Hacker News Reader

Comment by geocar | Hacker News Reader

Normally a "real browser" can't run 100s of ad players at once, but "methbrowser" is a node.js application with a C module that speaks Flash's plugin protocol directly. It simulates a dom, runs JavaScript in a node VM, but doesn't have to do any of the messy rendering that things like PhantomJS have to.

It was discovered years ago because:

* Their IP stack was acting like Linux[1]

* Their flash player said "I'm Linux"

* Their user agent said other things (random user agents)

* Their DNS traffic was going UK, but the hosts were coming out of the US

[1]: http://geocar.sdf1.org/browser-verification.html

View on HN

Here's an awesome technical writeup about MethBot: http://go.whiteops.com/rs/179-SQE-823/images/WO_Methbot_Oper...

The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

Yeah was curious about this as well.

In truth they were likely exploiting a vulnerability in MethBot. Similar to XSS only server side. The legality of this, if my suspicion is correct is highly dubious, so they kept the details low key.

I imagine somewhere in MethBots virtual DOM emulation they got sloppy and ran code (JS) from the server. Using metaprogramming plus some output they could predict they could use runtime reflection and inspect server side JS object.

> The part that confused me is when they claim to have obtained MethBot source code, but never mention how.

On page 19 in the The Methbot Operation report they state that ‘White Ops detection technology was able to use a JavaScript language feature called “reflection” to gather extensive, detailed information about its inner workings.’

I have personally never heard about JavaScript reflection before, but it appear to be a debug method for one object to dump information or data about another object.

Maybe the White Ops software loaded some JavaScript that was able to dump much of its environment and send it back to White Ops?

I don't know more than anyone else about this particular situation, but I can imagine how JS reflection works. Something like:

    let test = function() { return "hello";}
    test.toString()

returns

    "function() { return "hello";}"

It's not too difficult to imagine that pairing that with some JS parsing would allow you to slowly crawl your way around an app and gather the app structure. Crazy, and fascinating idea.

If WhiteOps did that, they didn't need to. A nodejs vm escape was sufficient to get process.mainModule.require and from there, it's game over.

Can we have a spamhaus for ad fraud?

* list of botnet infected IPs participating in ad fraud

* list of offending/incompetent SSP blindly accepting forged requests

> Can we have a spamhaus for ad fraud?

There are a lot of vendors in this space now, offering various kinds of "spamhaus"-type solutions. They're all crap because they operate blacklists of various kinds to keep their customers dependent.

The ideal scenario is for ad networks/SSPs to implement the anti-fraud technology themselves, however getting there from here is difficult: The first ad network to go clean will be at a significant (fiscal) disadvantage.

I'd like to get in touch with anyone ad network/SSP that wants to go first.

> lists of botnet infected IPs participating in ad fraud

This won't be enough.

A popular "audience extender" is to use an iframe containing your site as an ad tag, and run it on your display network. Unless you have been using an ad blocker for the last ten years (and maybe even then), it's very likely your IP address has been used in ad fraud.

> lists of offending/incompetent SSP blindly accepting forged requests

Google facilitates an enormous amount of ad fraud, but media buyers have to buy from Google because nobody else sells Google search ads (except, I suppose, the injection people...)

Yahoo purchased a company who was selling video ads that were muted using uncommon AS3 mixer controls.

I think a much shorter list would be the media suppliers that don't have ad fraud on them and don't facilitate ad fraud. You'll find such a list below.

I upvoted you because of your helpful list.

Hm I can't seem to see any list. Where is it?

I almost replied like you did; the joke is that there is no such list.

()

Do you have any more information about the as3 mixer controls?

Sure.

    var st:SoundTransform = new SoundTransform(1.0);
    st.leftToLeft  = st.leftToRight  = 0.0;
    st.rightToLeft = st.rightToRight = 0.0;
    SoundMixer.soundTransform        = st;

Mutes the audio, but if a VPAID component naively checks:

    SoundMixer.soundTransform.volume

they will get 1.0. Most don't even bother checking though.

I don't understand ad networks enough to grasp how fraudulent ad inventory works, but as this article shows - you can make a killing exploiting it..

As is stands, is there any sort of compliance measure (or regulatory body) to monitor/prevent ad fraud in these networks?

> I don't understand ad networks enough to grasp how fraudulent ad inventory works, but as this article shows - you can make a killing exploiting it..

Someone has some "sites" that they show to an ad network or an advertiser and tries to sell the impressions on those sites. They receive "ad tags" in exchange, and the theory is that users are exposed to the ads shown by those ad tags, and the advertiser is satisfied.

However, once they have "ad tags", they can do whatever they want with them. They can find the URL signal that represents "give me money" and arrange to fire that signal.

> As is stands, is there any sort of compliance measure (or regulatory body) to monitor/prevent ad fraud in these networks?

No.

The Media Rating Council[1] was endowed by congress with special powers that allow participants to talk to each other antitrust protections kicking in, but these conversations are extremely non-productive.

[1]: http://mediaratingcouncil.org/

>Yahoo purchased a company who was selling video ads that were muted using uncommon AS3 mixer controls.

Thanks for the code above. What was the company name? never heard of it.

> It was discovered years ago

And yet they're still active with the same tech stack.

They only have to do the very minimum to recover from detection. The incentive is for them to keep the largest possible bag of tricks ready to deploy every time they get a dip in revenue due to fraud detection to milk the fraud. Besides, most of the countermeasure takes the form of javascript to be executed by the client, since the fraudsters control the client, they can alter the operating environment of the fraud detection as needed.

I don't think that's quite right.

When three-letter television companies will buy an audience extender from one of these shady guys rather than tell the advertiser that they don't have as much traffic as they projected, you don't really even need to worry about detection.

There exist passive techniques powerful enough to really map these kinds of actors out thoroughly, however the industry has been reticent to stop it because everyone from Viacom to Google has facilitated ad fraud, and there's this fear that stopping things too abruptly will cause advertisers to lose faith in this (still nascent) $60 billion dollar industry (US numbers).

Given the complexity and quirks of modern browser engines it seems like it should be pretty easy to detect this type of custom "browser".

Most anti-ad fraud vendors can't do the IP packet analysis trick since they use ELB to help control their costs/scale.

All the other techniques require JavaScript and/or AS3 and are thus subject to modification by these kinds of sophisticated attackers. The only real way to do JavaScript in these cases is to change it often enough and run enough parallel versions that the attacker cannot keep up.

Aah, they were doing it for the last 10 years or so. People who are serious into botting have software that basicaly runs the browser in a vm.

The level of programming skill in the "industrial scale botting" community is high. Top tier botters can easily get into +$100k club if they were doing whitehat stuff.

I am a developer with these types of skills, but was mainly testing for a pet project scraping data. What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club?

>What are you referring to with the "whitehat stuff" to get in the 100k+ (/day) club?

Bot detection, ad auditing, antifraud systems

I reversed engineered (out of curiosity) the JS/AS code of > 10 solutions of this nature. Wrote bypasses for many (locally, for fun). How do you make whitehat 100K+/day with these skills?

Absolutely. As a lead dev for a video ad company, I can tell you that we pay big money for skilled security and anti fraud guys.

Speaking of DNS, one of the sdf nameservers you are using is very slow or non-responsive: ns-a.sdf.org

It reminds me of ns.cnet.com

I dont suppose I can install that with NPM eh?

Reply on news.ycombinator.com