Google just shut down what is considered to be the most sophisticated mobile ad fraud yet. A company hid code in an application available in the Google Play store which automatically "clicked" on websites in the background without the user having any idea it was going on.
https://www.forbes.com/sites/thomasbrewster/2017/05/26/google-shuts-down-massive-ad-fraud-on-play-store/#301327547807
While this represents yet another episode in the cat and mouse game between ad providers and those who try and cheat the system, it points to a growing level of sophistication and brazenness. To upload an application to the Google Play or App Store is to not only try and hide in plain sight, but on some level to accept that you will most likely be caught. The fact that this app went undetected for a year and made millions of dollars through ad fraud will no doubt only encourage larger and more sophisticated attacks. It also begs the question as to how many more similar apps are already out there that haven't been identified.
Android is by no means alone in this struggle, "Malvertising" is also affecting iOS devices. One article (https://blog.malwarebytes.com/threat-analysis/2017/04/malvertising-on-ios-pushes-eyebrow-raising-vpn-app/) does a nice job of tracking how one particular foul product works:
"This malvertising chain starts off with an ad call from Propeller Ads Media, goes through Real Time Bidding (RTB) via AdMetix, is redirected to RevenueHits, and finishes off with scammy advertisers."
This highlights one of the digital ad world's biggest problems: the complex network and ecosystem of providers that come together to show you an ad are vulnerable to misbehaving participants inserting offending content somewhere along the chain and it's very hard to protect against.
No comments:
Post a Comment