Man Accused of Attempting to Extort Google

sandalwood writes "A programmer has been arrested on charges of attempting to "threaten Google with a software program he devised that creates phony clicks on pop-up advertisements delivered by Google. Google pays Web site publishers companies a certain amount for legitimate hits on those ads, but Bradley created a method that generates false clicks that appeared to be real Internet traffic, which would have repeatedly defrauded Google... Bradley contacted Google in early March, informing company officials that he had created the program and wanted $100,000 to keep him from selling it to spammers, according to an affidavit by a U.S. Secret Service agent." A harbinger of organized crime to come? That's a real nice website you have here... a shame if anything were to happen to it..."

Comments

Or vice versa

[Space cowboy]

Want to really annoy your competition ? Do the same thing actually on a google search page - just make it "search" 1000 times for words that bring up your competitions 'adwords' box, then "click" the adwords link. Google then bills your competitor for the maximum (s)he specified per day/week/month and, bonus!, your competitor then drops down the rankings for which google Adword to display...

Random words mixed in with the key ones, random delays between searches, random User-Agent, etc., etc. Seems like it would be easy to do, and hard to track...

Simon.

Re:Or vice versa

[psycho_tinman]

Well, I don't see how this person could offer up a tool for extortion without figuring out how to spoof IP addresses, anyway. Surely, it would raise an alert if most, if not ALL of your clickthroughs came from a single small set of IPs ? Also, one nitpick about the article, since when does Google offer popup advertising ?

I'm quite certain plenty of programmers know how to fake clickthroughs, or they could sit down and figure it out. Spoofing IP addresses, on the other hand, would be slightly more difficult.. and there are only so many open proxies and so on.

On a slightly more depressing note, this sounds like a perfect scheme for all those zombie machines that are being spawned out there (with email worms). Instead of doing a Distributed DOS or sending out spam (which are their current uses, and can be easily traced back), if they were used to randomly send out a few million clicks, or to host a mini link farm for Googlebot's eyes only.... the possibilities for spamming become endless. Scary thought.

Re:Or vice versa

[walter_kovacs]

Actually no, click fraud is a real problem with Google (and all other pay per click engines). There have been many times when my Adwords traffic has spiked, sales have plummeted and conversions gone through the floor, and I am 99% sure that it is click fraud - the logs are just FULL of proxies, and Google seems helpless to do anything about it, but still happily collects the money.

What a daft bugger.

[ackthpt]

Spammers don't need programs like that. People who have ads on their web pages and want to generate hits on the ads would want that.

Spammers, on the other hand, have now moved onto blogs lately. Fred Rodriguez, a rider Emeryville, CA, for italian team Aqua e Sapone has spams for the usual penis enlargment, diet pills, cheap computer eqz, etc. on his guest book. Spammers got no shame, just like this fool.

robots as websurfers

[nuffle]

This brings up some other related concerns about having robots browse pages, even when the intent is not malicious.

Some ads on websites are sold 'per-view' and not 'per-click', but if a web-crawling robot hits it, should it count as a view? Are the authors of these bots stealing from the advertiser?

A while ago I wrote a bot that posts to slashdot. He even had decent Karma for a while, before getting a bit confused. In any case, my bot would usually post some links in his comments, which could have the effect of altering the target's page ranking on Google (this was not his purpose though). Am I somehow culpable for cheating Google?

Anyway, the point is that I think robots should have some limited rights to view pages and do human-like behavior on the net.

Anyone remember AllAdvantage?

[cr@ckwhore]

Anyone remember the company AllAdvantage (was that really the name?) that paid users to click on ads during the dotcom boom? I remember almost everyone was into it ... people were making hundreds, even thousands of dollers per month.

Of course, none of the ad traffic was legitimate! There were tons and tons of scripts and programs that would click the ads for you ... set it up to run all night, go to sleep, wake up rich in the morning. That's probably why the thing was so popular!

I remember the comany would implement anti-cheat methods every couple of weeks, even to the point of tracking mouse movements ... the idea being that if the mouse wasn't moving, but clicks were coming in, then it was a cheat.

Ok, well... as always, cheaters take things to the next level. The ultimate cheat was one that surfed the web from a pre-determined list of web sites, while randomly moving the mouse cursor around the screen, and clicking every couple of seconds. Worked like a charm!

No more AllAdvantage.

Google has more sophisticated technology than AllAdvantage though... its almost impossible to cheat google. Even if this dumb-ass really did write a program to click ads on his own sites, google would catch that. There's AdSense partners getting canned every day for suspicion of cheating, when sometimes it's only as simple as an innocent erroneous click on their own ads. It happens... check the adsense forums. I doubt this guy would have been able to execute much of his plan successfully.

Re:Anyone remember AllAdvantage?

[CGP314]

Wow, I forgot all about AllAdvantage. I still have an old website on fortunecity.com plugging that service. (I sadly want to gain control of that site again, but I forgot my username/password)

As I remember it, you didn't get paid for clicking on the ads, AllAdvantage displayed a banner ad on the bottom of your computer and paid you to `look' at it. But all it really kept track of was if the mouse was moving.

I had a friend send me a script to move the mouse around while I slept, but AA cought on to that pretty quickly.

So, I just tied my mouse to a rotating fan. Sometimes the simplest solution is the best.


-Colin

Comment removed

[account_deleted]

Comment removed based on user account deletion

I did the same thing....

[DeionXxX]

I uhhh... made the same program last year in January or so at a client's request. I was skeptical that I could defraud Google's AdWords, but I ended up being successful. Out of respect, I never gave the client's his program even though it worked and sent it over to Google and told them about their vulnerability.

Defrauding Google, is like defrauding a family member or something...

I'm glad this ass got caught.

-- D3X

My guessing the specs

[Felinoid]

Google dosen't just have text link adds on Googles website. They also have ads on OTHER peoples websites and pay those websites for that.

With out banner adds or pop ups (Thwap the guy who called Google ads POP UPS) you'll need some software on your server to make this work.

Im guessing this guy hacked this software so he can send bad any data he wants and is expecting Google to act like Microsoft and pay to keep it quiet.

He picked the wrong target. Find a defect in Windows.. a nasty one.. and bribe Microsoft to stay quiet. They appear all fine with the extrotion scams and all about security by obscurity.
(I'm joking BTW.. Try that and Microsoft will thump you something nasty AND clame your defect is fraudulent)