate business to make more money with less risk? I suppose for some it's just for the thrill.
- brazzledazzle 8y agoI think because it’s a different type of risk. With your own business the risk is that you fail and don’t make money. With a scam you can make a bunch of money for a long time before the risk of being caught ramps up. You’re quickly (relatively) rewarded instead of agonizing over whether or not you will be.
- cal5k 8y agoWell, they all live in Kazakhstan and Russia. It may not be so easy to convert talent into legitimate business success, particularly when "cybercrime" (god I hate that word) is often encouraged in places like Russia so long as it targets non-Russians.
- gitpusher 8y agoIn my mind, "normal" digital advertising only barely escapes the definition of fraud.
- drb91 8y agoWho doesn’t love to be manipulated constantly?
- honestoHeminway 8y agoGlorry to the Google-toad
- ajsharp 8y agoUsing your malware botnet to click on fake ads and generate 27mln in actual ad rev is pretty damn crafty. Only part I'm unclear on is whether they were actually operating the network/marketplace, or just falsifying the publisher and user parts of it. Sounds like the latter, in which case, I wonder which ad networks got gamed.
- wyqydsyq 8y agoWhat impresses me is that three of them have already been arrested in various countries, I wouldn't have expected such effective international cooperation between intelligence/police services considering the countries they were arrested in aren't exactly closely tied to the US
- celticninja 8y agoAs usual you with russian suspects they wait until they travel outside of Russia and get them then. I imagine the other suspects won't be leaving Russia anytime soon.
- RugnirViking 8y agoThe cynic in me says that this is because they weren't just hurting the interests of the U.S. government - they were hurting the interests of the largest mega-corporations on the planet.
- paulwib 8y agoMaybe not so surprising - Bulgaria and Estonia are both in the EU and Malaysian-US co-operation on security is pretty tight.
- jcampbell1 8y agoThe interesting thing about ad fraud is the people that lose have no ability to police the problem. Ad networks get paid for fraud. Intelligent ad buyers that use cost-per-acquisition targeting, don't care because they just bid lower if the traffic is a mix of fraud. The losers are unsophisticated ad buyers such as the brand advertisers that use ad agencies to fill their ads with garbage traffic. Proctor and Gamble has recently figured that internet display is pretty much worthless. The other losers are legit publishers. I am perfectly happy to pay $0.50 a click with half the traffic being fraud, as I am willing to pay $1.00 a click for legit traffic from legit publishers. I get the same result, buy my money gets split 50/50 between legit publishers and crooks. I am mostly a dev, but have bought more than $1M in advertising on multiple platforms. The biggest joke I have ever seen was AppNexus. It was like 70% or more fraud, and it was the most obvious crap imaginable. For instance, all clicks coming from 8 month old user agents for evergreen browsers. Google Adwords and Double Click have been mostly clean. I'd say 85-90%. I do see stuff that is obvious bullshit from time to time, and it goes away pretty quickly and but Google doesn't refund the money. I don't really care... they make it so we can police it pretty well. Facebook ads are completely clean, but they don't run a network. The simple rule for picking a ad platform is: if it isn't loaded with performance advertisers (CPA), then stay the hell away.
- cosmie 8y agoWhile I agree on the mostly non-existent fraud[1] for ad views on the Facebook, Instagram, and Messenger properties direction, they actually do run a network now[2]. I can't find any information about how it handles ad views when it can't identify the end user. If they don't display an ad then it's likely as robust as the on-property views. But if it shows ads, then it probably introduces the same level of fraud as you see on AdWords. [1] Fraud free doesn't mean bullshit free. They tend to be very liberal with how they calculate billable events from user interactions. [2] https://www.facebook.com/business/marketing/audience-network https://www.facebook.com/business/marketing/audience-network
- DINKDINK 8y ago>Ad networks get paid for fraud Ad networks value proposition is give us money and an ad and your revenue will rise. If there's fraud that just dilutes the effectiveness of the proposition. Eventually poor quality networks die in the same way that the market winnows fertilizer etc. There is no free lunch
- ryan-c 8y agoSome technical details: https://services.google.com/fh/files/blogs/3ve_google_whiteops_whitepaper_final_nov_2018.pdf https://services.google.com/fh/files/blogs/3ve_google_whiteo... (note: I work for White Ops)
- dillondoyle 8y agoBy chance do you know if/where the collected 3ve js code will be published? I'm specifically interested in looking at their js property patching
- ryan-c 8y agoI don't think it's being published. The snippets in the paper were obtained from process memory dumps by folks reversing the malware, so we don't really have a good clean copy - just fragments.
- dillondoyle 8y agoInteresting. Well if it ever gets published would love to see it! We have our own js to help us model 'unique voters reached' and as one piece of fraud reduction toolset (in addition to 3rd party providers). The given example in pdf (maxchannelcount) is actually one piece of entropy we collect. Now I'm thinking through this example,I'm going to try and test for these monkey patched methods (not sure if can do it, but maybe md5(toSting) compare to major browser native hashes?). Sounds like you work for a verification vendor, if so have you had success with detecting these 'monkey patches'?
- ryan-c 8y agoI work for White Ops, which could reasonably be considered a verification vendor, though we prefer to be known as a security company. As you can imagine, specific techniques used for detecting fraudulent monkey patching (or even whether we attempt to do so) aren't generally something I can talk about. That said, there are a few slides about the cat-and-mouse games of .toString() here (starting about page 20): https://rya.nc/shmoo17 https://rya.nc/shmoo17 [PDF] In short, using .toString() will find naive monkey patches, however it can be overridden to varying degrees of cleverness.
- badrabbit 8y agoHaha,this is kovter. It's a slick malware,always found the infection interesting. It's fileless and uses javascript to start mshta which executes powershell from the registry and so on. It was one of my favs, happy-sad they took it down.
- Myrmornis 8y ago> This kind of exploitation undermines confidence in the system, on the part of both companies and their customers,” stated FBI Assistant Director-in-Charge Sweeney. Haha! What on Earth is "the system"?! Did he really say that? Bad criminals spoiling our nice advertising system.
- mrhappyunhappy 8y agoIs there an easy way to check if your computer is compromised and is part of a botnet?
- tgragnato 8y agoIt depends: you need to rely on an IoC to notice a piece of malware. This is typically a signature, a direct communication with a known C2 or a malicious URLs, a hash, ... Beyond the most simple techniques, I'd mention traffic monitoring and analysis (especially traffic flow analysis) and behavioural analysis. However detecting a dormant botnet isn't easy nor simple. e.g.: DARPA (via HACCS) awarded a $1.2m contract to build a system that can automatically pinpoint botnet-infected devices. https://www.fbo.gov/?s=opportunity&mode=form&id=72de4936f6f4d88cc838a624c1157f26&tab=core&_cview=0 https://www.fbo.gov/?s=opportunity&mode=form&id=72de4936f6f4...
- tenaciousDaniel 8y agoThis alert has some info about where the malware is installed. That would be a good place to start: https://www.us-cert.gov/ncas/alerts/TA18-331A https://www.us-cert.gov/ncas/alerts/TA18-331A