6 ms·

I assume it will be a cost benefit analysis for unfortunate victims.

by notlukesky 7y ago

stri8ed 7y ago
Putting up a captcha would be another option.
- gruez 7y ago
  captcha on what, the site? since there's basically nothing authenticating the site to the adsense iframe/script, can't the attacker serve a cached version locally?
  - stri8ed 7y ago
    Are you sure there is no authentication? https://www.seroundtable.com/google-adsense-verify-sites-26596.html https://www.seroundtable.com/google-adsense-verify-sites-265...
    - throwaway2048 7y ago
      That has nothing to do with the discussion at hand, and would do nothing to prevent a malicious ad clickbot
      - stri8ed 7y ago
        To actually enforce the policy described in that link, would require authenticating websites when rendering ads. Otherwise, one could just embed an ad from a different domain, and easily defeat this process.
        gruez 7y ago
        I'm not sure why the parent (throwaway2048) is getting downvoted over this. He's correct. The attack is as follows: You want to attack (send fake traffic to) example.com, but example.com has implemented a captcha system (think cloudflare interstitial). If you directed your bots to visit example.com, they'd have to solve the captcha to view the ads. However, there's nothing stopping you from solving the captcha once, getting the page source, and serving that to your bots. This works because example.com doesn't serve any ads directly, it only embeds a <script> or <iframe> element to adsense. Since the bots are under your control, it's trivial to set up the redirection (eg. hosts file or HTTP proxy). HTTPS isn't a problem either because you can MITMing yourself with a self signed certificate, which is not a problem either as you can get your bots to trust that certificate. From the perspective of the adsense script, it's impossible to tell whether the bot is visiting the real example.com or a fake version, since the browser is under the attacker's control. The only way to mitigate this attack would be some sort of one time use token that's generated server-side by example.com, and authenticated by adsense each time it tries to display an ad, which I doubt adsense supports.
        thrwaway69 7y ago
        One solution could be some sort of DRM based device attached ad...but that will cause other problems.
- lexicality 7y ago
  "Nearly there - just complete this captcha to see our advert!"
  - stri8ed 7y ago
    I mean on the page content. Using something like Google's Recaptcha would reduce friction for legit users.
    - throwaway2048 7y ago
      How would it "reduce friction for legit users"
    - rbritton 7y ago
      I think there was a time that was true. Now reCAPTCHA is so prone to tagging someone as a bot if they employ any ad blocking or tracking prevention that it significantly interferes with web use. It's an overall harm to the web in my opinion.
    - pier25 7y ago
      AFAIK attackers only need to actually access your content once and extract the ad embed. Please correct me if I'm wrong.
  - pcr0 7y ago
    I think parent comment meant putting up a captcha on the website for suspicious traffic, the way Cloudflare does. I don't think anyone is silly enough to suggest putting captchas on ads.
tmpz22 7y ago
It's ok Google setup a form to communicate with AdSense partners. > “We have a help center on our website with tips for AdSense publishers on sabotage,” the statement continues. “There’s also a form we provide for publishers to contact us if they believe they are the victims of sabotage. We encourage publishers to disengage from any communication or further action with parties that signal that they will drive invalid traffic to their web properties. If there are concerns about invalid traffic, they should communicate that to us, and our Ad Traffic Quality team will monitor and evaluate their accounts as needed.”
- duxup 7y ago
  I wonder, has anyone contacted Google and somehow avoided getting banned? Google seems to show no outward no interest in actually unbanning anyone once they're banned, do they care if you tell them beforehand that you're concerned someone is messing with your ads? And if they do care, does that even help / wouldn't the "ban this guy" script just run anyway?
  - somehnguy 7y ago
    I highly doubt it. I've had ~$150 sitting in my adsense account for about 4 years now because I'm unable to cash out. Their 'input bank information' page is broken, seems like my old banking information is stuck filled out and I can't remove it. Won't let me put new information in either. And the link to the help site leads to a 404. I've tried various forms to reach a person and they've all been fruitless. Google is just holding my money hostage with no recourse. They even send me a 'your payments are on hold' email every few months to basically say 'remember, we stole your money and theres nothing you can do about it!'. Thanks Google, I almost forgot that you're the definition of faceless corporation again.
    - duxup 7y ago
      I had a similar situation where I bought a domain for an old blogger blog years ago. So anyway the credit card tied to that has expired (years ago I thought). Then Google emails me their "update your payment information" email ... and points me to a Gsuite login. Bro (Google) I don't have a Gsuite account ... and my regular Google account has valid payment options. Every form of help just points back to Gsuite... Blogger doesn't appear to have any of the old information as far as the domain being purchased. I managed to get the domain registrar to help. There was no way to contact Google, it was just an infinite loop telling me to login to Gsuite.

I assume it will be a cost benefit analysis for unfortunate victims.

stri8ed 7y ago

Putting up a captcha would be another option.

gruez 7y ago
captcha on what, the site? since there's basically nothing authenticating the site to the adsense iframe/script, can't the attacker serve a cached version locally?
- stri8ed 7y ago
  Are you sure there is no authentication? https://www.seroundtable.com/google-adsense-verify-sites-26596.html https://www.seroundtable.com/google-adsense-verify-sites-265...
  - throwaway2048 7y ago
    That has nothing to do with the discussion at hand, and would do nothing to prevent a malicious ad clickbot
    - stri8ed 7y ago
      To actually enforce the policy described in that link, would require authenticating websites when rendering ads. Otherwise, one could just embed an ad from a different domain, and easily defeat this process.
      - gruez 7y ago
        I'm not sure why the parent (throwaway2048) is getting downvoted over this. He's correct. The attack is as follows: You want to attack (send fake traffic to) example.com, but example.com has implemented a captcha system (think cloudflare interstitial). If you directed your bots to visit example.com, they'd have to solve the captcha to view the ads. However, there's nothing stopping you from solving the captcha once, getting the page source, and serving that to your bots. This works because example.com doesn't serve any ads directly, it only embeds a <script> or <iframe> element to adsense. Since the bots are under your control, it's trivial to set up the redirection (eg. hosts file or HTTP proxy). HTTPS isn't a problem either because you can MITMing yourself with a self signed certificate, which is not a problem either as you can get your bots to trust that certificate. From the perspective of the adsense script, it's impossible to tell whether the bot is visiting the real example.com or a fake version, since the browser is under the attacker's control. The only way to mitigate this attack would be some sort of one time use token that's generated server-side by example.com, and authenticated by adsense each time it tries to display an ad, which I doubt adsense supports.
        thrwaway69 7y ago
        One solution could be some sort of DRM based device attached ad...but that will cause other problems.
lexicality 7y ago
"Nearly there - just complete this captcha to see our advert!"
- stri8ed 7y ago
  I mean on the page content. Using something like Google's Recaptcha would reduce friction for legit users.
  - throwaway2048 7y ago
    How would it "reduce friction for legit users"
  - rbritton 7y ago
    I think there was a time that was true. Now reCAPTCHA is so prone to tagging someone as a bot if they employ any ad blocking or tracking prevention that it significantly interferes with web use. It's an overall harm to the web in my opinion.
  - pier25 7y ago
    AFAIK attackers only need to actually access your content once and extract the ad embed. Please correct me if I'm wrong.
- pcr0 7y ago
  I think parent comment meant putting up a captcha on the website for suspicious traffic, the way Cloudflare does. I don't think anyone is silly enough to suggest putting captchas on ads.

tmpz22 7y ago

It's ok Google setup a form to communicate with AdSense partners. > “We have a help center on our website with tips for AdSense publishers on sabotage,” the statement continues. “There’s also a form we provide for publishers to contact us if they believe they are the victims of sabotage. We encourage publishers to disengage from any communication or further action with parties that signal that they will drive invalid traffic to their web properties. If there are concerns about invalid traffic, they should communicate that to us, and our Ad Traffic Quality team will monitor and evaluate their accounts as needed.”

duxup 7y ago
I wonder, has anyone contacted Google and somehow avoided getting banned? Google seems to show no outward no interest in actually unbanning anyone once they're banned, do they care if you tell them beforehand that you're concerned someone is messing with your ads? And if they do care, does that even help / wouldn't the "ban this guy" script just run anyway?
- somehnguy 7y ago
  I highly doubt it. I've had ~$150 sitting in my adsense account for about 4 years now because I'm unable to cash out. Their 'input bank information' page is broken, seems like my old banking information is stuck filled out and I can't remove it. Won't let me put new information in either. And the link to the help site leads to a 404. I've tried various forms to reach a person and they've all been fruitless. Google is just holding my money hostage with no recourse. They even send me a 'your payments are on hold' email every few months to basically say 'remember, we stole your money and theres nothing you can do about it!'. Thanks Google, I almost forgot that you're the definition of faceless corporation again.
  - duxup 7y ago
    I had a similar situation where I bought a domain for an old blogger blog years ago. So anyway the credit card tied to that has expired (years ago I thought). Then Google emails me their "update your payment information" email ... and points me to a Gsuite login. Bro (Google) I don't have a Gsuite account ... and my regular Google account has valid payment options. Every form of help just points back to Gsuite... Blogger doesn't appear to have any of the old information as far as the domain being purchased. I managed to get the domain registrar to help. There was no way to contact Google, it was just an infinite loop telling me to login to Gsuite.