Man Accused of Attempting to Extort Google

sandalwood writes "A programmer has been arrested on charges of attempting to "threaten Google with a software program he devised that creates phony clicks on pop-up advertisements delivered by Google. Google pays Web site publishers companies a certain amount for legitimate hits on those ads, but Bradley created a method that generates false clicks that appeared to be real Internet traffic, which would have repeatedly defrauded Google... Bradley contacted Google in early March, informing company officials that he had created the program and wanted $100,000 to keep him from selling it to spammers, according to an affidavit by a U.S. Secret Service agent." A harbinger of organized crime to come? That's a real nice website you have here... a shame if anything were to happen to it..."

Comments

Or vice versa

[Space cowboy]

Want to really annoy your competition ? Do the same thing actually on a google search page - just make it "search" 1000 times for words that bring up your competitions 'adwords' box, then "click" the adwords link. Google then bills your competitor for the maximum (s)he specified per day/week/month and, bonus!, your competitor then drops down the rankings for which google Adword to display...

Random words mixed in with the key ones, random delays between searches, random User-Agent, etc., etc. Seems like it would be easy to do, and hard to track...

Simon.

Re:Or vice versa

[Mr. Darl McBride]

Want to really annoy your competition ? Do the same thing actually on a google search page - just make it "search" 1000 times for words that bring up your competitions 'adwords' box, then "click" the adwords link.

Presumably Google has something that filters excessive traffic by IPs not known to be proxies for places like AOL.

The problem comes in when there are all these databases of open web proxies and code in CPAN for accessing and using those. :/

Re:Or vice versa

[stonebeat.org]

actually this will not work. Google use statistical data to stop the user from doing this. It will almost have to be a DDOS attack (i.e. have thousands of IP addresses click on the AD) to pull this off. In that case it would be much easier just to DDOS the website of your competitor. Just like what happened to SCO.com

Re:Or vice versa

[Anonymous Coward]

OK, somebody help me out here. Why is Google paying for hits on ads they deliver? Shouldn't the company be paying them? Isn't that how ads work? I display your ad and if someone clicks on it to get to your site, you pay me money for bringing them there? What am I missing here?

Re:Or vice versa

[psycho_tinman]

Well, I don't see how this person could offer up a tool for extortion without figuring out how to spoof IP addresses, anyway. Surely, it would raise an alert if most, if not ALL of your clickthroughs came from a single small set of IPs ? Also, one nitpick about the article, since when does Google offer popup advertising ?

I'm quite certain plenty of programmers know how to fake clickthroughs, or they could sit down and figure it out. Spoofing IP addresses, on the other hand, would be slightly more difficult.. and there are only so many open proxies and so on.

On a slightly more depressing note, this sounds like a perfect scheme for all those zombie machines that are being spawned out there (with email worms). Instead of doing a Distributed DOS or sending out spam (which are their current uses, and can be easily traced back), if they were used to randomly send out a few million clicks, or to host a mini link farm for Googlebot's eyes only.... the possibilities for spamming become endless. Scary thought.

Re:Or vice versa

[merlin_jim]

Random words mixed in with the key ones, random delays between searches, random User-Agent, etc., etc. Seems like it would be easy to do, and hard to track...

Don't forget random IPs... without that, the tracking becomes very easy

Re:Or vice versa

[walter_kovacs]

Actually no, click fraud is a real problem with Google (and all other pay per click engines). There have been many times when my Adwords traffic has spiked, sales have plummeted and conversions gone through the floor, and I am 99% sure that it is click fraud - the logs are just FULL of proxies, and Google seems helpless to do anything about it, but still happily collects the money.

Re:Or vice versa

[AndroidCat]

That's why the article mentions spammers. The (old) trick works by sending out spam that generates a click-through when someone opens the email. (Or previews it in LookOut.) That way it comes from a whole bunch of IP addresses of people dumb enough to allow HTML script to run in their email.

Re:Or vice versa

[pinkUZI]

um... guys,
maybe I'm out of line here, but this is not a good topic to brain storm. Why do we want to devises more deviant ways to spam?
And why hurt our precious Google!

Re:Or vice versa

[Faith_Healer]

I am pretty sure that its posible to generate fake packets that have a made up mac and ip and just anticipate the conversation. In fact seems like blind spoofing would be the best way to do someting like that. That would realy tear up their statistical data.

Re:Or vice versa

[AndroidCat]

As I said, click-through spam is old news from a few years ago. I'm sure anyone could find examples in news.admin.net-abuse.sightings if they search through GoogleGroups .. um .. or maybe not. :^P

Re:Or vice versa

[idiot900]

maybe I'm out of line here, but this is not a good topic to brain storm. Why do we want to devises more deviant ways to spam?
And why hurt our precious Google!

1) Because it's our intrinsic human right to think about whatever we want.
2) Because some of us, as server administrators, must deal with spam in all its vile forms, and we therefore must know our enemy.

Re:Or vice versa

[Dun Malg]

um... guys, maybe I'm out of line here, but this is not a good topic to brain storm. Why do we want to devises more deviant ways to spam? And why hurt our precious Google!

Pretending no one thought of it is not an effective way to prevent others from thinking of it. We want all possible exploits to be exposed, so they can be dealt with. You're advocating security through obscurity.

Re:Or vice versa

[DrSkwid]

are you really so ignorant?

it would take under an hour to write the code

google will even help you

Re:Or vice versa

[AndroidCat]

Yep, too late--some damned fool already posted about that trick to news.admin.net-abuse.email back in May of 2001. D'OH! :^)

Re:Or vice versa

[Anonymous Coward]

1. Company pays google to create ads

2. You to place those ads on your site

3. Google pays you a fraction of the ad revenue

Re:Or vice versa

[Anonymous Coward]

There is a valid methods for doing this. I know more than one, orginally I was going to post it, but greedy slimy business men might read this and get a programmer to write it. A little unknown fact, right from a GOOGLE engineer, and I quote "We DO NOT check for spam clicking". Guys, THIS IS ALREADY BEING DONE. THIS is not new news. I Hope the FBI does their job and get the a--holes that are doing. Google is not the ONLY victim, Looksmart, overture ( yes overture, i know about the split servers to prevent double clicking, might want to try a more elegant solution) . While this is not rampant, it is being done in HIGHLY competive spaces. I know for a fact these devices are in place.

Google, and the other search engines know about this, and done very little to stop mass clicking.

This costs the small companies a lot of cash, because you will have bigger enties running a software application and bringing up their PPC costs. Plus the fact, most smaller companies are not as indept in PPC marketing.

Sincerly,

Anonymous Coward

Re:Or vice versa

[quigonn]

That is really non-trivial, as you have to be really good in guessing TCP parameters like window size, sequence number and acknowledgement number.

Re:Or vice versa

[Scott Wood]

HTTP runs over TCP, which means that to complete a "click", you'll need to be able to receive data at the spoofed IP address and respond based on it (specifically, you need to know the initial sequence number). Unless you can guess what that number is (which is not easy with good TCP code), you won't be able to get the server to listen to you. You might get lucky once in a while, but not enough for an attack that depends on a high rate of success.

As for MACs, they're for the local network only. As Google can't even see your MAC, spoofing it would have fairly little point.

Re:Or vice versa

[Permission Denied]

The (old) trick works by sending out spam that generates a click-through when someone opens the email.

Presumably Google is smart enough to check referer logs when charging for adwords. If they don't check referers, a much simpler and more reliable attack is to embed a 1px by 1px iframe in your own high-traffic website.

Re:Or vice versa

[dubl-u]

1) Because it's our intrinsic human right to think about whatever we want.

FYI, thinking is something you do inside your head. Talking, on the other hand, is an action that can have consequences in the world. It's unfortunate that the urge to accept responsibility for the consequences of one's actions is not quite as intrinsic as the urge to run one's mouth.

Re:Or vice versa

[Pig Hogger]

maybe I'm out of line here, but this is not a good topic to brain storm. Why do we want to devises more deviant ways to spam?

So, in other words, you are advocating security through obscurity...

Re:Or vice versa

[BizidyDizidy]

This term is the most overused sack of crap going right now. Details a modern security system that isn't fundamentally equivalent to security through obscurity.

Re:Or vice versa

[themusicgod1]

systems can think, and we are a system. while the person may or may not be 'thinking', a person is taking place in the thinking process of a higher order. behold! the hivemind!

Re:Or vice versa

[MCZapf]

You imply that security through obscurity is always bad. I don't think that's true. For example, would you post your Slashdot password in a reply to this comment? I don't think so. You are relying on the security/obscurity of keeping it to yourself.

So, to restate the original question, why give the spammers free ideas in an open forum? (I'm sure some read Slashdot.) Would having these discussions in a closed forum of spam fighters be too obscure for you?

Also, I am not advocating stifling anyone's free speech. Talk about it if you really want to. But I second the original poster's suggestion.

Re:Or vice versa

[AndroidCat]

I'm sure they've encountered these obvious tricks before over the years. And since it was bound to come out during the trial, I bet they got as many details as possible from this guy and ran it past their technical people before they called the police.

Re:Or vice versa

[Flashbck]

a much simpler and more reliable attack is to embed a 1px by 1px iframe in your own high-traffic website

There is a huge difference between the HTML code in an e-mail doing this and having it on your high traffic website...the IP addy. If you put a 1px X 1px iframe then all the traffic to google created by that iframe will be from the web server that hold the page aka 1 IP. By using the e-mail scam, the refering IP changes all the time.

Re:Or vice versa

[Camel Pilot]

I have had similar experiences. Overture (aka yahoo) attempts to console you with their Click Protection buzz words. But in reality they do not filter out the even the most basic fraudulent clicks.

Here is summary of my recent experience with Overture's Click Protection program. Overture e-mail responses are almost unbelievable.

Overture claims to provide "Click Protection" for their pay-per-click advertising service. In reality they fail to prevent the most basic and easiest to detect non-authentic clicks - that is competitors clicking on competitors. They do not even filter out a customer clicking on their own links from within the Overture manager. Nor do they provide a method for an advertiser to test their own ad rendered URL's - a necessary function as a means to test the validity of an entered URL. Since filtering out such clicks would be simple and straight forward using established cookies or session id's - I can only speculate the reasons for not patching this obvious flaw and question the "sophistication of Overtures "Click Protection".

Re:Or vice versa

[BizidyDizidy]

Just so no one considers me guilty by association, I'm not on this "don't talk about it because it might give them ideas bandwagon".

Historically, attackers are always ahead of defenders; it's no one's fault, it's just the nature of the two roles. Thus, secrecy is typically to the benefit of attackers, not defenders.

Criminals have little trouble devising criminal enterprises; the real problem is that honest people have a much harder time doing so.

Re:Or vice versa

[BizidyDizidy]

I guess I don't really understand this security system. If somebody actually knows what you look like, why need photo id? Photo ID's alone clearly have a ton of obscurity built into them. For instance, there are hidden security features that aren't fully known so they are difficult to reproduce. Also, the equipment for making ID's is rare, and thus obscure. Someone who knows what you look like is a decent example. It's benefit is, at this time, it is impractically difficult to impersonate someone with great accuracy, and so we don't have to use obscurity. The same thing can be said to some degree about any system that requires you to have a physical object, but the line is very blurry. I would argue that, fundamentally, requiring someone to have something that is kept hidden, protected is security by obscurity. For instance, you wouldn't leave your keycard laying around Times Square with a sign that says "Secret Passcard". For some reason, when you take it so far as needing an actual person, it seems less so, but it's still not entirely obvious that it isn't a different manifestation of StO.

Re:Or vice versa

[SnappleMaster]

Security through obscurity is not bad. But if a system relies upon it as a main line of defense, the system is flawed. The moment the obscurity is broken, the system is compromised.

Obscurity can be broken trivially. But security cannot be broken by a simple discovery of a hole in the algorithm.

Why should we "brainstorm" against a system that is secure only through obscurity? Because someone *will* break the "security" and then all users will be screwed. Better to do it sooner than later and force it to be improved.

Re:Or vice versa

[SnappleMaster]

"If they don't check referers, a much simpler and more reliable attack is to embed a 1px by 1px iframe in your own high-traffic website."

That's silly. For one thing, how many of us own a high-traffic website? For another, if you're going to do that why not just write a script to hammer google with requests? Would google really care about the difference? If they see a high-traffic website hammering them and suspect foul play they'll examine the source and see that it is malicious. In the end they'll consider you as bad as the script kiddie.

Re:Or vice versa

[geoffspear]

If they don't check referrers, they would have no idea all the hits were coming from the same webpage, as the requests themselves come from the IPs of the users who are loading the page, not the server where it's hosted.

Re:Or vice versa

[vrai]

The slashdot password system is not security through obscurity. It's a (hopefully) secure system that relies on a private token. Anyone can download the source code to Slashdot, but knowledge of how it works doesn't allow you to compromise the an given account.

As a more common example, take PGP. PGP uses a well known algorithm, but that does not make PGP insecure. Even if you steal a person's private key - you can only compromise their date, other PGP users are safe.

Security through obscurity is when a system is only secure if its workings/algorithms remain secret. For any system that is to be distributed outside of a controlled environment this is a very bad idea, as it's almost guaranteed that someone will crack it.

Re:Or vice versa

[Walrus99]

Can you do that with just HTML? Wouldn't you also need at lest JavaScript or C running under Active X?

Re:Or vice versa

[SnappleMaster]

Hm... I suspect you are right and I am wrong. I could never get the hang of Mondays.

Re:Or vice versa

[Tatarize]

3) Because while brainstorming we are helping to inform the other very smart people on the site about the problem, and somebody might churn out an answer. Information and ideas are not weapons, they are the solution.

Re:Or vice versa

[0x0d0a]

Some browsers do not send referrer information or have it blocked.

I would suspect that a link from an email would result in no referrer data being sent in most web browsing environments.

Since the two possibilities (legit user, no referrer data and bogus user, clicked on email) can't be distinguished easily, I would expect that Google just waits for a lot of hits to suddenly come in on an AdWord, with a high percentage of click-through. Especially if most do not have host-referer.

Re:Or vice versa

[Anonymous Coward]

"Google seems helpless to do anything about it, but still happily collects the money."

Exactly, it's not google being defrauded, it's thousands of tiny one-person companies.

Re:Or vice versa

[hesiod]

> Umm, yeah but let me know if you find a program that can spoof a full TCP connection

Umm, I don't know one, I was just pointing out that the program they talked about does, in fact, exist.

Re:Or vice versa

[MullerMn]

As a more common example, take PGP. PGP uses a well known algorithm, but that does not make PGP insecure. Even if you steal a person's private key - you can only compromise their date, other PGP users are safe.

Maybe I'm the possessive type, but if you try and compromise my date, I'll kick your ass.

Re:Or vice versa

[JohnFluxx]

The argument is that the password itself counts as security through obscurity. So in that case yes slashdot does use security through obscurity.

If instead, for example, slashdot logged you in based on your ip, then that wouldn't be security though obscurity.

Re:Or vice versa

[Chester K]

FYI, thinking is something you do inside your head. Talking, on the other hand, is an action that can have consequences in the world. It's unfortunate that the urge to accept responsibility for the consequences of one's actions is not quite as intrinsic as the urge to run one's mouth.

Talking is distributed thinking. As soon as you start looking down upon talking about abuse, you at the same time prevent anyone from doing anything to stop it.

Re:Or vice versa

[TheRoachMan]

It sounds logical but perhaps it isn't: if you open a web-page with two frames, one for http://slashdot.org and one for http://www.google.com, then both webservers see your IP as the requester right? So far I believe I'm right. But if http://slashdot.org has two frames, one with src=http://www.google.com and the other with src=index.html then google sees the referer for that hit as http://slashdot.org, because the page was loaded from a 'frameset', right? I'm not sure here, so could someone confirm this?

Re:Or vice versa

[wideBlueSkies]

>>Talking, on the other hand, is an action that can have consequences in the world.

Precisely. And that is why Patriot Act 2005 will make gatherings of more than 3 people illegal. We can't have people 'talking'. It leads to all kinds of problems.

wbs.

Re:Or vice versa

[japhie]

You forgot the obligatory `5. Profit' step.

Re:Or vice versa

[wideBlueSkies]

>>If instead, for example, slashdot logged you in based on your ip, then that wouldn't be security though obscurity.

Sure it would. Who says that person 'a' can't figure out person 'b's IP, spoof it and log on as person 'b'?

wbs

Re:Or vice versa

[JohnFluxx]

You dumb ass - of course there was the implied meaning that your IP address could be public knowledge.
Whether it is secure or not is totally irrelevant to the discussion.

Re:Or vice versa

[hesiod]

> I don't see how this person could offer up a tool for extortion without figuring out how to spoof IP addresses, anyway

Umm, unless I misunderstand you, IP spoofing programs have been around for YEARS

[I reposted this because it was unfairly moderated a troll, which it obviously is not.

Re:Or vice versa

[roie_m]

You're confusing the requester and the referrer.
Let's say you open two browsers, one with /. and one with google, as you said. The requester for both of them will be your computer, and there will be no referrer (no webpage/server referred you to /., you just opened them).
Now if /. has two frames, as you said, then the referrer to google (inside /.) will indeed be /., but the requester will still be your computer. That's because the code merely tells your browser to get google (i.e., refers your browser), but your brwser is what actually contacts google. The arguments above you were based on the assumption that google checks for fraud based on the requester, and not the referrer. (I don't claim to know whether that's true or not, though)

Using Google to extort Google? ;-)

[ChaoticChaos]

I wonder how long he had to Google before he figured out the technical details of how to do that? ;-)

Search terms: "how to extort" AND money AND "from google" ;-)

Re:Using Google to extort Google? ;-)

[physicsboy500]

Google...

The cause of and solution to all of life's problems

Re:Using Google to extort Google? ;-)

[Minwee]

Your search - "how to extort" AND money AND "from google" - did not match any documents.

Suggestions:

- Make sure all words are spelled correctly.
- Try different keywords.
- Try extorting money from Yahoo! They! have! lots! of! money!
- Try patenting PageRank and suing us.
- Ask the underpants gnomes. They know everything.

Also, you can try Google Answers for expert help with your search.

Re:Using Google to extort Google? ;-)

[hajejan]

Google inserts AND operators between search terms anyway.. :P

Re:Using Google to extort Google? ;-)

[BoomerSooner]

I thought that was beer?

At least that's Homer's view.

Re:Using Google to extort Google? ;-)

[fm6]

I don't think Homer's philosophy extends to causes. Just solutions!

Blackmail

[darkmeridian]

This is blackmail, plain and simple. It is just happening in cyberspace and the current laws are thankfully being applied in this new world. There is no genuine economic transaction being furthered by this man's program but to destroy Google's income. He doesn't have a leg to stand on in court.

Re:Blackmail

[ackthpt]

Be honest, how old did you think this guy was, before reading the article? 12? 14?

Michael Anthony Bradley, 32

Probably still has his mothers umbilical cord attached. Sheesh.

Re:Blackmail

[Anonymous Coward]

It's almost tragic, if he wasn't such asshole. Here's someone who spent x-amount of months/years accumulating enough skill to do something like this... Instead of either trying to sell it (which would be lame, don't get me wrong) or informing Google and possibly getting a good gig, he tries this illegal crap to get money. It's kinda like beefing up a car just so you can drive it off a cliff. There's a lesson here kids ;-)

Good one!!

Found him!

[Mr. Darl McBride]

You can find articles about the fellow by looking at the top Google hits for "moron," "fucktard," and "what the hell were you thinking?"

Re:Found him!

[BabyDave]

You can find articles about the fellow by looking at the top Google hits for "moron," "fucktard," and "what the hell were you thinking?"

He works for SCO?

Re:Found him!

[martingunnarsson]

Here's the top hit!

Re:Found him!

[davesag]

damn that just turns up george w bush. oh and these

www,badsamaritan.com and flame flamers. see.

That'll teach him a lesson...

[LinuxInDallas]

Next time, just go straight to the spammers.

Slashdot...

[martingunnarsson]

That's a real nice website you have here... a shame if anything were to happen to it...

Isn't this what Slashdot is trying to do? No?

Re:Slashdot...

[CreatureComfort]

Slashdot isn't trying to do it, it's just an unfortunate side effect... bull in a china shop syndrome...

Foolish criminal

[msgmonkey]

I'm amazed that this guy thought that google would pay out. If he was clever he would set up a few websites and rake the money in slowly over a length of time. I guess greed got the better of him.

Re:Foolish criminal

[dipipanone]

If he was clever

Unlike you...

he would set up a few websites

...and then have Google advertise them via their advertising program...

and rake the money in slowly over a length of time.

Every time he clicks on a link to his own website, he -- as the website owner -- pays Google for it.

Now how do you suppose he's going to make any money at that?

Re:Foolish criminal

[msgmonkey]

You're thinking of Google Adwords in which case your reasoning would be correct. Google also have another service whereby you host Google adverts inside your own site, everytime someone clicks you get paid like a normal banner ad.

My reading is that this guy found a way to fake clicks to the latter service.

Re:Foolish criminal

[dipipanone]

Google also have another service whereby you host Google adverts inside your own site, everytime someone clicks you get paid like a normal banner ad.

Oh, ok. This makes a little more sense.

In that case, I owe the parent an apology for calling him dumb.

he must have been

[squarefish]

feeling lucky

What have we learned?

[g0bshiTe]

Next time don't go to those you are trying to extort. Just go straight to the competition. I'm sure the spammers would have paid him much more than $100,000 collectively and not turned him in.

Imagine, he could have licensed his software to the spammers and charged them an annual fee to use it. He could have been the "Microsoft" of the spamming industry.

Re:What have we learned?

[merlin_jim]

Imagine, he could have licensed his software to the spammers and charged them an annual fee to use it. He could have been the "Microsoft" of the spamming industry.

I would like to point out that, due to dangerously unsecure settings on installation of their home software, Microsoft is already the "Microsoft" of the spamming industry...

Note: WinXP really is better. Win2003 is much better. But if we don't have Microsoft to pick on, just who ARE we gonna pick on?

Re:What have we learned?

[physicsboy500]

Imagine, he could have licensed his software to the spammers and charged them an annual fee to use it. He could have been the "Microsoft" of the spamming industry.

And just as noble!

Re:What have we learned?

[CGP314]

He could have been the "Microsoft" of the spamming industry.

I thought Microsoft was the Microsoft of the spamming industry.


-Colin

Hi. I'm Troy McClure

[Anonymous Coward]

Hi. I'm Troy McClure. You might remember me from such search-engine fraud films as "The Altavistan Job", "The Great Dogpile Caper", and "Lycos Grifters IV: Electric Boogaloo".

Re:Hi. I'm Troy McClure

[ObiWanKenblowme]

My favorite was "Dial G for Google"

I think slashdot just found...

[ph4s3]

...a new revenue stream.

Hi little guy, this is Cmdr.Taco... We're going to link to your site in an article. What? You say you can't handle the traffic? For the low low cost of $699 we can grant you a license to mirror your site on our finely tuned slashdot-proof servers.

Re:I think slashdot just found...

[physicsboy500]

The funny thing is, is if they are based on a per bandwidth basis, that would be more of an investment. 1,000,000 users * 54kb * $.05/Mb yeah... the math is obvious.

Re:I think slashdot just found...

[ph4s3]

I know. I was only half way kidding. Slashdot has a very large potential in the "let us host your site or you'll go down in flames" niche market.

If there wasn't such a potential for misuse, I think it would be a good idea.

Re:I think slashdot just found...

[benja]

Beat the rush and see the story early! Plus, we guarantee that the listed homepages of Slashdot subscribers will never be linked from a Slashdot article not submitted by the subscriber themselves.

stupid...

[jwthompson2]

This guy tried to extort the search engine that allows you to find almost anything including almost anybody and he was expecting to not get caught?

Stupid!

Re:stupid...

[SEWilco]

You forgot to include the obvious link: Michael Anthony Bradley

Would this really bother them?

[slavefishy]

Apart from being threatened, surely Google have sufficiently intelligent engineers to figure out a solution to this problem?

No doubt the software would follow a particular pattern, which even in a large amount of data, could possibly be tracked and with regards to things like open proxies, it would surprise me if Google didn't already check for things like that.

Re:Would this really bother them?

[Lord Kano]

Apart from being threatened, surely Google have sufficiently intelligent engineers to figure out a solution to this problem?

Aside from saving themselves $100k, they get to avoid the arms race. Their engineers vs. this programmer and the spammers. Over and over again, measuers, counter-meaures, counter-counter measures, counter-counter-counter measuers ad infinitum.

Besides, if they get this guy sent to PITA prison, that will have a chilling effect on the next poor schmuck who is thinking of fucking with Google.

LK

Re:Would this really bother them?

[PhuCknuT]

Wether or not google can find a way around it, or even if the guy didn't write the software he claims to, is meaningless. The (alleged) fact that he threatened to harm the company if they didn't pay him is extortion, and he should go to prison for it if it's true. It's that simple.

Re:It's not fraud

[no haters]

How is falsely inflating banner views and click-throughs not fraud? You are defrauding the company in order that they will pay you for advertising that was never "aired" to the public.

Google uses pop ups?

[slash-tard]

I havent seen any, I do use the google tool bar though.

BTW, I have also devised a program to simulate fake activity. Use any of the windows based graphical macro programs, load google, search, click the ad, save macro, repeat it in a loop. You could do this in multiple VMWare sessions if you wanted to increase your "productivity".

The fine line....

[Kailden]

For your Occupation, choose 2 of the following three:

1) Fun
2) Well-paying
3) Legal

This guy probably was legal up to the point of threatening Google. I guess that the fine line between the criminal mind and normal everyday greed.

Re:The fine line....

[PetWolverine]

I guess that the fine line between the criminal mind and normal everyday greed.

Exactly. Real criminals use the law to their advantage--see the RIAA for a case study. It's the fools who are too greedy that get caught; if you play it safe, you can get away with murder. As many previous comments have mentioned, imagine if this guy had gone straight to the spammers instead of effectively turning himself in in this manner. As it is, the technology will still get picked up by spammers and it's something that Google will eventually have to deal with--because while it's illegal even without the extortion (it's fraud), it's also not practical to track down all spammers and nail them to the wall.

However, as far as prosecuting spammers, this method, if widely used by them, may give us a new means--it doesn't require that spamming be illegal, since they commit fraud by using this method. Since fraud is illegal pretty much everywhere, there shouldn't be too many offshore havens for this sort of business.

Anyway, it'll be an interesting situation to watch develop, but no more so than the general circus that is our legal/political machine as it gets used to the whole "Internet" thing (or for that matter, the whole "Information Age"/"Third Wave" thing. the second wave is over, people! move on, let it die!).

Re:The fine line....

[rev_sanchez]

It's all in the marketing. He should have offered it as a "diagnostic tool" for their Ad Words feature and offered them an "exclusive partnership" with this project for $100,000.

Re:The fine line....

[jackbird]

For your Occupation, choose 2 of the following three:

1) Fun
2) Well-paying
3) Legal

Horseshit. You, sir or madam, are a sad, sad case if you believe that. That or your concept of 'well-paying' is completely outrageous.

Slashdot - weapon of mass debandwith

[Fullmetal Edward]

"Come out with your hard drives up or we'll send in the slashdotters and Shaft!"

The way of the future... Just wait till Bush catchs on, Cowboy Neal and Taco will be billionairs with an army of geeks on hand...

TO THE SLASHDOT MOBILE!

Re:Slashdot - weapon of mass debandwith

[Skater]

Slashdot gave away the PT Cruiser years ago!

--RJ

Re:It's not fraud

[Moonpie Madness]

He didnt click on banners and is not charges with doing so. He is charged with threatening to harm their ability to make money, the means to which are clearly wrong. He said 'gimme some money, or i release a nefarious program' that request is the crime, not the actions themselves.

Psst ... /.

[g0bshiTe]

I figured out and wrote a perl script to increase my karma. Give me $1200 worth of ThinkGeek stuff, or I'll post it in the forums!!!!

Interesting

[SirLantos]

A series of funny quotes come to mind: 'You want I should break your links?' 'Mario, I need you to 404 this site.' 'I will ping flood you so fast, you wont know what hit you.' 'I host your site. You've never google me. You dont visit my page. And now you want me to bring down this site. What am I supposed to think?' 'Johhny, I swear, I'll get you your page hits. I just need some more time.'

Re:Interesting

[Mudcathi]

"Pay up, else youse sleeps wit da phishes!"

Re:Interesting

[RedBear]

'I host your site. You've never google me. You dont visit my page. And now you want me to bring down this site. What am I supposed to think?'

I swear to GOD, I saw this EXACT string of sentences in a private forum the other day!

Or, putting that in terms we can all understand...

[TrekkieGod]

1. Find random website
2. E-mail admin, and threaten to bring site down by posting story on slashdot
3. ???
4. Profit!!!

Very similar to the google case, I think step 4 only applies to the lawyers

What a daft bugger.

[ackthpt]

Spammers don't need programs like that. People who have ads on their web pages and want to generate hits on the ads would want that.

Spammers, on the other hand, have now moved onto blogs lately. Fred Rodriguez, a rider Emeryville, CA, for italian team Aqua e Sapone has spams for the usual penis enlargment, diet pills, cheap computer eqz, etc. on his guest book. Spammers got no shame, just like this fool.

Re:What a daft bugger.

[good(k)night]

I think "Spammers" is a synonyme for "Bad people" nowdays

sloppy work

[The Clockwork Troll]

He was very easy to track down. Apparently, a red flag gets raised at Google whenever anyone actually clicks on those ads. So, they eliminated the guy who needed ink jet cartridges and sent the police in.

Maybe Linux Today can do it!

[Moonpie Madness]

Maybe Linux Today can ask for money from major media outlets to prevent them from linking.

Googling

[kc0re]

"How to hack google.com" AND "how to code"

How IS it fraud?

[Anonymous Coward]

"How is falsely inflating banner views and click-throughs not fraud?"

You'd be better off asking if it IS fraud.

"You are defrauding the company in order..."

No fraud is possible doing clicks like this. The crime is the guy's extortion threat.

Advertising on WebPages is a Joke

[stecoop]

Every SlashDotter should click on every advertisement that you see on Slashdot. Slashodot will get paid and the advertisers will get a heavy bill - everyone wins.

That would be a nice technology to add to Mozilla 1.x where it automatically hides the advertisement and treats it like a click through where advertisers get tired of paying out.

Re:Advertising on WebPages is a Joke

[Lord Kano]

Every SlashDotter should click on every advertisement that you see on Slashdot. Slashodot will get paid and the advertisers will get a heavy bill - everyone wins.

Not necessarily, all of the extra traffic might lead the mid manager types think that banner ads and popups are working. I'm just waiting until the day that they start paying you to tattoo ads on your forehead.

LK

Re:Advertising on WebPages is a Joke

[stecoop]

Yeah - Cause and effects are difficult to predict concerning opinion and forecasting.

I swear one of the web pages today that was slashdoted couldn't even show an advertisement because it was so loaded... Ironic huh?

Re:Advertising on WebPages is a Joke

[jasonjacks0n]

That would be a nice technology to add to Mozilla 1.x where it automatically hides the advertisement and treats it like a click through where advertisers get tired of paying out.

Actually, I've seriously considered writing a plugin along those lines.

My idea is more of a "reward" thing .. basically, I don't particularly want to be bothered by ads, but it would be nice if I could click on a toolbar button called something like "reward 'em" and moz would do a virtual click on every ad on the page, but loading the results into a hidden window (or, in other words, retrieve the content but never display it). Maybe moz could even do it automatically (optionally of course) .. I have a fast connection and mostly wouldn't even notice the difference.

That way I can help ensure that my favorite sites have a revenue stream .. think of it as a guerilla micro-payment scheme.

Re:Advertising on WebPages is a Joke

[trippccn]

Albeit a great idea, in the end this would actually hurt the /.'s of the world because advertisers would find that their advertising dollars are less and less effective, pulling their budgets. Combine that idea with this:

When you want to buy something, say a w00t shirt from thinkgeek, instead of going straight to thinkgeek, if the user had a small search application that would instantly pull up the thinkgeek banner ad from one of their favorite publishing sites and auto-clicked on it, both the click AND the sale would be attributed to /.

Re:Advertising on WebPages is a Joke

[KingOfBLASH]

Creating a Mozilla extension wouldn't be that hard to do exactly what you are suggesting. However, it is important to remember that advertisers advertise on sites because some percentage of the eyeballs they get buy things. If every slashdotter clicked through and didn't buy anything automatically, they would see a much larger payout for a much lower percentage return, and would pull their ads. Pay the $5 for a subscription if you want to help out /. instead.

Also, some places you advertise on charge a fee for just having the ad seen (google). In this case, you are helping the site even if you aren't clicking through.

Re:Advertising on WebPages is a Joke

[jasonjacks0n]

Albeit a great idea, in the end this would actually hurt the /.'s of the world because advertisers would find that their advertising dollars are less and less effective, pulling their budgets.

Yeah, that's definitely a downside to it. If everyone used it, it would self-defeat. But, given the marketshare of moz/firefox combined, and the even smaller number of people who go to mozdev and install any plugins, I don't imagine it would be much of an issue, at least not right away.

When you want to buy something, say a w00t shirt from thinkgeek, instead of going straight to thinkgeek, if the user had a small search application that would instantly pull up the thinkgeek banner ad from one of their favorite publishing sites and auto-clicked on it, both the click AND the sale would be attributed to /.

Yeah, I really like that idea too. Basically anytime I purchased something from amazon or thinkgeek, or whatever, I could credit one of my favorite sites. On the other hand, I don't know of a way to actually implement this ..

Re:Advertising on WebPages is a Joke

[anotherone]

Unless the advertiser is smart, in which case they will realise that they're paying a large amount of money with no increase in sales. Then they will stop advertising on slashdot, and slashdot will lose money in the long run.

Re:Advertising on WebPages is a Joke

[trippccn]

Off the top of my head neither do I, but I'm sure it wouldn't be too tough. Commission Junction hijacking was a problem for awhile where spyware could take every transaction an infected host makes and credit that towards a CJ account, i'm not sure if this technology is relevant to the application we were talking about, but maybe...

Re:Advertising on WebPages is a Joke

[Wycliffe]

>
>Also, some places you advertise on charge a fee for just having the ad seen (google). In this case, you are helping the site even if you aren't clicking through.
>

Yes, some places still might charge for views, but google is not one of those. Google and all of the other major search engines only charge for clicks.

Re:Advertising on WebPages is a Joke

[KingOfBLASH]

No, that's not true. Google charges you a price per click through which is based on a number of factors -- including the number of times an ad has to be viewed before someone clicks it. So, no, they don't explicitly charge you for every view, but your cost per click goes up for each view that nobody clicks. AND, to add insult to injury, if your ads don't meet some performance criterion (number clicks / views) they get shut down, and your account gets charged $5 every 3 times you restart your ads.

Re:Advertising on WebPages is a Joke

[Wycliffe]

>
>your cost per click goes up for each view that nobody clicks.
>

I've never heard of this, and I would be very interested in proof of your claim of the CPC being adjusted up based on the CTR(click thru rate). Even if this is true (which I would be very surprised if it is), you can control you max CPC, and you NEVER get charged unless you actually get a click, so no, they don't charge for views. As far as shutting down keywords with low CTR, they have this policy for exactly that reason. They don't want to give unlimited free views to ads that noone is clicking on.

Re:Advertising on WebPages is a Joke

[KingOfBLASH]

Refer to the google adwords pricing page.

I quote, "Ad placement is based on a combination of maximum cost-per-click (CPC -- how much you are willing to pay per click) and clickthrough rate (CTR). This means that if you earn a higher CTR, you are rewarded with a lower actual CPC. Our system monitors your competition and performance and automatically charges you the least amount possible."

It's a relatively new thing, and I was pissed when my ads were shut down several times after it started.

Re:Advertising on WebPages is a Joke

[Wycliffe]

Hrm, I knew of that policy, but I always thought of it as a plus. I always thought of it as google giving a discount to high CTR users. I.E. I can get position #1 for .25 instead of .50 if my click thru rate is high, so this actually causes google to get less per click than they would otherwise, but still net the same therefore helping them maintain the quality of their ads without affecting their income. To me, I've always thought of it as a win-win situation for both google, the searchers, and the advertisers, but I guess it can also work against the advertiser if they have keywords with low CTRs and are trying to outbid someone with high CTRs.

Story Full of Errors?

[0x0d0a]

I've yet to see Web-based advertising of Google, much less pop-up advertising. This makes me think that the story is simply wrong, and reversed the roles.

* Google does not provide "pop-up ads". They provide text-based ads.

* Google does not pay website owners for AdWords. The owners pay Google to for advertising space on Google.

This is my 5000th post.

Re:Story Full of Errors?

[Exodious]

* Google does not pay website owners for AdWords. The owners pay Google to for advertising space on Google.
Not true. You can use their adsense program. I think /. uses it sometimes as well.
http://www.google.com/services/ http://www.google.com/adsense

Re:Story Full of Errors?

[karmaflux]

I've yet to see Web-based advertising of Google ... This is my 5000th post.

And you've never seen, in five thousand posts, an ad for Google on slashdot? Wow. I thought I was a real slashdotter for not reading the articles, but you've shown me the way: shut your eyes and touch-type.

Re:Story Full of Errors?

[nsingapu]

Google does not pay website owners for AdWords. The owners pay Google to for advertising space on Google.

Google does pay website owners for displaying adwords, in its adsense program.

The problem with the guys attempted extortion is that google charges advertisers more then it pays out on the adds, and as such this guys program, if sucessful, still makes google a buck. That said the amount advertisers pay on adds is determined by a number of criteria such as CTR (which is why googles adds are generally of good quality; better, more relevant, and therefore more clickable adds can be put in top positions for less then irrelevant adds) and as such something of this nature could potentially really screw up advertising related statistics and revenue for google.

Re:Story Full of Errors?

[0x0d0a]

Well, I've been using privoxy recently, which pretty much completely eliminates ads, but I've used enough non-privoxied machines that I would have expected to hit a Google ad. I've seen TV ads for Google, but certainly not a banner ad. I take it that they *are* present?

Re:Story Full of Errors?

[Quattro Vezina]

And you've never seen, in five thousand posts, an ad for Google on slashdot? Wow. I thought I was a real slashdotter for not reading the articles, but you've shown me the way: shut your eyes and touch-type.

Actually, I use AdBlock on Firefox. It eliminates all those pesky ads. So I've not seen an ad on /. for a long time. And before I used Firefox, I don't think I've seen a Google ad. Plenty of ads for webhosting companies and the like, but no Google ads.

Re:Story Full of Errors?

[hikerhat]

PEBKAC. The article isn't about AdWords.

robots as websurfers

[nuffle]

This brings up some other related concerns about having robots browse pages, even when the intent is not malicious.

Some ads on websites are sold 'per-view' and not 'per-click', but if a web-crawling robot hits it, should it count as a view? Are the authors of these bots stealing from the advertiser?

A while ago I wrote a bot that posts to slashdot. He even had decent Karma for a while, before getting a bit confused. In any case, my bot would usually post some links in his comments, which could have the effect of altering the target's page ranking on Google (this was not his purpose though). Am I somehow culpable for cheating Google?

Anyway, the point is that I think robots should have some limited rights to view pages and do human-like behavior on the net.

Re:robots as websurfers

[Lord Kano]

Are the authors of these bots stealing from the advertiser?

No. Better yet, FUCK NO!

I'm sick of this shit, people don't get it. Just because someone does something that you don't like, such as skipping commercials in PVR'd tv, using a spider to index webpages or downloading a Britney Spears MP3, that doesn't mean that they're stealing!

Re:robots as websurfers

[Anonymous Coward]

A while ago I wrote a bot that posts to slashdot.

From the looks of things, you're not alone in that.

Re:robots as websurfers

[man_ls]

skipping commercials in PVR'd tv: correct

using a spider to index webpages: correct

downloading a Britney Spears MP3: incorrect

but 2 out of 3 isn't bad I suppose......

Re:robots as websurfers

[Anonymous Coward]

Anonymous Coward,
Why do you say, you're not alone in that?

Re:robots as websurfers

[Lord Kano]

downloading a Britney Spears MP3: incorrect

Then please tell me why is it that the RIAA has never had someone prosecuted for theft. Theft is a state matter, they invariably use copyright law. That's a federal matter. Arguably far more serious than theft.

LK

Re:robots as websurfers

[Psychic Burrito]

A while ago I wrote a bot that posts to slashdot. He even had decent Karma for a while, before getting a bit confused.

Coool! Now that you stopped your experiment, show us some links to the messages that it posted! I'd be interested in reading them! :-)

Re:robots as websurfers

[Lord Kano]

Well, I think you just answered your own question: The RIAA is going for the crime with the more severe consequences for the offender.

Unintended consequences. Until someone is actually convicted of theft, copyright infringement is not theft.

I don't understand...

[Serious Simon]

...why he thought spammers would use this software to raise costs for Google? What would be in it for them?

Re:I don't understand...

[walter_kovacs]

The idea is to push your competitors out of the competition by costing them tons and tons in click throughs, so you have the ad space all to yourself. You also pay less per click if there are no competitors for a keyword.

Re:RTFA

[Moonpie Madness]

I know, I did read the article, i just am incoherent. The clicking itself is only fraud in virtue of the threat

Anyone remember AllAdvantage?

[cr@ckwhore]

Anyone remember the company AllAdvantage (was that really the name?) that paid users to click on ads during the dotcom boom? I remember almost everyone was into it ... people were making hundreds, even thousands of dollers per month.

Of course, none of the ad traffic was legitimate! There were tons and tons of scripts and programs that would click the ads for you ... set it up to run all night, go to sleep, wake up rich in the morning. That's probably why the thing was so popular!

I remember the comany would implement anti-cheat methods every couple of weeks, even to the point of tracking mouse movements ... the idea being that if the mouse wasn't moving, but clicks were coming in, then it was a cheat.

Ok, well... as always, cheaters take things to the next level. The ultimate cheat was one that surfed the web from a pre-determined list of web sites, while randomly moving the mouse cursor around the screen, and clicking every couple of seconds. Worked like a charm!

No more AllAdvantage.

Google has more sophisticated technology than AllAdvantage though... its almost impossible to cheat google. Even if this dumb-ass really did write a program to click ads on his own sites, google would catch that. There's AdSense partners getting canned every day for suspicion of cheating, when sometimes it's only as simple as an innocent erroneous click on their own ads. It happens... check the adsense forums. I doubt this guy would have been able to execute much of his plan successfully.

Re:Anyone remember AllAdvantage?

[leenoble_uk]

Dagnabit. You waited until now to tell me that AllAdvantage had finished. I just thought I hadn't built up enough points yet. Damned thing's been taking up 80 pixels of my monitor height. I'm startin' to get screen burn there.

Re:Anyone remember AllAdvantage?

[CGP314]

Wow, I forgot all about AllAdvantage. I still have an old website on fortunecity.com plugging that service. (I sadly want to gain control of that site again, but I forgot my username/password)

As I remember it, you didn't get paid for clicking on the ads, AllAdvantage displayed a banner ad on the bottom of your computer and paid you to `look' at it. But all it really kept track of was if the mouse was moving.

I had a friend send me a script to move the mouse around while I slept, but AA cought on to that pretty quickly.

So, I just tied my mouse to a rotating fan. Sometimes the simplest solution is the best.


-Colin

Re:Anyone remember AllAdvantage?

[hetairoi]

Oh man, I had forgotten about AllAdvantage. They had the greatest business model EVAR!

Well ... for the consumer anyway.

Re:Anyone remember AllAdvantage?

[carn1fex]

Ahh but what about Fatshoe.com? where they had a listing of tons of ads, surveys, etc you could click on thru the site and the money would go right to a debit card you were issued. Amazing! Brilliant! .. well.. apparently no one wanted to sit clicking around for an hour to total up $1.50. Long live the 90s!!! In any event they cleaned house by selling the software that allows the system to work.

Was he also wearing. . .

[Fantastic Lad]

a pair of those blinking Nikes while running away from the cops?

-FL

this never would've happened...

[irokie]

this never would've happened if they didn't offer google in "hacker"

Am I missing something here?

[Afty0r]

Or is there no incentive for a spammer to use this? Who was this guy going to sell the software to, it has no value except to a person who specificaly wants to devlue Googles adspace.

Re:Am I missing something here?

[walter_kovacs]

The idea is to push your competitors out of the running by massively inflating their advertising costs, so you have the space all to yourself, and thereby also end up paying less per click yourself.

Re:Am I missing something here?

[mog007]

A few sites come to mind.

Prior art!

[AndroidCat]

I received spam that tried to generate fake click-throughs a couple years ago. I could dig out a copy of the LART I sent with the code used to the company that was being defrauded by the fakes. (I'm sure they were real impressed with the spammer.) Nothing new here.

Or is this like the "on the Internet" patents? "I have a spam scam that really works--on Google!"

Idiots

[screwballicus]

If only the world's more malicious traders in contraband goods would use this method.

"See, I have this cache of weapons in my house, and I'll sell them off to criminals at some point if you don't give me the money!"

"Wait...SWAT Team? What SWAT Team?"

"Outside my house?"

Paddy Power.

[Kiffer]

A harbinger of organized crime to come? That's a real nice website you have here... a shame if anything were to happen to it..."

Allready happened in Ireland with Paddy Power

http://www.business.com/directory/media_and_ente rt ainment/amusement_and_family_entertainment/paddy_p ower_plc/news/
and
http://www.cnn.com/2004/WORLD /europe/02/23/online. hackers/

or just google for Paddy Power and hackers

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:It's still not fraud

[Moonpie Madness]

exactly driving a car is not a crime, but if you drive a car over a person or away from the bank you robbed it is criminal clicking is not a crime, but threatening to click a bunch to ruina business unless they pay is criminal

Maybe I'm dense, but...

[Artifex]

even though Google pays websites a certain amount per click, doesn't it also charge the advertisers placing the adwords at least as much?

Doesn't that mean it's not Google that would be defrauded, but the affected advertisers?

No results, but five advert boxes

[blorg]

Ironically, while that exact search does actually come up with 0 results, there are 5 'sponsored links' offering 'Secrets behind AdWords', 'Create AdWords Cash' and so on...

Re:No results, but five advert boxes

[Minwee]

The "Make $3000 a month using Adwords" link looks like the closest thing to what we were searching for.

I wonder how long it will take for my Adword to make it to the top of the list and people to start sending me tons of money...

I did the same thing....

[DeionXxX]

I uhhh... made the same program last year in January or so at a client's request. I was skeptical that I could defraud Google's AdWords, but I ended up being successful. Out of respect, I never gave the client's his program even though it worked and sent it over to Google and told them about their vulnerability.

Defrauding Google, is like defrauding a family member or something...

I'm glad this ass got caught.

-- D3X

Re:I did the same thing....

[pigscanfly.ca]

I have actually seen a lot of these sort of things on scriptlance . They tend to be labelled as "fake hits" and whenever I ask them why they want the software they want it to "test" their banner exchange or something similar....

Re:It's still not fraud

[Moonpie Madness]

i understand what you are saying, but i still disagree. the clicks themselves are part of the problem. If I were stalking a girl, my talking to her on the phone would be illegal speech invirtue of what they were a part of. obviously speaking to others is not a crime, though when it is part of a pattern of harassment or extortion each action is a crime. and it is fraud, it is an attempt to impersonate a clickthrough human when in fact its a bot. This may not seem like much, but it is fraud in the literal sense

Um,,,

[Lord Kano]

Is this really illegal? Seriously.

I mean, he created a product. He was planning to sell it, but if Google is better served by that product not making it to market isn't it common sense that they might want to buy it?

For example, if I developed a way to run my automobiles using water as fuel or to get 200 miles per gallon of gasoline ,I'd offer to sell them to the big oil companies before I went to Ford and GM.

LK

Re:Um,,,

[Ill_Omen]

The problem is that this guy's (alleged) program's sole purpose was to commit fraud.

To continue your gasoline example, it'd be like developing a method to fool the 'pay-at-the-pump' system into giving you gas without actually charging your credit card, and then telling the gas station that if they don't give you $100,000, you'll publish the program in the USA Today(tm).

Re:Um,,,

[Lord Kano]

To continue your gasoline example, it'd be like developing a method to fool the 'pay-at-the-pump' system into giving you gas without actually charging your credit card, and then telling the gas station that if they don't give you $100,000, you'll publish the program in the USA

I suppose that it's all in the approach.

I'd call it extortion if the approach was like this "If you don't give me 100,000 dollars, I'm going to release this product that can be used to defraud you." I wouldn't call it extortion if the approach was like this "I have a product that can be used to defraud you. Some people have expressed an interest in this product. I'd like to offer you the chance to buy all of the rights to this product and do with it whatever you choose. My asking price is $100,000. What do you say?"

The devil is in the details.

LK

Is this Extortion?

[N8F8]

Sounds like capitalism to me.

Re:Is this Extortion?

[mabu]

How can you tell the difference these days?

Ha ha, but AdWords among most effective ads on net

[blorg]

If I'm actually looking to buy something, and I see an ad that is *relevant*, sure I'll click on it. We advertise heavily on AdWords ourselves and get a phenomenal amount of traffic on them, with click-throughs over 25% on certain keyword combinations.

Re: I believe we are talking about the sidebar ads

[Anonymous Coward]

I believe that we are talking about the google sidebar ads. This program could be devastating for a small time organization trying out the ad system provided as a single run could quickly bust the advertisement budget - Contrary to what someone else mentioned it does not take a DDOS like run or attack to do that, just target the specific keywords that a site uses and bam! Disaster is knocking. Hope google at least makes sure the clickthrough is based on unique IP's in the future. That would make it a little harder for such a program... but alas not impossible.

Am I the only one...

[Xenographic]

Who saw the headline and thought that this was a dupe of that CPA suing Google for the not-quite-right summary of the disciplinary action against him?

Funny thing is, it doesn't feel very different, even if one is legal and the other is not...

Organized crime is already in on it

[Len]

A harbinger of organized crime to come? That's a real nice website you have here... a shame if anything were to happen to it...

This has been going on for a while. Just last week, for instance, some bookie sites in the UK were DoS'd and then received demands for money.

Re:Organized crime is already in on it

[SySOvErRiDe]

As reasoned by the Patrician of Ankh Morpork, "if you were going to have crime, it at least should be organized crime." ;)

Re:Psst ... /.

[Anonymous Coward]

I figured out and wrote a perl script to increase my karma. Give me $1200 worth of ThinkGeek stuff, or I'll post it in the forums!!!!

Awww, crap, you too? That's common knowledge:
num=int(rnd(0)*5)
select num
MSG="Microsoft sucks."
MSG="Linux rocks!"
MSG="MPAA is bad."
MSG="RIAA is evil."
MSG="This is a repost. Duh!"
end select

printf $MSG

My guessing the specs

[Felinoid]

Google dosen't just have text link adds on Googles website. They also have ads on OTHER peoples websites and pay those websites for that.

With out banner adds or pop ups (Thwap the guy who called Google ads POP UPS) you'll need some software on your server to make this work.

Im guessing this guy hacked this software so he can send bad any data he wants and is expecting Google to act like Microsoft and pay to keep it quiet.

He picked the wrong target. Find a defect in Windows.. a nasty one.. and bribe Microsoft to stay quiet. They appear all fine with the extrotion scams and all about security by obscurity.
(I'm joking BTW.. Try that and Microsoft will thump you something nasty AND clame your defect is fraudulent)

Re:My guessing the specs

[bobsledbob]

They also have ads on OTHER peoples websites and pay those websites for that.

I assume you're referring to AdSense?

you'll need some software on your server to make this work

AdSense uses javascript. You place a small script on your webpage, and the rest of the script is downloaded from Google's website.

Im guessing this guy hacked this software so he can send bad any data he wants

Therefore, since it's javascript, the program runs between the client and Google's server. There's nothing that really "runs" on the originating website server.

The only way that this guy could have done what he claims would be to automatically request a page with an ad running on it, screen scrape the page for the ad link, then request the ad link. They use a random "key" of sorts with every ad displayed, so it's not like you can just repeatedly "click on" the same url over and over. Once the key has been clicked on, it's no longer valid for any more clicks.

Also, Google would obviously be monitoring IP addresses, so for this threat to have worked, he would have had access to multiple machines across the internet. It's not like you could just request the ad link with a spoofed IP either, since Google has at least one redirect in their reply. The zombie client would have to at least receive and follow the 301 redirect back from the Google link in order to count as a click.

Google syndicate their ads through AdSense program

[blorg]

Now how do you suppose he's going to make any money at that?

Google have a programme called AdSense in which they put Google AdWords on other websites - I'm sure you've seen them around the net. He could have set up a website, signed up with AdSense, and then had his clicking program click away on those ads on his own website. Result? A cheque from Google for the clicks.

Too late

[pjt33]

You missed it

Re:This is done all the times

[SmackCrackandPot]

It's not simply a case of buying the technology and canning it. It's more a case of buying the technology, incorporating it into existing projects, and moving the engineers onto something else (Non-Compete Agreements work wonders).

It also happens internally within corporations. A new division gets set up to target a selected marketing segment. They then start to grow and begin to compete against existing divisions. The existing groups respond by stating to management that the new divisions would fit well within their long term goals - and a re-organisation takes place. Very smooth.

This is better done by people

[slappyjack]

THe really good way to do this is to get a message out on some site like /. that has a huge volume of readers and get them to each do it a couple of times a week. That would make it look like real traffic.

Its like the days of overture where they would list the amount that companies were bidding per click right in the search results. I greatly enjoyed searching "Bulk Mail" and "Mass Mailer" and then clicking through the top ten sites, most of which were paying a buck or two PER CLICK.

Fast way to cost the scumbags a little money and get them nothing for it. Get 100,000 + users all do it in a week and you've suddenly cost them a LOT of money.

try it. It takes about five minutes, is a nice relaxing little clickfest, and its fun!

and you don't even need to know how to write code to do it.

Re:This is better done by people

[LetterJ]

A buck or 2? You should check out what they're paying in categories like home mortgages. In lots of those categories, the rates are closer to $10-15 PER CLICK. In most categories of pay-per-click engines, it's really difficult to stay under $0.50 or even a dollar.

Re:This is better done by people

[tanguerilla]

Heh, no shit, it would be real traffic!

saying that it'd be easier to organize a 100,000+ person click-through campaign then to write a satisfactory program is rediculous.

Re:This is better done by people

[slappyjack]

What I'm saying is that if you got on a site like this where people actually follow links they see, you'd EASILY get 100k hits within a few days, scpecially when you consider the basic bent of the average /.er

that is all.

Re: I believe we are talking about the sidebar ads

[DrSkwid]

This program could be devastating for a small time organization trying out the ad system provided as a single run could quickly bust the advertisement budget

There is a reason you set your maximum spend budget in the adwords settings before you go live.

Ok, I know this is nit-picky...

[mystery_bowler]

...but...

extortion != organized crime

This is one programmer acting alone (and stupidly). Organized crime requires an organization. If the programmer had been hired by someone else who had the idea to extort Google but not the technical know-how, this would be organized crime.

Re:Wacky myths

[goatan]

Check out when the car seat-belt was introduced. Exactly when the patent expired! It was offered to all car manufacturers to save lives - exactly none of them touched it, untill the patent expired and they did not have to pay for it

Untrue As the following timline shows there were seat belts of diffrent types on cars before and after the patent was issued

1930's Several U.S. physicians equip their own cars with lap belts and begin urging manufacturers to provide them in all new cars

1954 Sports Car Club of America requires competing drivers to wear lap belts

1955 Society of Automotive Engineers (SAE) appoints Motor Vehicle Seat Belt Committee

1956 Volvo markets 2-point cross-chest diagonal belt as accessory For and Chrysler offer lap belts in front as option on some models Ford begins 2-year ad campaign based on safety, focusing heavily on belts

1957 Volvo provides anchors for 2-point diagonal belts in front

1958 Nils Bohlin, a design engineer with Volvo in Sweden, patents the "Basics of Proper Restraint Systems for Car Occupants," better known as a three-point safey belt. The device comprises two straps, a lap strap and shoulder strap. ** Volvo provides anchors for 2-point diagonal belts in rear

1959 Volvo introduces 3-point belt in front as standard, in Sweden

1961 SAE issues standard for U.S. seat belts (J4) Standards Association of Australia issues standard for "safety belts and harness assemblies"

1962 U.S. manufacturers provide seat belt anchors in front outboard as standard

1963 Volvo introduces 3-point belt in front as standard, in USA SAE issues revised standard (J4a)

1964 Most U.S. manufactures provide lap belts at front outboard seat positions Victoria and South Australia require seat belt anchorages at front outboard positions in new cars (either 2- or 3-point permitted)

1965 U.S. Commerce Dept. issues first seat belt standard (adopted SAE standard) SAE issues revised standard (J4c) Some U.S. manufacturers provide automatic locking retractors (ALRs) in front seat belts

1966 Swedish regulations prohibit 2-point cross-chest diagonal belt at seats next to a door, and Y-type of 3-point belt altogether U.S. Commerce Dept. issues revised seat belt standard (SAE j4c) Sports Car Club of America requires competing drivers to wear a shoulder harness as well as a lap belt (perhaps 1967, according to ref. 131)

1967 Society of Automotive Engineers study at UCLA leads to calls for two-point seat belts, highback seats and other occupant protection strategies for school buses. Volvo introduces 3-point belt in rear as standard, certain markets Great Britain requires 3-points in front outboard positions Australian standard for belt anchorages issued South Australia requires seat belts (lap belts OK) at front outboard positions

1968 Volvo provides emergency locking retractors (ELRs) as standard in front, in Sweden Great Britain requires retrofit of 3-point belts in front in MY 65 and newer cars Many U.S. cars this MY provide ELRs. 3 point harness is now legislation in the US.

1969 Sweden requires 3-point belts of approved type in front seats. Volvo provides 3-point belt in rear as standard, all markets Mercedes-Benz adds 3-point belt in rear outboard seats as standard, all markets Japan requires seat belts, front and rear Australia requires 3-point belts, front outboard seats, all cars registered since 1965

1970 Sweden requires belts in rear (diagonal and static allowed; lap-only not approved) Victoria, Australia requires 3-point belts, front and rear and mandates use, front and rear

1971 Volvo provides ELRs as standard in rear, all markets NHTSA amends FMVSS 208 to require passive restraints in front, to be effective

1973 New South Wales requires use of seat belts

1972 Volvo introduces adjustable B-post anchor point (not standa

Pop-up's?

[xanadu-xtroot.com]

...that creates phony clicks on pop-up advertisements delivered by Google.

Since when has Google had pop-up ads? Granted I only use Konq and Mozzie, but this is flat-out news to me since I've never even read it complained about.

Tangent: "software program"

[mwood]

I always wonder when I see that seemingly redundant expression. I mean, what would a hardware program look like?

Okay, *theoretically* there could be a need to distinguish a computer program from, say, a TV program or a spending program or a concert program, but really, how likely is it that a computer programmer is threatening an information service company with information about who's playing second violin tonight?

o sure,.,,,

[MoFoQ]

o sure, a man does it and it's illegal...but if an organization/company does it, it isn't immediately determined by the law as extortion. (though in Germany, SCO was literally told to STFU until they can prove their claims with real evidence).

Re:Pop-up's? -- Maybe they were confused

[fuzzybunny]

Google doesn't, and this is outside the scope of this article, but I've seen phony pop-ups delivered by quite a few scam sites. They'll use the (now "fixed") IE bug of URL forgery (create a link using http://www.google.com%01%00@badsite.com and IE only ses http://www.google.com), have badsite.com be nothing but a pass-through redirect to google.com with a few web bugs and stuff, and pop up an ad purporting to originate with google.)

You get this quite a lot with amazon and paypal among others, both for people phishing for account details, and for unscrupulous advertisers trying to present their 'product' as something originating with the legitimate site that loads in the background.

Microsoft issued a patch which flat-out prohibits use of '@' in http URLs without some registry changes. Maybe the authors just got their facts mixed a bit.

Re:It's not fraud

[OneHungLo]

"defrauded Google"? No, clicking on banners is not fraud. When will this abuse of criminal terms ever end? It is a losing battle with the liars who says "copyright infringment = theft" already.

It's comments like this that make me wish I could mod them "-1, Dumbass".

Top 100 spammers

[aapold]

Hey, he knows how to find the top 100 spammers. That's gotta be worth something...

Similar trick...

[D. Book]

Most websites with ads these days use third-party ad networks such as ValueClick. And as someone who runs such a site I've always been worried about the possibility of this one: if some kiddie dislikes me or my website for whatever reason, it's child's play to starve it of ad revenue. Just point your proxies my site's ads and make them click. The ad network will see the click-through ratio skyrocket, and instantly conclude I'm attemtping to defraud them. My account gets suspended. The site is starved of ad revenue, and possibly blacklisted so I can't just move to another network.

For years I've worried about this more than I do about DDoS attacks, wondering how long it would be before the kiddies take to this kind of attack. So far they haven't.

Re:Ha ha, but AdWords among most effective ads on

[0x0d0a]

If I'm actually looking to buy something, and I see an ad that is *relevant*, sure I'll click on it. We advertise heavily on AdWords ourselves and get a phenomenal amount of traffic on them, with click-throughs over 25% on certain keyword combinations.

"Sex-crazed underage lesbians?"

Don't get me wrong, I think that Google's ad system is the best thing since sliced bread, but 25% for any terms that I can think of seems absurd. Even if you simply inserted part numbers for products you sold (eg "AZR-3120"), you'd still run into people just searching for data on those parts.

Uhm, why not link to the article at the source?

[SGHarms]

The first line from the linked page (that does not seem to load in non glacial units of time measure) at miamiherald.com is that the article was picked up on the wire from a San Jose Mercury (arguably the best tech-sensitive newspaper around) story?

It's not like the Merc isn't used to getting a bazillion referred hits from /.

Re:Who clicks on those insipid ads anyway?

[PetWolverine]

I like the Carlin quote, but Google's ads are not the typical annoying pop-ups--they're text-only, unobtrusive, clearly separated from non-paid search results, and as a consequence of these things, they're some of the most effective ads left on the 'net. That's in terms of click-throughs, conversions into sales for the advertiser, and revenue for Google. Seeing as how the Internet briefly thrived on advertising commissions until the ads became so ineffective that nobody would pay for them, any method that promises to return the value to online advertising holds the potential to bring back the .com boom in a more sustainable (and sensible) way. Google does this by seeing the value that ads can provide to the advertisee; sometimes, especially when looking for a place to buy something, Google's paid results are more relevant than the normal PageRank-based ones. Anything that threatens Google's ability to deliver good value both for the advertiser's money and the customer's time threatens, at least in principle, all that this new model promises for the Internet economy.

In practice, of course, I'm sure Google's brilliant engineers can find a workaround and start another technology race with the spammers. Whether or not they stay ahead, they'll surely keep their collective head above water--or we'll see a new business model arise out of Google's ashes, and eventually one of these models will just have to work.

George Carlin on intelligence

[0x0d0a]

I think it was Carlin that said, "Think of how dumb the average person is... Half the people are dumber than that guy." Scary.

Carlin is almost certainly wrong. He is only correct if the following points are true:

* he's using the uncommon "median" definition of average (if he was using the more common "mean" definition, it would be extremely unlikely that he was correct, since there would have to be a distribution that splits exactly halfway at the mean intelligence point).

* There are not an odd number of people. If there are an odd number of people, fewer than half of the people out there are necessarily on either side of the median.

* Whatever metric Carlin is using for intelligence does not rate the two people used in calculating the mean to determine the median value as having the same degree of intelligence. If he is using something as roughly grained as an IQ score, for instance, he would certainly be wrong. (If he were, a number of people that would have been to one side of the median would be equally dumb as the median value, preventing half of the people out there from being dumber).

Re:George Carlin on intelligence

[anotherone]

Yeah, and he totally fails to take into consideration the people who are actually dumb, but try to appear smart by laboriously picking apart a joke and posting about it on slashdot!

Re:George Carlin on intelligence

[flosofl]

You must be a total riot at parties...

What do you do for an encore? Deconstruct Winnie the Pooh so little children won't be "deceived" by those deliberately decietful stories.

While not being technically correct (as far as terminology goes). We all (well, most of us .. not you, obviously) understood Carlin's joke.

I thought statistics was a bad memory from years ago. Thanks for reminding me of my professor. I swear, you just sucked the joy out of the room...

Umm.... Why are you guys here?

[novakane007]

The Secret Service? Aren't they supposed to look after the presidents (present & past)?
Why wouldn't this be an FBI case?

25%, I shit you not

[blorg]

That 25% is only on a few very specific search phrases, but we honestly do get that high on those phrases. The reason is that for those phrases we are more relevant than the actual search results *in our geographic area*.

We get 10%+ click-through on the most completely generic term for the site. It could possibly be higher, but we also rank first in the normal search results for that term, if you limit your search to one particular country or use the country name as part of the search. Being able to limit AdWords to individual countries is one of the great things about Google - Overture isn't half as good in this regard.

Our *average* click-through over all phrases is much lower, at 3%, largely because with a lot of the other product words we use, people *would* be just searching for information on the product, rather than with a view to purchase. We could raise the click-through by only displaying ad if the search term included words such as 'buy', 'purchase', etc. but 3% is well above Google's cut-off and we aren't paying for the extra impressions, only the clicks, so this suits us fine. We still rank first on most of these search terms (e.g. competing AdWords are seen as less relevant).

downloading a Britney Spears MP3: incorrect

[hummassa]

... besides the bad music, there is nothing incorrect about this in general, p. ex., if you own a CD-version of the song, you have the right to do it.
At least in my jurisdiction... ;-)

Re:downloading a Britney Spears MP3: incorrect

[Minna Kirai]

if you own a CD-version of the song, you have the right to do it.

Even if you have no right to the song, it's not theft. "Doing something without permission" isn't theft. It might be infringement, fraud, or trespassing, but unless you take away something the victim already had, no theft has occured.

Re:downloading a Britney Spears MP3: incorrect

[hummassa]

I only commented in terms of correct/incorrect. IMHO, copyright infringement is incorrect. BUT downloading some MP3 isn't always copyright infringement and it's still more incorrect to let anyone treat it as if it was or to treat anyone doing it assuming he/she has done something wrong.

Re:downloading a Britney Spears MP3: incorrect

[Lord Kano]

"Doing something without permission" isn't theft. It might be infringement, fraud, or trespassing, but unless you take away something the victim already had, no theft has occured.

Exactly. It's kind of like trying to equate rape with theft.
He Stole the pussy!

Re:The future of advertisement...

[hiryuu]

Maybe you'll have to verify your humanity any time you want to search for something.

Or maybe advertisers will quit trying to quantify per-view or per-link and just pay (or be charged) a flat fee for a time-period run, something more similar to how things work on TV and radio. Rather than making an ad on the web accountable in ways that no other media is required, why not just assume it's getting you market-awareness and presence?

Re:selling fake click-throughs

[cayenne8]

"I considered doing something like this when I ran an ISP network - I could have spread my clicks through several class-Bs at the very least, or even made use of unused address space... but in the end, we realised that however clever we were with contract wording, it was still going to be fraud, and therefore illegal."

Interesting..and from reading this article, it does seem the guy was guilty of fraud, etc.

But, I'm wondering...if someone wants to do this, with no motive for profit or fraud....would it in fact be illegal at all? I don't know of any laws out there that make it illegal to use a program to cruise through sites, and make 'clicks' along the way......

google pays its clients?!?

[schodackwm]

uh.... Commander? Don't you mean the ad-posters (link targets) pay Google?

Re: I believe we are talking about the sidebar ads

[Ironica]

There is a reason you set your maximum spend budget in the adwords settings before you go live.

Yes, and then that budget is busted after a few minutes, and no one actually *sees* your ad.

Only with Google

[KalvinB]

was I able to make a little over $5 with only 3 clicks on the ads I'm displaying. I used Commission Junction for about a year and racked in 70,000+ impressions with about 7000 click thrus. Didn't make a penny. That's why I went to a subscription based web-site. After a review not too long ago I decided to cut down the number of sections that require a pass. Those major sections that don't require a pass now have Google Ads.

The rate variance is why Google doesn't tell you how much a click is worth. It varies from a few cents to a few dollars and possibly more depending on the ad. I run a programming site so I get some expensive programming ads.

Google is being incredibly generous with their AdSense program and I would hope Google would be able to find a way to take out the idiots who try to abuse it rather than cripple the program.

At the start all ad programs paid decently for click-thrus but morons abused it and morons ran the programs so they couldn't deal with it. Or they simply decided they could make more money if they went pay per sale since the advertisers would get the same amount (or more since web-sites got desperite and would flood visiters) of exposure for a lot less money.

It's an absolutly retarded program from a publisher's view. You basically have to sell the ad. You have to dedicate the page the ad is on to the ad so that people will buy what the ad is selling. The standard is about a 1.0% click-thru rate. And of those you now have a fraction of a percent that will compulsive buy. I had one text ad with Commission Junction that did a 10% click thru rate. But I would only get paid if someone bought the book right then. Nobody did so I never got paid. But the seller got lots of free publicity.

One major game development web-site I know has basically signed up for every ad program on the planet and then ran it through their custom script that selects which program to display an ad from to the visitor. I noticed they have Google Adsense worked into the mix as well. I have to wonder how much that stupid monkey and other flashing banners are worth that they don't just stick with Google and dump the rest of the ad systems.

Ben

Re:Only with Google

[bhima]

Judging by the R&D section of their website I really would expect them to quickly defeat this attack.

It reminds me of ...

[Poligraf]

.. an old joke:
- Hey, missy, either you give me all your money or I will use this water pistol to wash away all of your makeup! ;-)

Not too original

[Anonymous Coward]

Posting anonymously because I should :)

Anyone remember those annoying click competitions that were popular last year? Someone sends you a link, you click on it, and you added one thug to thier gang or one prostitute to thier harem or something. The strongest gang/pimp/whatever at the end of the month wins a ps2 or other prize. Well, being the perl monk I am, I decided to help a friend of mine win himself a ps2.

First step was to get a list of proxies. Not too hard there. I remember 10-15 websites that listed anywhere from 100 to 2000 open web proxies each. I wrote a quick perl script to scrape the page for the host and port (was a nice script, even worked inside tables) and write them to a file. I has a second script that actually tested those proxies. I ended up with around 5000 working proxy servers.

The next step was to write a script to attach to the proxy, click the link, follow the redirect, load all images, and verify that everything worked. I love pthreads :)

Every day I'd run that script and he'd get another 5k thugs. He actually won 3 months in a row. I think he got a ps2, GBA, and a $200 amazon.com gift certificate (which he promptly gave to yours truly :).

Anyway, the point of this is that its not too tough to use proxies to defraud pay-per-click stuff. You can use it to your benefit to earn yourself some fradulent $. You can use it to your benefit to cost your competitors $ (via pay-per-click adwords). Or you can use it to vote in online polls (Ever wonder how those votes on MTV change drasticaly in the last few minutes? Thank Larry Wall!)

Re:Psst ... /.

[Anonymous Coward]

(Score -2, VB Programming)

Did he really expect them to pay?

[Rich Klein]

How could the guy expect Google to pay him not to run his program if he couldn't guarantee that someone else wouldn't come up with a similar program? Forget law and morals; he had nothing useful to sell to Google. Their money would be better spent finding and fixing any security holes.

Re:Clicking on ads is violence?

[kcb93x]

No, that would be offering Google an oppertunity at the product that bests theirs. Whereas this is a case of 'pay me money to shut me up or I'll cause your ad revenue to plummit and your results to be invalid.'

The first is legal, whereas the second isn't.

actually.. this idea has been around.

[joeldg]

get thousands of proxies.
use a nifty program like curl and randomize useragents/proxies etc.
query google as you go and get the ads.
click-bomb off your competetive advertisers first thing in the morning to blow away their daily limits for advertising.
watch your five cent per click ad be number one!
easy..

so, let me get this straight...

[The Lynxpro]

...when an individual tries to extort Google, the U.S. Secret Service gets involved. Yet when a *business* (cough cough) like SCO tries to do the same thing, its board of directors is free to do as they please. Yep, that's justice.

Re:so, let me get this straight...

[FreshFunk510]

It's not justice, it's politics.
Think about it: Who has more political clout, some random individual or Google? SCO or some open source hippies?

No you're not.

[kcb93x]

I thought that too...it seems like people are *really* starting to go after Google.

*Puts on tinfoil hat*

Maybe Microsoft is covertly sending money to these people, in an attempt to make Google look bad now, since they:

-Didn't give in to SCO's demands for protection money^H^H^H^H^H^H^H^H licensing fees.
-Is MS's biggest online competitor for search engines
-Sees Google as the Linux of search engines (quick, clean, easy, no popups/annoying ads etc)

Maybe I'm just parinoid, but perhaps Bill's throwing money multiple directions at once.

off topic

[The Queen]

That is the first dead milkmen sig I have seen, and I have been reading /. since '98. Yay!

Could technique be used to fight Spam?

[SilentScream]

I have always wondered if a technique such as this could be used to fight Spam. For example, the mortgage lending spammers supposedly receive referral fees from the mortagage companies. If you reverse-spammed the spammers' web sites with bogus leads wouldn't this cause the spammers' customers to pay exorbitant bills and/or dilute the value of the Spam referalls to such an extent that spamming would no longer be a viable business?

Extortion is alive and well online...

[leviramsey]

There's a few gangs based in Eastern Europe that are using Windows machines infected with viruses/worms to DDoS gambling sites unless $5,000/month in protection money is paid up.

And let's not forget SCO...

TCP Spoofing in a nutshell

[0x0d0a]

It amazes me the number of people that talk about IP spoofing. All their wild theories can be shot down by asking "What happens when you send out thatfirst packet and it comes back to confirm it?"

TCP spoofing is quite possible. It's just difficult, and has become progressively more difficult.

Say we have just the idea of a basic handshake (without worrying about the way TCP works for a moment). Host A sends a packet to Host C purporting to come from Host B. Host C sends a packet to Host B saying "you really want to open this connection?". Host A waits a short period of time, then sends another packet to Host C claiming to be from Host B saying "yup, open it". Handshake completed.

Now, in TCP world, there are a couple of complications. First, Host B is supposed to respond back when it gets the "do you want to open this packet" question from Host C with a "Nope, blow away the connection" response. So, just for starters, Host B has to be unresponsive. That means that it might be a good idea for Host C to compromise a bunch of hosts and flood Host B starting sometime before sending that first forged packet to Host A. This bumps Host B's packet loss rate up to, say, 90%. That means that there's an awfully good chance that the "Do you want to connect" message never gets through to B...all C has is the forged response from A, so it considers the response valid and opens the connection.

Then we have sequence numbers. TCP uses sequence numbers to ensure that packets don't get lost or out of order. A's bogus response to C has to have a sequence number based on the number that A included in its "do you want to connect" message to B. The traditional way to get around this was to have C try to open a (non-forged) connection to A. A's response contains a sequence number. C ignores this response, and when A sends out its first packet to B, as long as nobody else has opened any connections in the interim, it uses a starting sequence number that is, say, one greater than the previous starting sequence number. At least, there is some form of correlation that C can use to determine the sequence number being sent to B that will allow it to forge a packet with a valid sequence number.

Most modern machines, to avoid exactly this sort of attack, generate an "unpredictable" number. However, since entropy (I guess you'd call entropy "stored unpredictability" -- data based entirely on unpredictable events from outside the computer's operating environment) comes in at a pretty limited rate in a typical machine, machines tend to just mangle some data in a hard-to-predict manner and use it to derive a starting sequence number for the next connection. Ideally, this sequence number cannot be predicted by host A -- in reality, it's possible that host A might manage to do so, if controlled by someone that's figured out a way to predict the output of the algorithm being used by host C.

If the A and C machines are both on a fast network (a business or university, say), it might even be possible to forge a connection through brute-force guessing of the next sequence number.

So, spoofing a TCP connection is difficult, but feasible. TCP is definitely not considered to be secure as a cryptographer would consider something to be secure.

So it's a good move to avoid using IP-based authentication.

Re:Psst ... /.

[Eil]

You're too late. The Slashdot editors already wrote one of those a long time ago and called it michael.

Re: I believe we are talking about the sidebar ads

[DrSkwid]

perhaps its a language thing

if would set the spend to 30 dollars and see how it goes.

I got the idea that the parent suggested run-away unbound spending

Did any of you ACTUALLY made any money?

[ToKsUri]

Did any of you ACTUALLY made any money?, I mean not only virtually in your account, but actually received a check at your house? Thanks

Re:Did any of you ACTUALLY made any money?

[CGP314]

Did any of you ACTUALLY made any money?, I mean not only virtually in your account, but actually received a check at your house? Thanks

I did. I got a cheque for about twenty dollars each month for about six months. I really couldn't believe it.


-Colin

Re:Did any of you ACTUALLY made any money?

[yarbo]

I got a few $30 checks

Re:Ha ha, but AdWords among most effective ads on

[antic]

Yes, but what's stopping people for clicking the ad anyway, even if they already own the product? It doesn't cost them anything to check the price and see if they got a good deal, see if the page has any links to the data they're after, etc.

The advertiser might not get a sale, but they increase brand awareness.

"thinking is something you do inside your head"

[Mudcathi]

Unless, of course, you externalize by talking back to all of those little voices in there...

Hear that rumbling?

[BillX]

Avalanche of pedantic comments on the difference between 'talking' and 'typing' in 3...2...

Strange Attractors and TCP/IP Sequence numbers

[aWalrus]

The parent poster is right.

Read this article for an analysis of the algorithms for generating "Random" numbers for TCP packet sequencing. It's a really interesting read, and knowing this makes it highly feasible to spoof an IP if you know what the machine on the other side of the line is running (for some systems).

Ha, AllAdvantage...

[BillX]

I remember that, from my broke-college-student days. Everyone used to start up 'move the mouse' scripts and go to sleep, and usually got caught. I figured it probably checked for more involved activity, such as actual Web surfing (clicking on links, and such), so I wrote two different scripts: one to move the mouse in such a way as to sequentially click through a set of Netscape bookmarks at a randomish interval (between 3 ~ 5 minutes IIRC), and another to generate an insanely huge set of Netscape bookmarks (arranged as something like 25 folders with 25 links per folder) by turning it loose on any randomly-chosen list-o-million-links pages and letting it collect all the links. Did this for a few months...start the click script and rake in the $$$ while in class or sleeping. Unfortunately, this was toward the end of AllAdvantage when they began limiting how many hours per month they'd actually pay for, so by the end I was getting checks for...what was it...$12.50 per month I think. Eventually it just went out of business.

Just looking around, I still have the QBASIC script that generated bookmark files. (Yeah yeah, Qbasic and all, but it was semi-ingenious in those days. The script called C:\Windows\ping.exe to verify all the servers, to prevent e.g. "DNS Error" dialog boxes that would interfere with the link-clicking, as well as filter out anything that looked like an ad-link, etc.)

A few other useless-but-interesting facts I'm remembering about these services... AllAdvantage used the IE HTML renderer; it basically just displayed a Web page in its main window. The HTML for this was embedded in the .EXE, which did not checksum itself. Just find the <IMG SRC=... tag in the binary, and change the width and height attributes to all zeros. Viola, no more blinky blinky.

While you were at it (messing with the .exe, and all), you could change its internal name and window title so that the adbar programs (Cashsurf, EPIPO and whatever else existed at the time) wouldn't detect one another and close down.

And then of course, there was always WindowsSniper...

Re:Ha ha, but AdWords among most effective ads on

[Courageous]

Man, you had me going there for a minute, until...
----
Your search - "Sex-crazed underage lesbians" - did not match any documents.

Extortion is too much work for some people...

[rocca]

...and it's easier just to sue for search results that match your name.

Re:The future of advertisement...

[cardshark2001]

Rather than making an ad on the web accountable in ways that no other media is required, why not just assume it's getting you market-awareness and presence?

I totally agree. Answer: because they can. The information is just so juicy, and it's just right there, it's too tempting to ignore.

As long as they don't ignore it, however, we will have scammers like this one.