The discovery points to widespread fraud in which adverts are clicked among networks of sites to generate money for sites and ad networks – though it is still unclear whether it is one or more publishers, or one or more ad networks which supply ads to the sites, which are to blame for the fraud.
Spider.io, a security group which previously pointed out that a flaw in internet Explorer was being exploited by advertising companies to track users, says that the botnet consists of at least 120,000 subverted Windows machines, 95% of them located inside the US.
Unlike most botnets discovered in the past, which have been used to send spam and host illicit pharmaceutical or phishing sites, Chameleon targets a couple of hundred sites which carry advertising – and make up 9bn of the 14bn ad impressions on those sites each month.
But such a colossal number of ad impressions would make those sites in aggregate as large as Facebook or Yahoo – something that Mike Shields, a writer on Ad Week, says is highly unlikely.
Now the question is who set up the botnet. Douglas de Jager, of Spider.io, said the financial motive may be that "owners of websites typically receive 55%-65% of the money spent by advertisers to serve display ads on their respective sites. Ad networks typically receive about 30% of the money spent by advertisers."
But he declined to name any of the publishers being targeted by the bots, because they might be the targets of a scam run from outside – or, he suggested, "it could even be a single person within one of the companies, unbeknownst to others at the company."
Fake ad impressions
The bots are tailored specifically for creating fake ad impressions: "individual bots run [Adobe] Flash and execute Javascript [used to display many ads]," the researchers note. "They click on ad impressions with an average click-through rate of 0.02%" – slightly higher than humans – "and generate mouse traces." The bots appear to sites as PCs running internet Explorer 9.0 on Windows 7.
But while that looks real enough, the clue is that the bots only visit 202 websites – and occasionally crash. They also generate clicks randomly dispersed around the page – unlike a real human viewing the page.
De Jager notes that "this particular botnet is being used to emulate human users surfing the web … it is difficult to imagine why one would run this type of botnet across a cluster of 202 sites, other than to commit display advertising fraud." The bots are not scraping data, he added.
One advertising executive who spoke to the Guardian on condition of anonymity said: "It's not just the 202 sites mentioned in Spider's research. Many other sites are being affected by other botnets. Some of these publishers may not be 100% at fault. It is possible that they may be unwitting pawns in someone else's fraud scheme. Regardless, they are huge beneficiaries of that behaviour, whether they are aware of it or not. And any publisher experiencing a huge growth in traffic should take responsibility for knowing where that traffic originates."
Two publisher networks, Alphabird and Digimogul, have been identified as particular beneficiaries of the fake traffic. The executive listed four more – Forward Health, Precision Media, HiFi network and Relevad Corporation – which he felt were beneficiaries of "suspicious" traffic. There is no suggestion that the networks are complicit in the botnet's activity.
Digimogul had not responded to a request for comment by the time this story was published. Alphabird was unavailable ahead of publication, but Justin Manes, Alphabird's chief operating officer, told Ad Week: "We buy lots of traffic all over the web, and we run a heavy ad load because you have to pay for it. We buy 100,000 visits for some sites [on the Alphabird network] and these sites obviously need content." He insisted that any fake clicks on ads meant "we're being duped. We're being robbed."
Digimogul's chief executive told Ad Week that suggestions it has bot traffic to boost its page view numbers – totalling a billion ad impressions for one film site, which would put it in contention with Yahoo – were "silly". He told the site: "If we were using bots, we would be getting caught. Everything is by the book."
Indications of fraud
But one advertiser says the company began realising there was a wide-ranging fraud a couple of months ago. "Our data science team began to see strange signals in the bid request data we receive from exchanges that indicated that something was amiss.
"We were first tipped off by the fact that particular newly created websites, that were putting their inventory on the exchanges, were scoring particularly high on our targeting models across many different clients. The scores they were receiving were off the charts. They were receiving scores higher than we have ever seen before for any website and they were scoring this way for many clients."
That was peculiar because the sites were too new to have gained a substantial amount of traffic by organic means – and yet seemed to have eager readers of exactly the right sort.
"These websites varied in content drastically, yet they were all indicative of good converters [visitors likely to click ads] for a large number of clients," a representative of the advertiser said. "For example, a Chinese movie site, a woman's health site, an allergy site, and a video-game site were all being visited by the best converters for a women's clothing site, an insurance site, a travel site, and a restaurant."
Unreasonable overlaps
Yet despite the disparate interests for which they catered, the sites had an "unreasonable" level of overlap in their user bases. So whereas the highest overlap between the New York Times's readership is with YouTube users – at 55% – a hip-hop site in a suspect network showed a 96% overlap with a film fan site, an 89% overlap with a men's health site, and also an 85% overlap with a women's health site, based on the cookies stored on the machine from earlier browsing.
"Over a hundred sites had over 50% over the same viewers as the hip-hop site," the network representative said. "What is even more suspicious is the variety in the types of sites. Apparently, all these 'people' that are interested in hip hop in finance, prescription drugs, men's health, women's health, cooking, futons, and greeting cards. There are many sites like those, and more and more are popping up daily.
"These sites were essentially herding users back and forth to rack up impressions on the exchanges. We dug further into the bid request logs and found users that are traversing back and forth between these sites sometimes at rates exceeding one advertisement per three seconds for a period of weeks."
The key problem identified by would-be advertisers is that ad exchanges – which let them choose sites which claim they will put ads in front of humans most likely to be interested in them – do too little to keep out networks of dubious reputation.
guardian.co.uk © Guardian News and Media 2013
