Slashdot Mirror
Russian Hackers Stole $5 Million Per Day From Advertisers With Bots and Fake Websites (cnn.com)
Russian hackers have used fake websites and bots to steal millions of dollars from advertisers. According to researchers, the fraud has siphoned more than $180 million from the online ad industry. CNNMoney reports: Dubbed "Methbot," it is a new twist in an increasingly complex world of online crime, according to White Ops, the cybersecurity firm that discovered the operation. Methbot, so nicknamed because the fake browser refers to itself as the "methbrowser," operates as a sham intermediary advertising ring: Companies would pay millions to run expensive video ads. Then they would deliver those ads to what appeared to be major websites. In reality, criminals had created more than 250,000 counterfeit web pages no real person was visiting. White Ops first spotted the criminal operation in October, and it is making up to $5 million per day -- by generating up to 300 million fake "video impressions" daily. According to White Ops, criminals acquired massive blocks of IP addresses -- 500,000 of them -- from two of the world's five major internet registries. Then they configured them so that they appeared to be located all over the United States. They built custom software so that computers (at those legitimate data centers) acted like real people viewing those ads. These "people" even appeared to have Facebook accounts (they didn't), so that premium ads were served. Hackers fooled ad fraud blockers because they figured out how to build software that mimicked a real person who only surfed during the daytime -- using the Google Chrome web browser on a Macbook laptop.
Turn off your ad blocker and reload this page.
Now, look at the shit down there.
Wait, now click on some of them - go ahead. Try the one with the really hot chick or movie star - there's always one of those.
You'll be stuck in horseshit hell. Some have mousetraps and other sleazy techniques to generate more page hits than you intended.
Fuck'em.
I mean really. It's one assholes "stealing" from another.
I buy amplifier!!!
Every PC I service gets adblocking with customer permission and education on it. It is in my opinion unethical not to. There are so many fraudulent (even browser hijacking and malware delivering ads), that there is no other choice.
Not to mention that it often speeds up browsing by a third or more, pertinent info is easier to find, etc.
Fix the industry or get thee gone.
Silence is a state of mime.
Cause this time you can easily follow the money. With Hillary there was no money trail.
I need to ask them some advice on finding an IP address available....
"criminals acquired massive blocks of IP addresses -- 500,000 of them -- from two of the world's five major internet registries."
If they are identified, I think they should be fined $1 and then be given a medal.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Your opinions are dumb and your grammar is bad.
Because their main competition, the Nigerian Prince, has already been caught.
Table-ized A.I.
Sometimes the only thing more dangerous than the answer is the question. Be careful, comrade!
I had a sucky sig.
nah, these ones have ethics
It doesn't seem like there was much unauthorized access to a computer system, sounds like they breached the ToS for Facebook, but other than that I don't see an actual crime here.
If your stealing from the worst kind of bottom feeders, is it really stealing?
AnellofalotMORE!
I run a couple FB community groups that are quite specific. They aren't of interest to anyone outside the community. Fairly regularly I will get requests to join the group from obviously fake accounts. Many have the wrong gender for their name or profile picture. They will have a small random assortment of friends from vastly different nationalities. They will belong to multiple groups in multiple languages. Most of them I report to FB are immediately classified by them as fake accounts and are deleted.
Anyway, I wondered what the point was of these fake accounts. I thought maybe they harvested information (by joining groups they could see who is in the groups and thus attempt to build a graph connecting users). However, now I believe these accounts are created to consume advertising in scams such as this one, and at least some attempt is made to make the accounts appear genuine by having an array of friends and belonging to groups, etc.
Better known as 318230.
The address bar of browsers is pretty useless as it is. In the old times, it showed where information as loaded from. Today, not really.
I'm dreaming of an address-sidebar instead of an address bar. For each address the browser wants to get data from, I want to be able to select to a) do it, connect, but don't get any data, c) ignore it.
Shouldn't be too hard?
The Hillshill tears are delicious. So delicious...
the most talented in the world, but clumsy to the likening of bumbling clowns who drop Russian flags, business cards, e-mail addresses, and personal details, everywhere in their path. The picture of the smart-but-dumb Russian hacker doesn't quite add up.
I find it ironic that this information comes about Ads, but it appears to me that this post might just be and Ad/plug for whiteopsdotcom! There site doesn't have any real data (at least at first glance). Normally when these things are reported by a security firm, there is a link to the white paper or the actual incident, and how they gleaned this information. All I see is a website advertising their services, and products. Not to mention the "contact us" for info and give us your email so we can spam you!
Again irony...
Sounds like they made money off of a stupid system by using the system in exactly they way it was intended to be used. What's the problem here?
The sooner websites notice, that ads are the wrong way, the better for the user. Find some better way than forcing shit on us.
I can probably find Russia on a map. You going to be down on me for that? Personally I think Trump is an idiot but let him, you know, actually be Prez before you cry about how bad a Prez he is. Otherwise you just sound like crybaby Hollywood celeb.
For the benefit of the millions of future imitators - can anybody explain how this activity could in any way be construed as theft on the part of the system developers. With the minimal details available, it appears that the ad was served, but the representation that the ad was delivered to a person was made by the ad networks - who are therefore the only party actually engaging in fraudulent activity.
It seems akin to paying an advertising agency to run a postal campaign, who then engage a subcontractor to dispose of the leaflets - which end up ultimately being dumped. The subcontractor dumping the leaflets isn't violating their contract for disposal.
If only their engineers knew basic math, the kind that would allow them to not miscalculate basic real metrics let alone the fraudulent ones.
Hackers fooled ad fraud blockers because they figured out how to build software that mimicked a real person who only surfed during the daytime -- using the Google Chrome web browser on a Macbook laptop.
Ugh. Who the hell would want to advertise to those assholes? I mean, Mac users are bad enough, but Mac users running Chrome... *shudder*
... who only surfed during the daytime...
Let me guess: IPs spoofed to look like they came from a Panera?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
How about we look at all of the people he's listed for his Cabinet who are almost universally in fundamental conflict with the departments they'll be nominated to head and decide we've already seen far more than enough (even letting alone all of his lies and vile behavior while campaigning).
What exact law did they offend?
This isn't too far off from building bots to cheat at online games.
It's bannable but illegal?
You conveniently leave out the key detail: Hillary Clinton was never involved in the deal. You further leave out that the Canadian government was also involved and had to sign off on the deal.
You also leave out that in addition to the State Department there were eight other agencies involved with the deal, including the Director of National Intelligence.
But I guess in your fantasy world Hillary was able to cajole all these people, including a foreign government, to make the deal because in a round-about manner her foundation received legal foreign donations from a country who was in negotiation to buy a uranium mine, a deal in which she was never involved with. Yeah, sounds completely plausible.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
I am playing one right now.
I worked policing affiliates for XPICS, the company that claims to have invented pay per click, back in the 1990's, the first internet job I had. We busted all sorts of scams that tried to send fake users and fake clicks to collect advertising revenue. Seems like a larger scale more modern continuation of that same type of operation.
Well done
Comment removed based on user account deletion
No no no, it is your nlgger grammar that is wrong. Sup
Commies all of them!
They're everywhere!!! EVERYWHERE!!!
hillary's sand nlgger electorate is so cheap
...because I'd rather get the DNC/Obama Admin "message of the day" directly first thing in the morning, instead of having to wait for it to filter through their shills and then social media.
Thanks!
-Styopa
*shrug* Maybe it's for the best. Mankind wasn't meant to have nice things. It's not like we'll miss them anyway.
Reading cyber-security news on CNN and NY Time is like taking stick tips from a bum. Very misinformed article. Just read the original research.
Finally someone has done what I've always wanted to do: massive click fraud botnets. I hope more spring up like this.
Second on the list: 'viruses' that automatically install an appropriate adblocker on all infected machines...
See subject & http://methbot.s3-website-us-east-1.amazonaws.com/domains.txt/ & for the best hosts file creator APK Hosts File Engine 9.0++ SR-4 32/64-bit https://www.google.com/search?hl=en&source=hp&biw=&bih=&q=%22APK+Hosts+File+Engine%22+and+%22start64%22&btnG=Google+Search&gbv=1/
* 8th botnet hosts stop in 1 week with this one, here's the rest https://yro.slashdot.org/comments.pl?sid=10010777&cid=53510613/ listed...
APK
P.S.=> It's NOT easy being "world-class" (like me, lol)... apk
Like seriously I'm almost tempted to move to Siberia. Why not make $5 million per day where no one will arrest you for doing this? Here I sit coding away for a lowly 100k a year like a good little drone while some Ivan is making $5 million a day off of code I could cobble together in a month myself. Oh, right -- I don't want to damn my very soul....
government speak for "somebody"