Ad Fraud Scheme Drained Users’ Batteries By Running Hidden Video Ads In Android

https://www.buzzfeednews.com/article/craigsilverman/in-banner-video-ad-fraud

394 275 7 years ago

I used to date a girl who had a Galaxy S8 from sprint and that phone had most ridiculous ads like online casino ads, everywhere, even on lock screen.

distant_hat• 7 years ago

A few years back Lockscreen was identified as one of the most underutilized real estate on the mobile phone. So a lot of phone companies started selling it to the highest bidder. While Samsung shouldn't be needing it, a lot of the lower end Chinese companies make razor thin margins on the phones, even if a company offered $1-3 for pre-installing an always running app that would show ads to users, they'd happily take it.

sk0g• 7 years ago

I doubt it's the Samsung launcher/ lock screen showing ads though. I remember a particular lock screen I tried out that was great. Functional, beautiful... Except, you know, when it showed an ad on half the lock screen.

Yeah, fuck that.

But a less tech savvy person might just go "well this is fine, I guess that's just how it is", and live with it.

haser_au• 7 years ago

The 'Peel Smart Remote' app came pre-installed on my old Samsung S6, and it did the same thing. Lock screen ads and everything.

https://fossbytes.com/peel-remote-use-remove-smart-remote/

https://www.androidpolice.com/2017/03/29/peel-remote-app-ups...

DrScump• 7 years ago

And their app lies about the scope of devices it can control. For example, it won't even warn you if your target device outright lacks an IR port before you install it.

Worse yet, check out the permissions it demands: Calendar (!), Contacts (!!), Camera, precise Location, microphone, Bluetooth... even body sensors!

randomfinn• 7 years ago

The link is blog spam, original article is at https://www.buzzfeednews.com/article/craigsilverman/in-banne...

fxfan• 7 years ago

The verge is not blogspam - its long form tabloid

dang4• 7 years ago

"Blogspam" is more an article attribute than a site attribute. In this case the article was a couple paragraphs lifted from another source, which is usually how people use the term.

dang4• 7 years ago

Thanks. Url changed from https://www.theverge.com/2019/3/22/18276542/scam-hidden-vide....

Submitters: please read and follow the guidelines. They include: "Please submit the original source. If a post reports on something found on another site, submit the latter."

https://news.ycombinator.com/newsguidelines.html

occamschainsaw• 7 years ago

Sorry about that, will keep it in mind for future posts.

zamalek• 7 years ago

It's crazy that ads have reached through point where impressions-without-impressions are lucrative. If I was the type of scumbag to pay large amounts of money for data hungry ads, I'd be furious. But, they don't care? Are ads now just a sunk cost with no ROI analysis? Is it like a gym membership?

drilldrive• 7 years ago

I think that the issue here is little to no access to a more detailed portfolio of the ads ran on your platform, as you are generally going through a middle-man, which in this case is the scammer by selling to providers on their front than they are paying you for.

narrator• 7 years ago

I think the issue is that there are lots of number crunchers out there thinking :

"Well this ad campaign is profitable when we spend $100 on highly targeted Facebook ads, let's spend $10000... Oh they don't have that many impressions to sell us..."

"Where are we going to get all those ad impressions from?"

"Shady Bob's affiliate network has millions of impressions to sell us!"

"Great. That should work. The sky's the limit on this ad campaign! We're going to be rich!"

rjbwork• 7 years ago

One of the issues is that there just isn't that many advertiser focused platforms that give the advertisers the data they need to actually do the analysis of that ROI. So they just kind of spray and pray sometimes.

darkpuma7• 7 years ago

Marketing/advertising professionals are in the business of persuading businesses of their efficacy as much, if not morose, than they're in the business of persuading consumers to patronize those businesses.

Smooth talking and flashy slide decks about how great their advertising service is can blind business owners to poor results.

GrumpyNl• 7 years ago

This has been the case with ads in adult since the start of internet.

llukas• 7 years ago

Another reason to cut all ads alike.

myth17• 7 years ago

How are they making money by draining batteries?

senectus1• 7 years ago

the answer is in the Title of TFA: This Giant Ad Fraud Scheme Drained Users' Batteries And Data By Running Hidden Video Ads In Android Apps

dang4• 7 years ago

The originally submitted article didn't have that title (see https://news.ycombinator.com/item?id=19459834).

TheIronMark• 7 years ago

The buzzfeed article goes into more detail, but the short answer is that the fraudsters buy a cheap banner ad in an app. They then resell that space for a higher fee, running a video that is hidden behind the banner ad. Because the video just keeps running, the brand whose ad it is ends up paying even more to the fraudsters.

Zak2• 7 years ago

I am amused that the article detailing a very good reason to use an adblocker asked me to disable mine.

mirimir4• 7 years ago

Hey, there are no ad blockers for apps, right? Messing with other apps is a ToS violation for both Google and Apple, as I recall.

Edit: OK, you can. But not with other apps from the official stores.

jjeaff2• 7 years ago

On both, you can block the ads at the DNS level. Not quite as effective, but still workable.

shtam• 7 years ago

You can with Adguard

Aozora7• 7 years ago

There are. Google doesn't allow apps that block ads in other apps on play store (anymore, they were on play store some years ago), but you can always just download and install them manually on android.

TeMPOraL8• 7 years ago

NetGuard is on Google's store, and (at least in pro version) you could use it to monitor and block individual addresses any app wants to access. It's a bit involved, though I recommend at least the basic functionality: the ability to selectively allow and deny access to Wi-Fi/mobile connection for apps. I don't run any ad-filtering for apps, but I disabled networking for any app that IMO shouldn't use it, and I'm surprised by which apps suddenly start popping up in NetGuard's notifications (especially when I'm not using them).

snaky• 7 years ago

That's the greatest and most underrated opportunity for F-Droid.

Zak2• 7 years ago

I use Adaway on Android; it's hosts file based and reasonably effective. It isn't in the Play store and requires root, so it's not exactly aimed at a mainstream audience.

AngryData• 7 years ago

Advertising is a scourge upon society.

kbenson2• 7 years ago

Advertising is a scourge upon society.

I understand where you're coming from, but that's painting with a pretty broad brush. Advertising covers everything from the signage stating the name of the mom-and-pop shop on the corner (which is why cities often limit the size of logos/names on building) to billboards on the side of the freeway. It covers movie trailers I seek out ant watch to see what's coming soon to commercials interspaced within a video that interrupts the flow.

I hate some of those, but i actively like, or at least value the utility of some of the others. A specific type of advertising has grown outsized that last couple of decades, and it's causing real problems. But let's not paint with too broad a brush just because we're fed up. That's how stupid laws get passed.

baybal24• 7 years ago

I am more on the position that advertising as a function of product promotion is dying, in all, but the most extreme overkill forms.

darkpuma7• 7 years ago

Have you tried not seeking out movie trailers and seeing how your life changes as a result? Between my television avoidance, adblocking, and theater avoidance, I've not seen a movie trailer in many years. Instead of deliberately blasting your brain with fast paced A/V propaganda for a minute or two, try learning about movies through word of mouth with people who share your general interests.

dkersten7• 7 years ago

A’s Banksy said:

...They butt into your life, take a cheap shot at you and then disappear. They leer at you from tall buildings and make you feel small. They make flippant comments from buses that imply you’re not sexy enough and that all the fun is happening somewhere else. They are on TV making your girlfriend feel inadequate. They have access to the most sophisticated technology the world has ever seen and they bully you with it. They are The Advertisers...
...You owe the companies nothing. Less than nothing, you especially don’t owe them any courtesy. They owe you. They have re-arranged the world to put themselves in front of you. They never asked for your permission, don’t even start asking for theirs.

Full quote here: https://trickygirl.wordpress.com/2012/03/01/quote-of-the-day...

pluma4• 7 years ago

You're right. Advertising is just a symptom of the root problem, capitalism.

"Attention is currency in the marketplace of ideas" as they say. If everyone is supposed to vote with their dollar, you need to make them vote for you. The easiest way to do that is by fighting for your attention.

snarfy• 7 years ago

I'm not against advertising, but I am against branding. The term was borrowed from the cattle industry, where a hot piece of metal scars the cattle with a logo of the owner. Branding in advertising is meant to scar your brain. I consider it a form of assault.

masonic• 7 years ago

I would rephrase as "fake advertising is a scourge on society" with "fake" specific to artificially generated "impressions" that, by design, no user ever actually selects or sees.

Qwertious• 7 years ago

Yes, I'd be interested to see what would happen if misleading/mis-impressioning ads were made illegal.

TeMPOraL8• 7 years ago

Nah, that's actually slightly positive in so far that it hurts the advertising industry.

The problem is with actual ads. The ones that distract, cajole and coerce people to do things against their best interest.

product508• 7 years ago

Advertising is what makes the web accessible to billions of people in the world for free.

Most apps offer the option to make an in app purchase and turn off ads. Why don't you do that vs. giving your unqualified opinions on what is good and bad for society?

bpchaps• 7 years ago

Does facebook offer that option?

roenxi5• 7 years ago

Voters are also usually not responsible enough to handle democracy either, and yet here we are.

1) If you don't tell people about your product, they won't know about it and probably won't use it. Word of mouth is ok, but it is surprising how many people are left uncertain and in the dark about what their options are if they aren't directly told what their options are.

2) Without advertising, the internet collapses. Google, in particular, collapses. And takes a lot of unprofitable-without-advertising services with it. Facebook probably goes as well. Most media companies too. Once you lose all those companies I'm not sure how many normal people would agree that the internet still existed.

ndnxhs• 7 years ago

The internet existed before advertising and it could continue to exist without it. People still desire instant communication and they would pay for it if a free option did not exist.

A lot of garbage like Facebook would fall and real social networks would take place with real interactions not algorithms trying to drive fake engagement.

black-tea• 7 years ago

The Internet would not collapse. We pay our ISPs for a connexion. They don't give a crap whether we're using Google or not.

chronogram2• 7 years ago

Voters are also usually not responsible enough to handle democracy either, and yet here we are.

What a weird way to start off. You should probably elaborate on that for it to make any sense outside of a high school economics class.

Regarding number 1: like what? I’ve never met anyone who looked really happy about seeing an ad for hot singles in their area, that they should feel insecure about how they look in lingerie, that they should go gamble.. would more than 1% of advertising be good? If an extremely large proportion of a thing is bad, then I can agree with someone calling it a scourge.

Regarding number 2: okay

dkersten7• 7 years ago

Google, in particular, collapses. ... Facebook probably goes as well.

You say this as if it’s a bad thing. In my personal opinion, both of these companies have ultimately done more harm than good. Maybe Facebook more so than Google, and some Google products have pushed various tech forward, but at the expense of being tracked and watched and having garbage we don’t want or need constantly punch us in the face for our attention. More people seem to be suffering from anxiety and depression and I personally think these companies are a major part of the cause. If they were to collapse, good riddance I say.

Most media companies too.

Most media companies are garbage peddling clickbait or misinformation, or at least empty-calorie/low substance content. I read a lot of stuff online because I’m just as addicted as everyone else, but the amount that is a truly insightful, actionable or entertaining in an any way memorable way is tiny. Good riddance to these too.

aiCeivi9• 7 years ago

Without advertising, the internet collapses.

I just can't wait for it. There are just few steps left:

1. Ads are served from same domain as content (this is now in progress)

2. YT integrates ads with main video stream, sites experiment with server side "render to canvas".

3. Adblock is using ML/AI

4. Laws are made against undisclosed sponsored content.

5. Online advertising is dead, clickbait is dead, free (now ad supported) content is dead. There are only subscription services left.

Razengan• 7 years ago

What if people were directly paid to view adverts?

Introduce ad viewing apps where people voluntarily sign up, provide information about themselves, and use attention-tracking etc. to reward them with some money based on how many adverts they watch or surveys they answer.

Maybe go further and ban all other forms of advertisement that takes up space anywhere, classifying them as vandalism.

Everybody wins (unless this idea is fundamentally flawed):

• People only see ads they want to see, when they want to see them.

• Companies know exactly who is watching and what they’re interested in, instead of going through third-parties and overly roundabout, sometimes illegal, ways to acquire that information.

• And the world becomes less uglier and noisier.

NeedMoreTea2• 7 years ago

lol, no. I think you just invented the black mirror 15 million merits episode.

dwighttk2• 7 years ago

why not? https://www.techeblog.com/rare-look-inside-an-app-review-far...

jerf• 7 years ago

"What if people were directly paid to view adverts?"

One of the "problems" with that it is that it would reveal just how little money these things make. A page full of busy ads that annoy the heck out of you may still make well under a penny, only breaking a penny if you actually click on something and possibly even then only if you buy something.

Facebook's approximate revenue in 2018 is about 34 billion, it seems [1]. Facebook's user count in 2018 [2], call it two billion for math convenience and a fudge factor for fake & dead accounts. Simple math shows that even if 100% of their revenues are from ads, they're making $17 dollars a year from their average user. Revenue, not profit. And they're one of the big money makers in the ad industry!

Converted to daily terms, that's about 4.7 cents per day. That's what they're trashing your feed for, rearranging it so you see more ads and less of your family, rearranging it to drive "engagement" by putting more rage- and stress-inducing controversial content into your feed, and carefully managing your experience for. 5 cents a day, average.

Advertisers aren't just crashing our society, driving our news industries into death spirals, invading our privacy at scales that would make the Stasi blush, and annoying the hell out of us on almost every web page we visit, they're doing it for almost no money. They can't afford to pay you to view advertising. Even someone making minimum wage would find the offer they could make laughable, because your offer would be coming out of their profits, not revenue, so if Facebook wanted to pay you to view ads they'd be slicing up something like a $1/year with you.

(This is why I've proposed as one solution something like a 1cent/impression advertising tax. It would annihilate everything but the absolutely most profitable portions of the industry. Even a 0.01cent/impression tax would probably kill 90% of it. And I think there's a perfectly justifiable case to be made that such a tax would simply be internalizing externalities and perfectly justified under both left and right wing theories of economics.)

[1] https://www.statista.com/statistics/544001/facebooks-adverti...

[2] https://www.statista.com/statistics/264810/number-of-monthly...

elagost• 7 years ago

The new technologies behind ads are really terrible, but I don't think there's anything inherently wrong with a full-page Rolex ad in the WSJ. Dude in a fancy suit wearing a watch that looks great, and a quick description - that's a very simple, easy to understand model. If I like that watch, I can save up for it. Rolex doesn't know I saw it and doesn't care.

New technologies behind ads, tracking users wherever they go and hounding them relentlessly and using their personal communications to harvest more data - that's the scourge. I'm fine with ads, but I block them on every website because I'm not fine with tracking.

Nextgrid3• 7 years ago

Advertising is like cancer. It starts small but eventually consumes the entire product/company. Seems like there is no "safe" amount of advertising, it becomes bigger and bigger and ends up swaying the entire company into doing unethical and anti-user things (like optimising for "engagement").

askafriend• 7 years ago

Stripping the conversation of all nuance isn’t the intellectually honest way to have this conversation.

dang4• 7 years ago

Maybe so, but please don't post unsubstantive comments here.

philipkiely• 7 years ago

"One of the hallmarks of mania is the rapid rise in the complexity and rates of fraud." -- Michael Burry, The Big Short (Film)

hrdwdmrbl2• 7 years ago

My first thought is that this is really Google's problem to fix. How is it even possible to do this on Android? Or is this also possible on iOS?

baybal24• 7 years ago

How? Google's last secret bastion of defence was a common opengl driver glitch that was checked from well hidden webgl shader code. Even that was said to be cracked in no time.

Simple explanation is that people on the other side of adfraud war are the ones getting incomparably bigger money than any ad-fraud specialist hired by ad companies (and they both hire pretty much the same people...)

Imagine, the more Google cracks down on it, the bigger is the monetary reward for cracking the protection. I remember reading mid-naughties era Russian computer journals with pics of "advertising specialists" racing off their new Ferraris in Moscow right at the moment it was said a big crackdown was going on.

EE84M3i• 7 years ago

I'm curious about this "hidden webgl shader code" you're talking about, but only getting google results for this comment. Do you have a reference for this?

product508• 7 years ago

This is irrespective of the OS. Basically, on the webview, they are running a downloading and running hidden video with all the trackers going off.

whalesalad• 7 years ago

Not necessarily. You can’t run wild on iOS.

hrdwdmrbl2• 7 years ago

It's not clear from the article, but this is only possible when the app is being viewed right?

onion2k• 7 years ago

Google could ignore it but that would make users use their phones less, which would impact Google's bottom line. Users associating video ads with fraud would also be bad for Google's brand. There are lots of reasons why Google would want to resolve this problem.

I imagine Google might even employ risk assessors to figure out the cost impact and decide if it's worthwhile spending time fixing it.

dschuetz• 7 years ago

Why is that even possible to hijack an active ad feed? It implicates that in-app ads are high risk security-wise. I just can't believe how broken the infrastructure for web services actually is, and why the companies doing and serving ads space only act when revenue is at stake. This and many other things are getting out of hand.

mirimir4• 7 years ago

Right. Some ads just serve malware.

pdkl95• 7 years ago

A lot of people listened to Douglas Crockford when he talked about "The Good Parts"[1] of Javascript. Unfortunately, very few people also listened to his warning[2] than mixing foreign Javascript was insecure by design (only proper trust boundary is the page).

[1] http://shop.oreilly.com/product/9780596517748.do

[2] https://www.youtube.com/watch?v=qfBL2sc2zUU

product508• 7 years ago

This is why advertisers flock to Google and Facebook Ads. You can call them a lot of things but ad fraud is something they take very seriously. A view or a click on Facebook video ad is most definitively pointing to the real thing. And just that surety is a good reason to pay some premium.

radium3d4• 7 years ago

Google is great but I definitely wouldn't put Facebook ad clicks anywhere near the quality of Google ad clicks.

product508• 7 years ago

If anything Facebook's clicks are much more reliable than Google's since Facebook shows almost all its ads on its O&O properties where there is 0 potential for fraud. A lot Google's mobile ads are via AdMob which are shown on third party apps which Google doesn't own - which can lead to scenarios where the publisher may be upto some mischief.

yilugurlu• 7 years ago

I guess the advertisers whose video ads run in the background don't care about ad viewability.

Most of our advertisers require at least %90 of viewability, big brands. But a still significant amount of them use VAST and don't care about any other measurement. When we ask them to if they have VPAID tags many times they just say no, we only have VAST.

dillondoyle2• 7 years ago

Seems like an impossible arms race though (to fake viewable) plus it looks like this fraud was a VPAID container.

VPAID adds a overhead compared to the possibility of a native implemented VAST player. If there was a way to verify & build trust with pubs/networks to run vast tags natively, no JS, I would buy that inventory. Newer vast also has a viewable event, but again is on the pub to specify legitimately hence the verifiable trust. There's a reason FB gets a lot of my $$

Macha• 7 years ago

Between players, ad network wrappers, third party service wrappers, creative teams getting the spec wrong, more requests for ad blockers to block etc., VPAID is a mess in terms of successful playback though. It's like developer for early 2000s browsers when you have to test in multiple tools and work around multiple quirks. I can see why advertisers might not want to bother.

mrweasel• 7 years ago

I like how the issue of draining the battery is in title. It indicates that the actual fraud aspect is less important, and that the issue that we're really suppose to be upset about is the battery issue.

Directing angre towards the advertising is a little weird too, if there was less fraud, then maybe the ad buyers be more critical in regards to which ads they buy and how many they run.

djhworld• 7 years ago

It's a three pronged attack.

The advertiser who's paying for fraudulent impressions, the user who's battery life is drained, and the app developer who might be getting reports/bad reviews about the app draining battery life

rizzin• 7 years ago

Embedded automatically played videos are a scourge upon Internet.

concerned_user2• 7 years ago

Also amount of ad space on news sites should be regulated, i.e. > 30% of screen space is meaningless pictures/ads/promo - not a news site.

hannob• 7 years ago

It is interesting how this article starts. A guy has an app which drains users batteries. But it's not his fault of course, because it's the ad company. Except the ad company says it's not their fault, because the ad came from some other company.

This fingerpointing points to one of the core problems of the ad industry: They created a system where nobody knows who's responsible for anything, so malware and fraud has an easy time.

But this mode of thinking makes no sense. If you put ads in your app YOU are responsible. If you use an ad service from a shady company that outsources to other shady companies then you're still responsible.

stestagg• 7 years ago

Just as if you were to buy a child’s toy that has a secret embedded camera that streams to some foreign server.

It may be the manufacturers fault, but the person who sold it to you (the provider) is liable.

Should be the same here

rahimnathwani2• 7 years ago

Right, and from the POV of the child, the parent is liable.

Barrin92• 7 years ago

I think it's a little bit more complicated. There's a point where this becomes somewhat questionable. Say the toy has a reputable certification and the company, up until now, never had any track record of mistreating their customers. In this case I'd argue the company is responsible, not the parent, and that it is actually worthy following through to find whoever acted maliciously rather than just picking the last person in the chain.

Now in the particular case of ads in applications, I think there are surely many developers who fail to do their due diligence when picking advertisement partners, but without a doubt there are also advertisement companies who excel at duping the developers they work with.

vanderZwan2• 7 years ago

Liability seems to be focused on pointing blame, and then based on that we decide who should clean up.

In situations like this perhaps it would be more productive if we had a system that focused more getting everyone to clean up and prevent this from happening again first, and then look at the liability part.

I do believe that this is the innate human response, the desire to "do the right thing". Most of us have the right mixture of nature/nurture to want to do that. But if the system doesn't enable that behavior or punishes that, that behavior will get suppressed and we end up in a miserable situation for everybody.

I dunno, it's not exactly an easy question or it would be solved already, and bad faith actors will exploit the goodwill of others too.

asdkfjasl2• 7 years ago

the person who sold it to you (the provider) is liable

I don't think that's true unless they knew it had this behavior or were negligent in some way.

concerned_user2• 7 years ago

That is all true but for practical intents and purposes you should probably make ad company responsible. It might seem a bit illogical but from practice standpoint, it is much easier to pursue and punish an ad company than to hunt each and everyone of its clients. Especially that they can just abandon the company and create new one, and it will be just cost of doing business, everyone of those shady players will have an ad shill company that can be replaced quickly in case of trouble.

CapacitorSet• 7 years ago

To me it feels like it's less of "nobody [in the industry] knows who's responsible" and more of "everybody takes responsibility for the earnings and nobody for the evils".

bluesign4• 7 years ago

This totally depends on unspoken agreement and assumptions.

- You invited me to dinner, went to shopping, bought some stuff to cook, one ingredient was bad, I got poisoned.

In my opinion, here you don't have responsibility, because you acted with your best knowledge and good expectations from shop.

This kind of stuff is happening on google a lot too, this is not totally about some small shady company, working with another shady company.

dspillett2• 7 years ago

- You invited me to dinner, went to shopping, bought some stuff to cook, one ingredient was bad, I got poisoned.

The difference is due diligence. In picking ingredients and preparing them the host of this dinner has most likely taken care to use what they have good reason to believe a reputable sources and methods.

People placing add on sites and in apps are doing no such thing for the most part - beyond concerns of outrageously illegal adverts or those that might otherwise offend their audience directly, they are simply picking the provider that is likely to pay them the most. This is insufficient due diligence so they shouldn't be able to pass the buck, but they can because there are so many levels of indirection in the industry it becomes difficult to prove who failed most.

There is commonality with your food example: the recent meat source problems in Europe when cheap horse meat was unexpectedly found in many places it shouldn't have been. This highlighted how little due diligence was happening at various points in that industry and the fact that the many levels of supplier supplying supplier supplying supplier made it easy for problems to go unnoticed as no one thought it was them that needed to check.

kartickv• 7 years ago

Is there an ad network that doesn't use JS? You make a call to the ad network server, it returns an image, you display it in a native UIImageView (not a web view), and if the user taps it, you open a URL in a web view.

Unless the user taps the ad, no JS or HTML is involved, which eliminates the possibility of such tricks.

I looked for such a library a while back, but didn't find any.

jonahbenton• 7 years ago

Part of what js does in that ecosystem is support independent accounting for the advertiser of whether their ad was viewed and by who/what...which on the margins of course can still be tricked/gamed, but which for mainstream advertising is important.

FridgeSeal2• 7 years ago

Yes, you would think it would be that simple, but it’s definitely not.

Advertisers will give you double click (by google), atlas (Facebook), mediamind, etc tags m, to deliver as the ad. They will load in god knows what JS into their little space and (I cannot stress this enough), advertisers love their gimmicky little iteractable/expandable, engagement-filled ads.

To boot, they’re all laden with code to detect what publishers/sites/apps you’re displaying on, how much of the ad is viewable on screen and for how long, every scrap of code they can possibly fit in there to identify the user down to the finest grain they can manage.

You would think that things needn’t be this complex, but ad-tech companies have done a wonderful job of convincing advertisers that “targeted advertising is definitely better, and you definitely invest the extra cost in it, and definitely do all these other things because if you don’t then you’re totally falling behind your competitors, who are totally scraping every bit of data from their users, so you’d be a loser not to do the exact same thing and ~give all that dats to us.~ Sorry, make “valuable use” of all that data”.

runn1ng2• 7 years ago

Yeah, many supposedly legit websites (even large media companies) run these very scammy "man from YOUR LOCATION got rich in 20 days!" "one weird trick to get younger" ads that ultimately lead to some scam

But if you ask them, it's not their fault, but the ad company (Google), which in turn will point to a different company, etc

And in the end, people are scammed and Google gets a bit richer, but it's nobody's fault or responsibility

alecb• 7 years ago

FWIW the companies responsible for those ads are Taboola, Outbrain, and Revcontent. I posted one especially egregious example last week on r/adops:

https://www.reddit.com/r/adops/comments/b0n57e/its_embarrass...

pluma4• 7 years ago

Even worse, I've seen several large media companies and news sites run ads on mobile that completely hijack the (Android, i.e. Chrome) browser and redirect to a third party landing page. They usually seem to get killed off eventually but every now and then they pop up again.

I'm not sure if these ads specifically target Android devices but it wouldn't surprise me.

netsharc• 7 years ago

Even responsible journalistic websites like Der Spiegel (insert comment about Relotius here) run ads like these, where the ads appear like "related articles" underneath serious articles...

And people ask me why I block ads.

atomical• 7 years ago

This is why I use Brave browser. The internet needs ads but the ads should be whitelisted.

dspillett2• 7 years ago

That wouldn't help here.

The problem being discussed here was adverts being run in the background of locally installed apps, not adverts in pages displayed by a browser.

vnnkov• 7 years ago

This fingerpointing points to one of the core problems of the ad industry: They created a system where nobody knows who's responsible for anything, so malware and fraud has an easy time.

They know.

hopler4• 7 years ago

This isn't specific to ads. It's a problem either supply chain in every industry. It's why your clothes are made in dangerous sweatshops, why your electronics are made by dumping toxic chemicals in rivers, and why your chocolate is farmed by child slaves.

phkahler2• 7 years ago

> But this mode of thinking makes no sense. If you put ads in your app YOU are responsible. If you use an ad service from a shady company that outsources to other shady companies then you're still responsible.

Then it comes back to the Play Store. They like having all those free apps. It makes users feel like their Andriod phone has whatever they need. Google needs to make apps searchable based on privacy settings. They need to encourage people to pay for user respecting apps. I'd happily pay a buck or two for lots of apps if only they didn't have add or try to get me to buy add-ons. Just give me upfront honesty about what I'm getting and I'll pay you for it. Stop hosting crapware in the app store!

Kalium• 7 years ago

Have you ever tried to convince someone to pay for something they believe they can get for free? The number of people who will pay monthly for user-respecting basic fundamentals like email is shockingly small.

How much do you pay for your email?

jimmy1• 7 years ago

This fingerpointing points to one of the core problems of the ad industry: They created a system where nobody knows who's responsible for anything,

This sounds like a lot of industries...

ams6110• 7 years ago

If you put ads in your app YOU are responsible.

Take that line of thinking one more step. If a user installs a "free" app that is ad-supported, the USER is responsible.

I tell my kids this when they bitch about needing a new phone because theirs is too slow and the battery drains too fast. I say look at all the crap you installed on it. Clean it up don't be so dumb.

14• 7 years ago

Lol, Did we have the same dad you sound like me talking to my kids. It is because we love them we don’t sugar coat it. But the issue I have is why are these ad companies even allowed to siphon information from a tablet my “child” is using. I know one needs to watch the internet that small children use. But if I have a tablet solely used for my kid to watch shows and perhaps play some educational games or coloring, what business does any company have sucking up data from that tablet. Surely just by the list of apps installed, all children’s games, indicates immediately that a kid owned the tablet but I suppose that Is just another data point they have and like.

jasonlotito• 7 years ago

Nice Scotsman there.

If you use an ad service from a shady company

And what if they aren't shady? Something large from a well known, non-shady company, like Twitter? Because that's who is mentioned in the article: Twitter's MoPub.

And is the reverse true? If you use these shady companies (Twitter and MoPub) are you contributing to the success of shady companies?

Bad advertisers are real, and they really exist. But trying to say that the person who relies on that software equally responsible as everyone down the pipe is a bit of a stretch. Otherwise, I could make the same extreme arguments about pretty much every tech company, big and small, and all the people that use them.

Even you.

manigandham7• 7 years ago

Adtech companies know exactly who is responsible. Every ad on any serious network is approved before going live. Every single auction is logged, that's just basic tracking and necessary for billing anyway.

The problem is that there are no serious consequences in this industry. Ad fraud isn't a technical problem, it's a business problem, one that most companies are not incentivized to solve or prevent.

crankylinuxuser• 7 years ago

If companies are "people" in the legal sense, why isn't there a 'corporate death penalty' for utter gross violations that would get real humans locked in a case for decades?

Is the CFAA only for fleshers? Why so?

halfjoking• 7 years ago

I work for a publisher and basically these ad networks say "you'll lose 50% of your revenue if you implement 'safe frames' in Google AdManager 360. We have some publishers who do it but basically no advertiser wants to run ads in a safeframe."

So you're saying the standard practice is to let the malicious ad buyers from your network run arbitrary javascript on our sites...

"Yes that's what our publishers do..."

nitwit0052• 7 years ago

This is overlooking the problem of detecting that people are doing something malicious. There is a fairly large variety of unwanted behavior, both by the advertisements, and by the sites or apps hosting the ads.

o_nlogn_420• 7 years ago

This is simply not true. I work for a top 3 major ad exchange, and there's only so much validation that can happen when you process 10s of millions of requests per second that have to leave your system in 40ms.

MrMember• 7 years ago

This happens all the time when a website serves malware through ads. The site will claim it isn't their fault, they aren't the ones serving the ads. And then they have the audacity to try and shame people for using adblockers.

pwthornton• 7 years ago

I live this everyday. Our ad team blames the ad network they run on our products if malware gets through, rather than taking responsibility and banning the ad network. Or even better, taking responsibility themselves for selecting ad networks that run scams and malware.

To me, if an ad network allows crap through, we have to take onwership and penalize the ad network and move on. But there is no accountability. It's everyone fighting for that next penny.

No one in the supply chain takes responsibility for this. That's how I, someone who works for a company that has ad-supported products, runs an ad blocker at the router level in my home. If people are going to actively try to harm me and my family by hunting for pennies, I am going to seek protection.

And because no one takes responsibility for this whole mess, the whole house of cards will fall. More and more devices are coming with ad-blocking built in. If we can't responsibly create ad-supported businesses, how can we honestly expect people to want to see those ads?

Digital advertising is so divorced from making users happy.

imhelpingu• 7 years ago

The situation will never change for as long as """"""marketers"""""" continue to benefit from the big data collection it facilitates.

Reason077• 7 years ago

Isn’t the real issue here a technical one with MoPub’s ad platform?

How is it possible that a banner ad can open hidden off-screen views, and play video ads using a different (fraudulent) publisher ID? Can’t banners be sandboxed in order to prevent such activity, or at least detect it?

perlgeek• 7 years ago

Or phrased another way, why does a banner need to be anything more than an image, possibly an animated image?

Everything else screams of abuse and unnecessary tracking.

Cthulhu_2• 7 years ago

Simple: Because video ads are more effective, thus providing more sales for whatever's being advertised and more advertising income. Ad companies are trying to find the limit of annoyance vs effectiveness, and despite most people finding video ads and the like annoying, they're proven to be more effective than static ones.

jefftk2• 7 years ago

why does a banner need to be anything more than an image?

Because of exactly situations like this! Say you're an advertiser and you make an image banner. You make a deal with an ad network to show your ad on some pages. Some site makes a deal with the same ad network to show ads on its pages. Your ad is on the publisher page, users are seeing it, everything is good.

Now a scummy publisher signs up with this ad network, and sets the ads to display underneath something else. If the ads are just simple images and nothing more, there isn't a way for the advertiser or the ad network to tell that they're being scammed.

(Disclosure: I work at Google on making ads declarative so they don't get to do this sort of thing. Speaking for myself and not the company.)

HenryBemis• 7 years ago

I think I have written than more than a dozen times already :)

NoRoot Firewall for android devices. You make a Global Filter (aka firewall rule) that writes: asterisk.XYZ.com:asterisk and you are done with that specific tracker/advertiser. Sometimes they don't use URLs but IPs, in which case I take the extra 30 seconds to check who does the IP belong to on www.ipaddress.com and if it is a CDN, I allow it (only for the app), if it is MoPub, Adjust, etc. they get a royal block on 123.123.asterisk.asterisk:asterisk to get done with it.

NoRoot firewall also has a "Access Log" tab which shows which connections have gone through and which are rejected, so you can fine tune further.

Edit: replaced asterisks with the word "asterisk"

jefftk2• 7 years ago

In general, ads get to run arbitrary javascript. This is terrible, because once you open the door to a programming language people can pull in anything. Automated and manual review can help, but it's hard to stop technically.

I'm currently working on making ads declarative [1] so they don't get to do this anymore.

[1] Specifically, AMP Inabox, which is AMP ads on non-AMP pages: https://www.ampproject.org/docs/ads/amphtml_ads

tobyhinloopen• 7 years ago

TIL Ad fraud is fine, just don't drain our precious batteries?

TeMPOraL8• 7 years ago

Gangsters shooting gangsters isn't fine either, but regular people worry mostly about collateral damage.

foobar_• 7 years ago

You know many programmers are the 1% of the internet, in a way. I think almost every programmer has an adblocker.

I've been browsing without an adblocker for a while. I really recommend it. You will see scam after scam after scam ...

And most people, the 99% who don't use adblockers are falling for all these things.

Radle• 7 years ago

"Aniview denies any involvement and instead says the platform and banner ads and code, which were created by one of its subsidiaries, were exploited by a malicious, unnamed third party."

The Bucket has to stop somewhere...

phkahler2• 7 years ago

“I don’t even think about me being ripped off,” Julien told BuzzFeed News. “All I think about is them damaging the app’s reputation. It can cost money to [a user] and drain his battery.

We need more of that attitude in the world. So many companies try to make a buck doing things that ultimately damage their reputation. Once that's gone it's all down hill.

krn4• 7 years ago

I don't mind Google or Facebook showing ads in their own products, because that's the only business model that works at their scale and for what their offer. Imagine the world, in which the access to the most advanced search engine or social network was only available to the people who can afford to pay for it.

But I don't support using ad networks in the products that are not big enough to sell them themselves. Firstly, because it makes those products completely dependent on third-parties for their own existence. And secondly, because these products often become proxies for third-party user tracking.

Just let me pay for your product, if I like it enough. Otherwise, I will just rely on Blokada[1] to protect me from your unwillingness to find a sustainable business model.

[1] https://blokada.org/

GenericsMotors• 7 years ago

Been using Blokada since December and it's now a must-have; battery life has improved somewhat as well.

I don't even make heavy use of my phone for social media apps, yet have close to 300K ad-related requests blocked since I installed it.

vanderZwan2• 7 years ago

that's the only business model that works at their scale and for what their offer.

Do you have any basis for that claim? Because my impression is that historically there have been and are plenty of other businesses at their scale that did/do not need this at all.

krn4• 7 years ago

historically there have been and are plenty of other businesses at their scale that did/do not need this at all.

Have we ever had an internet company with over 1 billion active users not using advertising as its main source of income?

einrealist• 7 years ago

There is an interesting podcast about ad fraud and different schemes, on Software Engineering Daily.

https://softwareengineeringdaily.com/2019/03/12/ad-fraud-eng...

howard941• 7 years ago

On unmolested Android an app running in the background causes the o/s to display an un-closable icon in the notification bar, according to google so as to help users avoid getting into these background battery-draining situations. This doesn't absolve the app writer from deploying what's essentially badly-behaving fraudware.

sucrose• 7 years ago

He also acknowledged removing the photos and names of people, including his cofounder, Tal Melenboim, from Aniview’s website after being contacted by BuzzFeed News.

Streisand Effect. Archived version of their "Team" page: https://web.archive.org/web/20171004134601/http://www.anivie...

cwkoss2• 7 years ago

Would be great if ad networks would stop letting random companies embed whatever js they want.

There is no reason a banner ad should have this capability. Twitter's MoPub is showing their negligent greed.

That being said, draining video ads budgets is probably a pro-social 'Robin Hood' kind of theft.

ChuckMcM2• 7 years ago

From the article -- which will see more than $20 billion stolen this year.

Think about the number in that article for a minute, $20 BILLION dollars "stolen" last YEAR.

How many places are there in the world where you can steal over a billion dollars from them, and they won't hunt you down and kill your family? A nation-state? Nope they will send their intelligence service after you. A drug cartel? Don't even get me started, this is the same scale of numbers that drug cartels earn[1]

And since there is no "War on Ad Fraudsters", no departments dedicated to hunting down and arresting 'kingpin' Ad hackers, why would you sell drugs when you can make about the same amount, so much more safely? When you figure all the expenses you don't need, the bribes, the security forces, the underground tunnels, even going out and acquiring product. This is so much better way to stealing money.

[1] the estimate, from the Justice Department, that Colombian and Mexican cartels reap $18 billion to $39 billion from drug sales in the United States each year. --- https://www.nytimes.com/2012/06/17/magazine/how-a-mexican-dr...

stingraycharles• 7 years ago

Keep in mind that it’s primarily the publishers that are hurt by this. Advertisers typically determine what they’re willing to spend on inventory based on the ROI, which is decreased by ad fraud.

As such, the inventory of “genuine” publishers is devalued as well.

Note that in this sense, a publisher can be both a powerhouse like FB or Google, or also smaller outlets.

ChuckMcM2• 7 years ago

I completely agree, it is perhaps the greatest source of Google's CPC erosion over the past decade. But the tools available to go after these folks are limited.

h1rschnas3• 7 years ago

One more reason to use AdGuard on Android.

Ad Fraud Scheme Drained Users’ Batteries By Running Hidden Video Ads In Android

Related Stories