4 ms·

...wut? That's ridiculous. What evidence is there that there are groups of nefarious hackers out there spoofing analytics data on people's websites? I don't th

by lmkg 15y ago

...wut? That's ridiculous. What evidence is there that there are groups of nefarious hackers out there spoofing analytics data on people's websites? I don't think there is a need for this solution because the problem doesn't exist. If I wanted to mess with someone's websites, there are much better ways than injecting some false data into their Google Analytics.

lamnk 15y ago
It's a problem of information asymmetry in the online (display) advertising industry, not a problem with hackers. Because advertisers don't know how many pageviews/visitors a website has, advertising agencies often have to make purchasing decisions based on numbers from Comscore, Quantcast, Google Analytics etc. Clearly, if the website owner can spoof his analytic data, he can sell his inventory at higher rates.
- mpclark 15y ago
  ...but not for long, because his CTR will be down on the floor. This feels to me like a clever solution for a problem that doesn't exist.
  - lamnk 15y ago
    Sure, that's why I wrote "online (display) advertising", which often has its cost measured in CPM, not in CPC, so CTR doesn't matter. This shows advantages of CPC ads over traditional display advertising and partially explains the success of Google. I do not have technical ability to judge whether his solution can really solve this problem, however the problem does exist, though not widespread, and who can solve it will have a great chance to earn a lot of money. AFAIK advertising agencies pretty much trust the data from the like of Comsore. It's not that they don't know the data is not really accurate, it's that they don't have anything else. How much does Comscore sell its packages? I don't know, but I'm sure it's not cheap and online advertisers/marketers still have to buy them.
eps 15y ago
What evidence is there that there are groups of nefarious hackers intercepting my shopping session at ToysRUs online store? Why the hell should I be spending my hard earned milliamps on this SSL thing? Certainly if someone wanted to mess with me, they would just whack me on the head in the dark corner of the street.
- ceejayoz 15y ago
  Intercepting a shopping session gets you a credit card number. Spoofing analytics adds a pageview to a stat you don't even get to see.
  - huhtenberg 15y ago
    You are missing the point. The probability of an exploit being ultra-low or hard to mount is not a valid justification for ignoring it altogether.
    - ceejayoz 15y ago
      No, but it being a rather useless exploit is.
angelbob 15y ago
You don't think that, say, the same people who resent ads being shown and turn them off might think it was hilarious to send back bad analytics data to companies who are quietly profiting from same? The same people, who, say, use a housemate's phone number for their Safeway card so that Safeway can't determine their shopping habits? If there was an easy way to do it, many people would want to. It's clear that there could be an easy way to do it if you put, like, two good hours of work into it.
- gyardley 15y ago
  I co-founded and ran Pinch Media, a mobile application analytics company. We operated independently for around two years before selling. During those two years, I believe we got more bad PR than a typical analytics company. I certainly got my fair share of anonymous hate email. During that time, we received exactly two easily-filterable attempts to spoof analytics traffic. Historically, anyway, this doesn't seem to be a real problem.
  - angelbob 15y ago
    Fair enough. You're much more confident than I would be about knowing. I work in the Analytics group at Ooyala, a video platform company -- among other things we handle all the analytics traffic for all videos on ESPN.com and its various subsidiaries. We get huge amounts of traffic, weird data mangling constantly, and a wide variety of bad responses -- and that's only the stuff that gets past and mostly checksums. It would take a pretty significant spoofing attempt for us to even know.
    - gyardley 15y ago
      Nice - nothing but respect for Ooyala. You're right - it's possible we got thousands of attempts to spoof traffic that we automatically dumped for being malformed. Like you, we also got a ton of weird data mangling and bad responses which we just ignored. Most were bad implementations or issues with the phones themselves, but some could've been spoofing attempts. It's also possible that smaller attempts to spoof traffic went by absolutely undetected by both us and our clients. Like you, it'd take a pretty significant spoofing attempt for us to notice. That said, what's the point of an insignificant spoofing attempt?
gyardley 15y ago
While I haven't seen any real, meaningful efforts at spoofing analytics data (I vaguely recall some grad student project), I've certainly heard of companies spoofing their own analytics data to appear bigger than they are to interested parties. More than one unscrupulous publisher has gamed comScore and Neilsen to pump up their reach figures and get access to more attractive advertisers. Of course, scammers aren't going to use this service. There's a market selling verification services to advertisers, but there's a ton of companies in this area already - from my limited vantage point, Double Verify looks like the market leader.
storborg 15y ago
I've often seen a different, but related effect of client side analytics where content thieves will "accidentally" spoof analytics data by simply copying a site verbatim, with the analytics tag included. In this case it's usually relatively easy to filter out, because the analytics host will identify the fake requests as coming from pages served on a different domain. However, it is annoying, and a combination of content theft plus hijacked DNS could result in more sinister influences.

by lmkg 15y ago

lamnk 15y ago

It's a problem of information asymmetry in the online (display) advertising industry, not a problem with hackers. Because advertisers don't know how many pageviews/visitors a website has, advertising agencies often have to make purchasing decisions based on numbers from Comscore, Quantcast, Google Analytics etc. Clearly, if the website owner can spoof his analytic data, he can sell his inventory at higher rates.

mpclark 15y ago
...but not for long, because his CTR will be down on the floor. This feels to me like a clever solution for a problem that doesn't exist.
- lamnk 15y ago
  Sure, that's why I wrote "online (display) advertising", which often has its cost measured in CPM, not in CPC, so CTR doesn't matter. This shows advantages of CPC ads over traditional display advertising and partially explains the success of Google. I do not have technical ability to judge whether his solution can really solve this problem, however the problem does exist, though not widespread, and who can solve it will have a great chance to earn a lot of money. AFAIK advertising agencies pretty much trust the data from the like of Comsore. It's not that they don't know the data is not really accurate, it's that they don't have anything else. How much does Comscore sell its packages? I don't know, but I'm sure it's not cheap and online advertisers/marketers still have to buy them.

eps 15y ago

What evidence is there that there are groups of nefarious hackers intercepting my shopping session at ToysRUs online store? Why the hell should I be spending my hard earned milliamps on this SSL thing? Certainly if someone wanted to mess with me, they would just whack me on the head in the dark corner of the street.

ceejayoz 15y ago
Intercepting a shopping session gets you a credit card number. Spoofing analytics adds a pageview to a stat you don't even get to see.
- huhtenberg 15y ago
  You are missing the point. The probability of an exploit being ultra-low or hard to mount is not a valid justification for ignoring it altogether.
  - ceejayoz 15y ago
    No, but it being a rather useless exploit is.

angelbob 15y ago

You don't think that, say, the same people who resent ads being shown and turn them off might think it was hilarious to send back bad analytics data to companies who are quietly profiting from same? The same people, who, say, use a housemate's phone number for their Safeway card so that Safeway can't determine their shopping habits? If there was an easy way to do it, many people would want to. It's clear that there could be an easy way to do it if you put, like, two good hours of work into it.

gyardley 15y ago
I co-founded and ran Pinch Media, a mobile application analytics company. We operated independently for around two years before selling. During those two years, I believe we got more bad PR than a typical analytics company. I certainly got my fair share of anonymous hate email. During that time, we received exactly two easily-filterable attempts to spoof analytics traffic. Historically, anyway, this doesn't seem to be a real problem.
- angelbob 15y ago
  Fair enough. You're much more confident than I would be about knowing. I work in the Analytics group at Ooyala, a video platform company -- among other things we handle all the analytics traffic for all videos on ESPN.com and its various subsidiaries. We get huge amounts of traffic, weird data mangling constantly, and a wide variety of bad responses -- and that's only the stuff that gets past and mostly checksums. It would take a pretty significant spoofing attempt for us to even know.
  - gyardley 15y ago
    Nice - nothing but respect for Ooyala. You're right - it's possible we got thousands of attempts to spoof traffic that we automatically dumped for being malformed. Like you, we also got a ton of weird data mangling and bad responses which we just ignored. Most were bad implementations or issues with the phones themselves, but some could've been spoofing attempts. It's also possible that smaller attempts to spoof traffic went by absolutely undetected by both us and our clients. Like you, it'd take a pretty significant spoofing attempt for us to notice. That said, what's the point of an insignificant spoofing attempt?

gyardley 15y ago

While I haven't seen any real, meaningful efforts at spoofing analytics data (I vaguely recall some grad student project), I've certainly heard of companies spoofing their own analytics data to appear bigger than they are to interested parties. More than one unscrupulous publisher has gamed comScore and Neilsen to pump up their reach figures and get access to more attractive advertisers. Of course, scammers aren't going to use this service. There's a market selling verification services to advertisers, but there's a ton of companies in this area already - from my limited vantage point, Double Verify looks like the market leader.

storborg 15y ago

I've often seen a different, but related effect of client side analytics where content thieves will "accidentally" spoof analytics data by simply copying a site verbatim, with the analytics tag included. In this case it's usually relatively easy to filter out, because the analytics host will identify the fake requests as coming from pages served on a different domain. However, it is annoying, and a combination of content theft plus hijacked DNS could result in more sinister influences.