20 ms·
Ad Fraud Scheme Drained Users’ Batteries By Running Hidden Video Ads In Android
- YeahSureWhyNot 8y agoI used to date a girl who had a Galaxy S8 from sprint and that phone had most ridiculous ads like online casino ads, everywhere, even on lock screen.
- distant_hat 8y agoA few years back Lockscreen was identified as one of the most underutilized real estate on the mobile phone. So a lot of phone companies started selling it to the highest bidder. While Samsung shouldn't be needing it, a lot of the lower end Chinese companies make razor thin margins on the phones, even if a company offered $1-3 for pre-installing an always running app that would show ads to users, they'd happily take it.
- sk0g 8y agoI doubt it's the Samsung launcher/ lock screen showing ads though. I remember a particular lock screen I tried out that was great. Functional, beautiful... Except, you know, when it showed an ad on half the lock screen. Yeah, fuck that. But a less tech savvy person might just go "well this is fine, I guess that's just how it is", and live with it.
- haser_au 8y agoThe 'Peel Smart Remote' app came pre-installed on my old Samsung S6, and it did the same thing. Lock screen ads and everything. https://fossbytes.com/peel-remote-use-remove-smart-remote/ https://fossbytes.com/peel-remote-use-remove-smart-remote/ https://www.androidpolice.com/2017/03/29/peel-remote-app-upsets-users-ton-ads-lock-screen-overlays/ https://www.androidpolice.com/2017/03/29/peel-remote-app-ups...
- DrScump 8y agoAnd their app lies about the scope of devices it can control. For example, it won't even warn you if your target device outright lacks an IR port before you install it. Worse yet, check out the permissions it demands: Calendar (!), Contacts (!!), Camera, precise Location, microphone, Bluetooth... even body sensors!
- randomfinn 8y agoThe link is blog spam, original article is at https://www.buzzfeednews.com/article/craigsilverman/in-banner-video-ad-fraud https://www.buzzfeednews.com/article/craigsilverman/in-banne...
- fxfan 8y agoThe verge is not blogspam - its long form tabloid
- dang 8y ago"Blogspam" is more an article attribute than a site attribute. In this case the article was a couple paragraphs lifted from another source, which is usually how people use the term.
- dang 8y agoThanks. Url changed from https://www.theverge.com/2019/3/22/18276542/scam-hidden-video-ads-android-app-drain-batteries-data-cpu-cycles https://www.theverge.com/2019/3/22/18276542/scam-hidden-vide.... Submitters: please read and follow the guidelines. They include: "Please submit the original source. If a post reports on something found on another site, submit the latter." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- occamschainsaw 8y agoSorry about that, will keep it in mind for future posts.
- zamalek 8y agoIt's crazy that ads have reached through point where impressions-without-impressions are lucrative. If I was the type of scumbag to pay large amounts of money for data hungry ads, I'd be furious. But, they don't care? Are ads now just a sunk cost with no ROI analysis? Is it like a gym membership?
- drilldrive 8y agoI think that the issue here is little to no access to a more detailed portfolio of the ads ran on your platform, as you are generally going through a middle-man, which in this case is the scammer by selling to providers on their front than they are paying you for.
- narrator 8y agoI think the issue is that there are lots of number crunchers out there thinking : "Well this ad campaign is profitable when we spend $100 on highly targeted Facebook ads, let's spend $10000... Oh they don't have that many impressions to sell us..." "Where are we going to get all those ad impressions from?" "Shady Bob's affiliate network has millions of impressions to sell us!" "Great. That should work. The sky's the limit on this ad campaign! We're going to be rich!"
- jjeaff 8y agoYou say that as if shady Bob is to be less trusted regarding ad impressions than Facebook. Facebook has untold millions and millions of fake accounts that they are not trying in the least to shutdown. Because they make just as much for an ad served to a bot as they do for a real user.
- rjbwork 8y agoOne of the issues is that there just isn't that many advertiser focused platforms that give the advertisers the data they need to actually do the analysis of that ROI. So they just kind of spray and pray sometimes.
- llukas 8y agoAnother reason to cut all ads alike.
- myth17 8y agoHow are they making money by draining batteries?
- senectus1 8y agothe answer is in the Title of TFA: This Giant Ad Fraud Scheme Drained Users' Batteries And Data By Running Hidden Video Ads In Android Apps
- dang 8y agoThe originally submitted article didn't have that title (see https://news.ycombinator.com/item?id=19459834 https://news.ycombinator.com/item?id=19459834).
- deleted 8y ago[deleted]
- TheIronMark 8y agoThe buzzfeed article goes into more detail, but the short answer is that the fraudsters buy a cheap banner ad in an app. They then resell that space for a higher fee, running a video that is hidden behind the banner ad. Because the video just keeps running, the brand whose ad it is ends up paying even more to the fraudsters.
- deleted 8y ago[deleted]
- Zak 8y agoI am amused that the article detailing a very good reason to use an adblocker asked me to disable mine.
- mirimir 8y agoHey, there are no ad blockers for apps, right? Messing with other apps is a ToS violation for both Google and Apple, as I recall. Edit: OK, you can. But not with other apps from the official stores.
- jjeaff 8y agoOn both, you can block the ads at the DNS level. Not quite as effective, but still workable.
- mirimir 8y agoWhat apps do you use? Or do you mean using pihole or whatever? Edit: OK, I see. Adguard, for example.
- underwater 8y agoBlokada DNS works reasonably well.
- shtam 8y agoYou can with Adguard
- 8y ago
- AngryData 8y agoAdvertising is a scourge upon society.
- kbenson 8y ago> Advertising is a scourge upon society. I understand where you're coming from, but that's painting with a pretty broad brush. Advertising covers everything from the signage stating the name of the mom-and-pop shop on the corner (which is why cities often limit the size of logos/names on building) to billboards on the side of the freeway. It covers movie trailers I seek out ant watch to see what's coming soon to commercials interspaced within a video that interrupts the flow. I hate some of those, but i actively like, or at least value the utility of some of the others. A specific type of advertising has grown outsized that last couple of decades, and it's causing real problems. But let's not paint with too broad a brush just because we're fed up. That's how stupid laws get passed.
- baybal2 8y agoI am more on the position that advertising as a function of product promotion is dying, in all, but the most extreme overkill forms.
- scrollaway 8y agoIs it possible you just don't notice the non-extreme forms anymore, given how extreme the rest is?
- baybal2 8y agoMay well be, but that still means that non-extreme-ads are on the way out...
- scrollaway 8y agoPeople used to really notice when a movie, TV programme or video game was violent. Blood, graphic death, etc. As those things became more common and more extreme, people stopped noticing. Now we don't really talk about it at all anymore. Does that mean non-violent movies and video games are on their way out? (No it does not.)
- philipkiely 8y ago"One of the hallmarks of mania is the rapid rise in the complexity and rates of fraud." -- Michael Burry, The Big Short (Film)
- hrdwdmrbl 8y agoMy first thought is that this is really Google's problem to fix. How is it even possible to do this on Android? Or is this also possible on iOS?
- baybal2 8y agoHow? Google's last secret bastion of defence was a common opengl driver glitch that was checked from well hidden webgl shader code. Even that was said to be cracked in no time. Simple explanation is that people on the other side of adfraud war are the ones getting incomparably bigger money than any ad-fraud specialist hired by ad companies (and they both hire pretty much the same people...) Imagine, the more Google cracks down on it, the bigger is the monetary reward for cracking the protection. I remember reading mid-naughties era Russian computer journals with pics of "advertising specialists" racing off their new Ferraris in Moscow right at the moment it was said a big crackdown was going on.
- EE84M3i 8y agoI'm curious about this "hidden webgl shader code" you're talking about, but only getting google results for this comment. Do you have a reference for this?
- product50 8y agoThis is irrespective of the OS. Basically, on the webview, they are running a downloading and running hidden video with all the trackers going off.
- whalesalad 8y agoNot necessarily. You can’t run wild on iOS.
- product50 8y agoYou can continue to believe that iOS is your temple of all great things and nothing bad can happen there. Or you can wake up and smell the coffee. It has nothing to do with the OS but everything to do with how HTML works on in app browsers.
- dschuetz 8y agoWhy is that even possible to hijack an active ad feed? It implicates that in-app ads are high risk security-wise. I just can't believe how broken the infrastructure for web services actually is, and why the companies doing and serving ads space only act when revenue is at stake. This and many other things are getting out of hand.
- mirimir 8y agoRight. Some ads just serve malware.
- pdkl95 8y agoA lot of people listened to Douglas Crockford when he talked about "The Good Parts"[1] of Javascript. Unfortunately, very few people also listened to his warning[2] than mixing foreign Javascript was insecure by design (only proper trust boundary is the page). [1] http://shop.oreilly.com/product/9780596517748.do http://shop.oreilly.com/product/9780596517748.do [2] https://www.youtube.com/watch?v=qfBL2sc2zUU https://www.youtube.com/watch?v=qfBL2sc2zUU
- product50 8y agoThis is why advertisers flock to Google and Facebook Ads. You can call them a lot of things but ad fraud is something they take very seriously. A view or a click on Facebook video ad is most definitively pointing to the real thing. And just that surety is a good reason to pay some premium.
- radium3d 8y agoGoogle is great but I definitely wouldn't put Facebook ad clicks anywhere near the quality of Google ad clicks.
- product50 8y agoIf anything Facebook's clicks are much more reliable than Google's since Facebook shows almost all its ads on its O&O properties where there is 0 potential for fraud. A lot Google's mobile ads are via AdMob which are shown on third party apps which Google doesn't own - which can lead to scenarios where the publisher may be upto some mischief.
- radium3d 8y agoAdMob is O&O by Google. I would say mischief is doable on both platforms since it is up to the developer to implement either SDK within their apps. This is why it is important to monitor conversion rates and be selective as to which apps your ads appear on. You could select Google's apps only for example.
- yilugurlu 8y agoI guess the advertisers whose video ads run in the background don't care about ad viewability. Most of our advertisers require at least %90 of viewability, big brands. But a still significant amount of them use VAST and don't care about any other measurement. When we ask them to if they have VPAID tags many times they just say no, we only have VAST.
- dillondoyle 8y agoSeems like an impossible arms race though (to fake viewable) plus it looks like this fraud was a VPAID container. VPAID adds a overhead compared to the possibility of a native implemented VAST player. If there was a way to verify & build trust with pubs/networks to run vast tags natively, no JS, I would buy that inventory. Newer vast also has a viewable event, but again is on the pub to specify legitimately hence the verifiable trust. There's a reason FB gets a lot of my $$
- Macha 8y agoBetween players, ad network wrappers, third party service wrappers, creative teams getting the spec wrong, more requests for ad blockers to block etc., VPAID is a mess in terms of successful playback though. It's like developer for early 2000s browsers when you have to test in multiple tools and work around multiple quirks. I can see why advertisers might not want to bother.
- dillondoyle 8y agoI'm with you. I would prefer the much simpler VAST (maybe even change to json lol) with trusted/verifiable publishers. It can be natively implemented and not have to call webviews and all kinds of js bloat! I just dont know how to make that happen. In essence it's what FB offers just using their own internal video delivery platform.
- mrweasel 8y agoI like how the issue of draining the battery is in title. It indicates that the actual fraud aspect is less important, and that the issue that we're really suppose to be upset about is the battery issue. Directing angre towards the advertising is a little weird too, if there was less fraud, then maybe the ad buyers be more critical in regards to which ads they buy and how many they run.
- djhworld 8y agoIt's a three pronged attack. The advertiser who's paying for fraudulent impressions, the user who's battery life is drained, and the app developer who might be getting reports/bad reviews about the app draining battery life
- rizzin 8y agoEmbedded automatically played videos are a scourge upon Internet.
- concerned_user 8y agoAlso amount of ad space on news sites should be regulated, i.e. > 30% of screen space is meaningless pictures/ads/promo - not a news site.
- hannob 8y agoIt is interesting how this article starts. A guy has an app which drains users batteries. But it's not his fault of course, because it's the ad company. Except the ad company says it's not their fault, because the ad came from some other company. This fingerpointing points to one of the core problems of the ad industry: They created a system where nobody knows who's responsible for anything, so malware and fraud has an easy time. But this mode of thinking makes no sense. If you put ads in your app YOU are responsible. If you use an ad service from a shady company that outsources to other shady companies then you're still responsible.
- stestagg 8y agoJust as if you were to buy a child’s toy that has a secret embedded camera that streams to some foreign server. It may be the manufacturers fault, but the person who sold it to you (the provider) is liable. Should be the same here
- rahimnathwani 8y agoRight, and from the POV of the child, the parent is liable.
- bluesign 8y agoLiable is a bit strong word here, liability without fault is mainly rejected concept in modern world.
- rahimnathwani 8y agoIf so, why is the retailer liable but not the parent?
- bluesign 8y agoI think retailer's liability here is also limited. Imagine you are a shop selling cola in can. If coca cola company put some unhealthy stuff in, you are not liable just for selling it. But if you made the stuff unhealthy because you stored it in direct sunlight long time, you are liable.
- Reason077 8y agoIsn’t the real issue here a technical one with MoPub’s ad platform? How is it possible that a banner ad can open hidden off-screen views, and play video ads using a different (fraudulent) publisher ID? Can’t banners be sandboxed in order to prevent such activity, or at least detect it?
- perlgeek 8y agoOr phrased another way, why does a banner need to be anything more than an image, possibly an animated image? Everything else screams of abuse and unnecessary tracking.
- Cthulhu_ 8y agoSimple: Because video ads are more effective, thus providing more sales for whatever's being advertised and more advertising income. Ad companies are trying to find the limit of annoyance vs effectiveness, and despite most people finding video ads and the like annoying, they're proven to be more effective than static ones.
- pbhjpbhj 8y agoThey reason they're annoying is because they distract from the content, which is the reason they're effective, they steal focus. The ad companies aren't trying to find the limit of annoyance vsc effectiveness, they're trying to maximise their profit. They don't care about annoyance, in fact annoyance can actually be positive for brand advertising.
- jefftk 8y ago> why does a banner need to be anything more than an image? Because of exactly situations like this! Say you're an advertiser and you make an image banner. You make a deal with an ad network to show your ad on some pages. Some site makes a deal with the same ad network to show ads on its pages. Your ad is on the publisher page, users are seeing it, everything is good. Now a scummy publisher signs up with this ad network, and sets the ads to display underneath something else. If the ads are just simple images and nothing more, there isn't a way for the advertiser or the ad network to tell that they're being scammed. (Disclosure: I work at Google on making ads declarative so they don't get to do this sort of thing. Speaking for myself and not the company.)
- tobyhinloopen 8y agoTIL Ad fraud is fine, just don't drain our precious batteries?
- TeMPOraL 8y agoGangsters shooting gangsters isn't fine either, but regular people worry mostly about collateral damage.
- foobar_ 8y agoYou know many programmers are the 1% of the internet, in a way. I think almost every programmer has an adblocker. I've been browsing without an adblocker for a while. I really recommend it. You will see scam after scam after scam ... And most people, the 99% who don't use adblockers are falling for all these things.
- Radle 8y ago"Aniview denies any involvement and instead says the platform and banner ads and code, which were created by one of its subsidiaries, were exploited by a malicious, unnamed third party." The Bucket has to stop somewhere...
- phkahler 8y ago“I don’t even think about me being ripped off,” Julien told BuzzFeed News. “All I think about is them damaging the app’s reputation. It can cost money to [a user] and drain his battery. We need more of that attitude in the world. So many companies try to make a buck doing things that ultimately damage their reputation. Once that's gone it's all down hill.
- krn 8y agoI don't mind Google or Facebook showing ads in their own products, because that's the only business model that works at their scale and for what their offer. Imagine the world, in which the access to the most advanced search engine or social network was only available to the people who can afford to pay for it. But I don't support using ad networks in the products that are not big enough to sell them themselves. Firstly, because it makes those products completely dependent on third-parties for their own existence. And secondly, because these products often become proxies for third-party user tracking. Just let me pay for your product, if I like it enough. Otherwise, I will just rely on Blokada[1] to protect me from your unwillingness to find a sustainable business model. [1] https://blokada.org/ https://blokada.org/
- GenericsMotors 8y agoBeen using Blokada since December and it's now a must-have; battery life has improved somewhat as well. I don't even make heavy use of my phone for social media apps, yet have close to 300K ad-related requests blocked since I installed it.
- vanderZwan 8y ago> that's the only business model that works at their scale and for what their offer. Do you have any basis for that claim? Because my impression is that historically there have been and are plenty of other businesses at their scale that did/do not need this at all.
- einrealist 8y agoThere is an interesting podcast about ad fraud and different schemes, on Software Engineering Daily. https://softwareengineeringdaily.com/2019/03/12/ad-fraud-engineering-with-praneet-sharma-and-shailin-dhar/ https://softwareengineeringdaily.com/2019/03/12/ad-fraud-eng...
- howard941 8y agoOn unmolested Android an app running in the background causes the o/s to display an un-closable icon in the notification bar, according to google so as to help users avoid getting into these background battery-draining situations. This doesn't absolve the app writer from deploying what's essentially badly-behaving fraudware.
- sucrose 8y ago> He also acknowledged removing the photos and names of people, including his cofounder, Tal Melenboim, from Aniview’s website after being contacted by BuzzFeed News. Streisand Effect. Archived version of their "Team" page: https://web.archive.org/web/20171004134601/http://www.aniview.com/about/ https://web.archive.org/web/20171004134601/http://www.anivie...
- cwkoss 8y agoWould be great if ad networks would stop letting random companies embed whatever js they want. There is no reason a banner ad should have this capability. Twitter's MoPub is showing their negligent greed. That being said, draining video ads budgets is probably a pro-social 'Robin Hood' kind of theft.
- ChuckMcM 8y agoFrom the article -- which will see more than $20 billion stolen this year. Think about the number in that article for a minute, $20 BILLION dollars "stolen" last YEAR. How many places are there in the world where you can steal over a billion dollars from them, and they won't hunt you down and kill your family? A nation-state? Nope they will send their intelligence service after you. A drug cartel? Don't even get me started, this is the same scale of numbers that drug cartels earn[1] And since there is no "War on Ad Fraudsters", no departments dedicated to hunting down and arresting 'kingpin' Ad hackers, why would you sell drugs when you can make about the same amount, so much more safely? When you figure all the expenses you don't need, the bribes, the security forces, the underground tunnels, even going out and acquiring product. This is so much better way to stealing money. [1] the estimate, from the Justice Department, that Colombian and Mexican cartels reap $18 billion to $39 billion from drug sales in the United States each year. --- https://www.nytimes.com/2012/06/17/magazine/how-a-mexican-drug-cartel-makes-its-billions.html https://www.nytimes.com/2012/06/17/magazine/how-a-mexican-dr...
- stingraycharles 8y agoKeep in mind that it’s primarily the publishers that are hurt by this. Advertisers typically determine what they’re willing to spend on inventory based on the ROI, which is decreased by ad fraud. As such, the inventory of “genuine” publishers is devalued as well. Note that in this sense, a publisher can be both a powerhouse like FB or Google, or also smaller outlets.
- ChuckMcM 8y agoI completely agree, it is perhaps the greatest source of Google's CPC erosion over the past decade. But the tools available to go after these folks are limited.
- h1rschnas3 8y agoOne more reason to use AdGuard on Android.