4 ms·

They're not looking for the presence/absence of JS/Flash but other things that can be measured by it. I assume their approach is similar to Spider.io (since acq

by paulgb 12y ago

They're not looking for the presence/absence of JS/Flash but other things that can be measured by it. I assume their approach is similar to Spider.io (since acqui-hired by Google) which found (if I'm remembering correctly) that certain javascript calls ran differently or at different speeds depending on whether the browser instance was real. Similar to how software can detect whether it's running inside a VM because of subtle differences in how instructions are executed. That said, if I had a botnet I'd just figure out what domains belonged to WhiteOPs and null-route them.

opendais 12y ago
If that is what it does, they should have clearly stated that in the article. Instead, its in a completely separate press release :/ EDIT: Its apparently stated here: http://www.marketwired.com/press-release/White-Ops-Secures-7-Million-in-Series-A-Funding-1923780.htm http://www.marketwired.com/press-release/White-Ops-Secures-7... "White Ops offers the world's first systematic solution for accurately isolating and eliminating bot-infected traffic. By applying the techniques of Side Channel Analysis across thousands of real-time user session variables, White Ops differentiates between a human and machine-driven request -- regardless of the sophistication of the bot programmer and across the full spectrum of impression and click fraud techniques. This approach is vastly more effective than methods generally employed by legacy fraud detection services, which rely largely on historical data and statistical and predictive analysis to detect bot activity. "
ryan-c 12y ago
> That said, if I had a botnet I'd just figure out what domains belonged to WhiteOPs and null-route them. That and bots that don't execute javascript would be a problem, yes. Our clients can account for that by comparing their traffic numbers with ours. (full disclosure: I work at White Ops on the 'botprinting' team)
- thibauts 12y ago
  I'd be very interested in knowing more about how the technology works. It's pretty difficult to assess it without more information. Specifically it feels like the good old software protection conundrum where you have to give the keys along with the lock. How do you prevent a bot operator to send the right signal (or not send it) to the (whichever) measuring party ?
  - paulgb 12y ago
    Here's a short explanation of spider.io's approach that might interest you: https://www.youtube.com/watch?v=RSWhvNdjAAE https://www.youtube.com/watch?v=RSWhvNdjAAE
    - thibauts 12y ago
      Ok so the library performs a kind of timing attack to detect whether it runs in a legitimate browser or not, and phones home { bot: true }. I make a bot that detects the script on the page and sends { bot: false }. You could try to obfuscate the signal by sending the raw collected browser behavior data but I still could reverse engineer its format or replay data from a legitimate session. I still don't understand how this could possibily work.

by paulgb 12y ago

opendais 12y ago

If that is what it does, they should have clearly stated that in the article. Instead, its in a completely separate press release :/ EDIT: Its apparently stated here: http://www.marketwired.com/press-release/White-Ops-Secures-7-Million-in-Series-A-Funding-1923780.htm http://www.marketwired.com/press-release/White-Ops-Secures-7... "White Ops offers the world's first systematic solution for accurately isolating and eliminating bot-infected traffic. By applying the techniques of Side Channel Analysis across thousands of real-time user session variables, White Ops differentiates between a human and machine-driven request -- regardless of the sophistication of the bot programmer and across the full spectrum of impression and click fraud techniques. This approach is vastly more effective than methods generally employed by legacy fraud detection services, which rely largely on historical data and statistical and predictive analysis to detect bot activity. "

ryan-c 12y ago

> That said, if I had a botnet I'd just figure out what domains belonged to WhiteOPs and null-route them. That and bots that don't execute javascript would be a problem, yes. Our clients can account for that by comparing their traffic numbers with ours. (full disclosure: I work at White Ops on the 'botprinting' team)

thibauts 12y ago
I'd be very interested in knowing more about how the technology works. It's pretty difficult to assess it without more information. Specifically it feels like the good old software protection conundrum where you have to give the keys along with the lock. How do you prevent a bot operator to send the right signal (or not send it) to the (whichever) measuring party ?
- paulgb 12y ago
  Here's a short explanation of spider.io's approach that might interest you: https://www.youtube.com/watch?v=RSWhvNdjAAE https://www.youtube.com/watch?v=RSWhvNdjAAE
  - thibauts 12y ago
    Ok so the library performs a kind of timing attack to detect whether it runs in a legitimate browser or not, and phones home { bot: true }. I make a bot that detects the script on the page and sends { bot: false }. You could try to obfuscate the signal by sending the raw collected browser behavior data but I still could reverse engineer its format or replay data from a legitimate session. I still don't understand how this could possibily work.