Experts say issue of click fraud not improving
471102
Companies like Google and Yahoo that control major online advertising networks have not met their pledge to aggressively ferret-out click fraud among their affiliate partners, driving growth of the problem across the entire Web industry, according to new research estimates.Click Forensics -- an independent click fraud monitoring and reporting service that markets itself as an online version of the TV industry's Nielsen ratings system -- released its latest statistics tracking Internet advertising trends on Friday, and the group reported that the issue of fraudulent ad traffic continues thrive on the Web.According to the company, roughly 16.2 percent of all online ad clicks were derived via click fraud during the third quarter of 2007 compared to a rate of 13.8 percent for the same period during 2006 and up from 15.8 percent of all traffic during the second quarter of this year.Even more concerning, Click Forensics leaders said, is the report's finding that the average rate of click fraud -- most often carried out by software programs designed to mimic legitimate traffic -- continues to rise on major search engine networks, including Google's AdSense and the Yahoo Publisher Network.Fraudulent traffic accounted for 28.1 percent of all ad hits on such networks during the third quarter of 2007 compared to 25.6 percent for the second quarter of this year and 21.9 percent for the first three months of the calendar, Click Forensics contends.The research company also reported that more than 60 percent of all ad traffic coming from so-called parked domains -- typically used solely to funnel traffic to advertisers -- was observed as being fraudulent during the third quarter of 2007.Tom Cuthbert, chief executive of Click Forensics, said that as a result of the negative impact that click fraud is having on Web advertising as a whole -- in that it undermines the legitimacy of all Internet ad traffic -- both publishers and advertisers are feeling a pinch.Ad publishers are seeing a diminishing of their network traffic quality, said Cuthbert, while advertisers are seeing their conversion rates "drop significantly" on content networks and are pulling back some of their spending as a result, he said."The issue of click fraud on these major networks is becoming a real problem for advertisers, and increasingly, they are choosing to stay away and look into other alternatives," Cuthbert said. "The big guys are not doing a better job of policing themselves; both Google and Yahoo have tools for advertisers to opt-out of suspected click fraud sites, but the vast majority of advertisers are not doing so, and the tools are too hard to use."Cuthbert said that the major network providers have promised to cooperate with efforts to drive down automated ad clicks and other forms of fraud but have not followed through on their promises."We've asked the search engines to work with us to improve the situation, and they've said yes, but here we are 18 months later, and we've seen no movement in that area, which is frustrating for us and for advertisers as a whole," said Cuthbert. "So far, we've had a great process of discussion, but we're really hoping to see them act on those ideas."Ideally, Click Forensics -- which claims to derive its figures from statistics provided by 4,000 advertisers and agencies participating in its Click Fraud Network consortium -- would like to serve as an objective third party that is used as a clearinghouse for identifying online ad fraud, much as Nielsen provides rating figures for the TV industry.Without such an entity, the ad networks continue to hold most of the cards, leaving advertisers at a disadvantage, he said."There needs to be better communication and sharing of data. We have information about traffic that these guys don't have, such as conversion data and other things from the actual advertisers, that they're very skeptical to give to Google or Yahoo," said Cuthbert. "Ultimately, we believe that the first provider to embrace this third-party model we're proposing will have a significant advantage over its rivals."Google disputes Click Forensics' figures Yahoo representatives didn't immediately return calls seeking comment on the Click Forensics report, but Google officials countered that Click Forensics' estimates don't accurately represent the company's own click fraud statistics.While Click Forensics has its 4,000 partners, the search giant claims to view a far broader and detailed swath of ad traffic, giving it a more comprehensive perspective. Google has consistently questioned the legitimacy of Click Forensics' figures since the company began issuing its reports in 2006."These estimates have never reflected the invalid click rates we see at Google; Click Forensics has consistently been one of the highest estimates our there with numerous serious methodology problems, and, as such, we rarely get asked about them these day," said Shuman Ghosemajumder, business product manager for the Trust &amp; Safety group at Google.Ghosemajumder said that Google offers "significantly more transparency" into its click fraud efforts and provides more traffic quality tools for advertisers than any of its rivals."We plan to do even more in the future," he said.Among the measures that Google has employed to help advertisers thwart click fraud were the launch of new IP exclusion and Placement Performance Reports in June, tools that Ghosemajumder labeled as unique features in the industry.The IP exclusion tool is meant to allow advertisers to specify IP addresses they want to avoid with their ads and builds on the site exclusion feature the company introduced in 2005, which allows advertisers to prohibit specific URLs from showing their content.The Placement Performance Reports are designed to give advertisers the ability to view which sites are performing the best among those displaying their content, which specifically arms the companies with the opportunity to use the site exclusion and site targeting tools drive out any apparent fraud, Google said.In August, the search giant also launched an Ad Traffic Quality Resource Center, which is meant to offer a single place where advertisers can access all of Google's click fraud resources.Some smaller search providers believe that they can begin winning advertisers' business away from their larger rivals by providing stronger methods of fighting click fraud.Daniel Yomtobian, chief executive of ABCSearch, said that his company has begun luring large, well-known advertisers like VeriSign away from other venues with a tool dubbed ClickShield, which promises to profile advertising affiliate behavior to give its customers better insight into just how their content is being distributed.Yomtobian points out that Click Defense, an online marketing firm that offers independent click fraud detection services, recently charted his company's traffic as having less than 5 percent fraudulent ad hits."As an industry we can't burden the advertisers and can't burden the users, as ad networks we all need to do a better job and police affiliates to drive down fraud," he said. "A lot of our competitors talk about their technologies to fight this problem, but a lot of that work is merely basic click fraud-blocking; by going above and beyond, we feel that we can grow our business based on delivery of a lower rate of unwanted traffic."
415534
Little progress has been made in cracking down on benefit fraud and error, a spending watchdog has said.
56130
Users should be wary of pressing the 'click here to remove' link on spam messages because it serves to confirm to spammers that junk mail messages are being read.
413097
The firm has rated the flaw as moderately critical. It demonstrated the flaw on its site, with options for both users who use pop-up blockers and those who don&#39;t.
94259
Pay-per-click advertising fraud is becoming more pervasive as spurious clicks can be generated through automated programs.
678512
Fraud committed by government contractors in Iraq is a problem but isn't as severe as some critics have suggested, federal officials said Tuesday.
694814
The battle between advertisers and online search networks over the pervasiveness of click-fraud continues to grow more heated with researchers claiming rapid growth of automated ad impressions and outside observers noting an overall lack of transparency in the space.
553897
Just when experts thought the spam tide was receding, it did what tides will do. The problem's worse than ever, and image-based attacks using artificial intelligence are to blame.
618610
Could this be an end to broken links? New software replaces and updates links on Web pages.
175189
(InfoWorld) - Though security industry experts were openly referring to the death of spam several years ago, the arrival of image-based attacks has resulted in a stunning renaissance in the volumes of unwanted e-mail reaching end-users' inboxes. And while filtering technologies have improved significantly and can thwart the ability of most image spam to force its way onto corporate networks today, some experts believe that the fight against the use of such AI (artificial intelligence) tactics on the part of spammers is only just getting underway. In a new report published on May 30, analysts at Cambridge, Mass.-based Forrester Research extrapolate on their theory that image spam is merely the tip of the iceberg when it comes to spammers' use of AI. The only way to prevent a repeat of the image spam surge as new models using AI come to light, Forrester analysts said, will be for technology vendors and enterprise customers to abandon their current approach of trying to filter out every type of campaign that the mass-mailers conceive and instead battle the roots of the problem. Just as Web sites and anti-spam providers have utilized techniques such a CAPTCHA -- the challenge response tests found in many different online applications that ask users to input characters planted into obfuscated image files -- to beat back unwanted bot-driven activity, so too will spammers utilize AI to create seemingly endless variations on their message campaigns to circumvent the latest filtering tools, the experts said in their report. CAPTCHA is an acronym for "completely automated public Turing test to tell computers and humans apart," a concept named after Alan Turing, the English mathematician referred to by some as the father of modern computer science. "The notion with CAPTCHA is that computer bots and other programs can't efficiently process the image, that they can't deduce the words in the image, and that's the same thing that spammers are doing today to defeat traditional filters," said Dr. Chenxi Wang, one of the analysts who authored the research. "People have devised new filters that use technologies such as optical character recognition that has curtailed the spread of image spam," said Wang. "Unfortunately image spam is only one type of AI problem, and spammers have many they will use in the future; this only the beginning of an arms race." Just as CAPTCHA has largely foiled the ability of scammers to game online registration and transactional systems, spammers will be able to use a nearly endless variety of techniques to avoid the latest and greatest message filtering tools, the analyst said. Without a major breakthrough in AI research, Wang said, there is "no way we can bridge the gap" with the number of methods that spammers will be able to use to keep their schemes humming along. Among the types of methods that spammers are already employing to beat existing image-filtering tools are spam campaigns that use distorted and obfuscated text images, graphic pictures, and audio and video files. To fight spammers over each type of content will be a losing battle, Wang said, recommending that customers and technology providers instead focus on monitoring messages for fundamental properties exhibited by each flavor, such as the links to malware sites that most of the e-mails carry. "Vendors should look through brouhaha calling for them to defend against each type of image spam and build products that attempt to capture the fundamental properties of spam," said Wang. "They can use techniques such as intent analysis and URL reputation analysis; those factors won't change with each new type of campaign that's being invented." While conceding that the fight against spammers isn't one that will ever likely draw to a close, companies such as ISPs that are working harder than ever to keep unwanted e-mail from reaching their customers say that progress is being made. Stephen Currie, director of product management for e-mail, at Atlanta-based ISP EarthLink, which reported 2006 revenues of more than $1.3 billion, said that his company has been able to reduce the amount of spam reaching its customers by 80 percent in the last 18 months. Using filtering tools sourced from software maker Cloudmark and its internally developed Scamblocker.com anti-phishing resource, along with a heavy dose of input from its users, has allowed the firm to turn up the heat on image spam and other AI campaigns, he said. "The message content fingerprinting technologies from San Francisco-based Cloudmark allow us to understand message contents without ever opening them up, and it doesn't require as much CPU power on our end as it would have even several years ago," Currie said. "But the real key has been to become very aggressive about using the feedback we get from end-users to stop spam that initially finds a way through." Just as CAPTCHA relies on human interaction to defeat automated input, the approach of using customer feedback to identify and block spam sources is one that has trumped technological means, the executive said. "Once we determine the root source of a campaign using these types of methods, we can block a lot of the IP addresses being used to stop it from sending additional mail to our servers," Currie said. "Although we're getting shipped more spam than ever, customers are telling us that they're now getting less than over the last several years, but we absolutely expect new things to come along and challenge us; it's the proverbial cat-and-mouse game." In addition to utilizing human and technological means to stop spam, EarthLink is also involved in the Messaging Anti-Abuse Working Group (MAAWG), a global ISP initiative aimed at improving the current state of electronic messaging. In mid-May, the group released its latest Sender Best Communications Practices (BCP), a set of best practices for e-mail technologies and subscription methods meant to improve deliverability rates for legitimate newsletter and marketing messages. Officials with San Carlos, Calif.-based e-mail security service provider Postini -- which claims to process more than 1 billion messages per day for more than 35,000 organizations -- said that spam levels continue to set new records and that unwanted e-mails currently account for roughly 40 percent of all traffic it monitors. In addition to high levels of image spam, the company is also tracking developments such as an increase in the volume of messages that appear to be meant to harvest e-mail addresses for subsequent malware attacks, including botnet threats. Other recent trends under investigation by the firm include spam that attempts to evade filtering tools by using strings of gibberish to confuse content scanning technologies. The company maintains that its products can help customers catch up to 99 percent of all spam if they are willing to employ the most aggressive settings available, but Postini executives said that users' fear of missing legitimate messages forces most companies to seek a balance between warding off unwanted e-mail and toning down the possibility for false positives. "Because the overall volume of spam continues to increase, clients are seeing a few more messages per day sneaking in, and it does tend to be image spam, but progress is being made," said Adam Swidler, Postini's senior manager of solutions marketing. "It's probably naive to think that this fight will ever end as long as there is a monetary driver for the bad guys, but we do think that we can help get to a place where spam is only a minor nuisance."
497773
Researchers at Carnegie Mellon are exploring ways to make it harder for individuals to function on the Internet black market, which has a pronounced reputation-economy component that may probe an Achilles heel.
466855
New service helps companies thwart online scams.
442479
The fight against identity theft in the U.S. isn't going so well, according to new research released by Gartner Inc. And it doesn't look like it's going to get better anytime soon.
228635
A whopping 70% of respondents say they&#39;ve been duped, and 15% admit to revealing personal information. By Thomas Claburn. Phishing could cost consumers $500 million this year, according to a new study conducted
523305
EBay and PayPal, once the primary lures used by phishers to trick e-mail users into giving up personal information, aren&#39;t as popular as they used to be.According to security vendor Sophos, which monitors&#160;spam and phishing&#160;e-mails to catch new blasts and determine trends, the number of messages pretending to be from eBay or its payment subsidiary PayPal has dropped from 85 percent of all phishing e-mails a year ago to 21 percent in September.&quot;That&#39;s an impressive turnaround by anyone&#39;s standards,&quot; said Graham Cluley, senior technology consultant at Sophos, in a prepared statement.Cluley attributes this drop in part to&#160;online initiatives&#160;by eBay and PayPal to educate their customers about phishing scams, and to PayPal&#39;s launch earlier this year of an&#160;authentication keyfob&#160;that creates a dynamic password for customers concerned with fraud.Sophos says the amount of phishing attacks circulating have stayed relatively consistent over the past year, but now phishers are using different tactics to try and fool recipients. Phishers are beginning to diversify by spoofing small credit unions, other online retailers, and overseas companies, he says.Network World is an InfoWorld affiliate.
369741
A service launched last week that aims to help online users determine whether their credit card and Social Security numbers may have been compromised is running into skepticism about how secure -- and safe -- it is.
162029
Rise in online identity fraud has companies on the hook: Educate customers or lose them.