Internet Advertising: Is Your Browser Putting You at Risk?

Transcription

1 ANALYST BRIEF Is Your Browser Putting You at Risk? PART 2: CLICK FRAUD Authors Francisco Artes, Stefan Frei, Ken Baylor, Jayendra Pathak, Bob Walder Overview The US online advertising market in 2011 was approximately $155 billion USD. 1 Fraudsters utilize click fraud to deflect some of this money to them or to deplete their competitors marketing budgets. In the process, millions of consumer and corporate users are infected by malware as a byproduct of this war between ad buyers, ad publishers and fraudsters. Click fraud is a type of Internet crime that abuses pay- per- click online advertising for the purpose of generating a charge per click, of which the criminal is paid a percentage of the ad revenue. The effects of click fraud can be devastating for small business owners and very costly for big budget ad buyers. For individuals and enterprise users, the effects of click fraud itself are malignant, as click fraudsters fund many malware campaigns. These campaigns lead to multiple malware infections such as banking trojans that typically accompany each click fraud software installation. NSS Labs Findings Click fraud itself, causes minimal direct harm to the typical end user, as the ultimate target is the ad buyer. Consumer and corporate users are infected by additional malware as a byproduct of click fraud installation. Click fraud catch rates are Chrome 1.6%, Firefox 0.8%, Internet Explorer 96.6%, and Safari 0.7%. Services are available that may help ad buyers identify click fraud. However, service contracts with ad networks may contain clauses that restrict ad buyers ability to recover damages for click fraud. 2 The average lifespan of a click fraud URL was 32 hours with over 50% expiring within 54 hours. 1 advertising- revenues- continue- growth / 2 Section 5.

2 NSS Labs Recommendations Ad buyers should: Put pressure on Google to increase the click fraud protection capabilities of Chrome and the SafeBrowsing API. Consider the use of click fraud forensics to reduce the amount of click fraud damages. Check and challenge contract clauses that may limit damages or restrict ability to recover damages. Prepare for major growth of click fraud in Analysis Who Is Affected by Click Fraud? Primary Victims Ad buyers: Ad buyers purchase ads from ad publishers and are impacted by click fraud directly, as they pay for the total number of clicks (valid clicks and undetected click fraud). Secondary Victims Ad Publishers: The existence of click fraud has the potential to damage both the reputation of ad publishers and general confidence in the online advertising economy. Most attempt to identify click fraud and actively reduce it via the use of fraud detection engines, thus combating negative perceptions. Consumers and Corporate Users: As ad publishers fraud detection engines become more sophisticated, fraudsters evolve creative methods of simulating undetectable traffic. One method is to infect millions of unsuspecting consumers and enterprise users with click fraud malware, which will convert their machines into bots. As these fraudsters have a strong cash flow, they finance many pay- per- install campaigns. Unfortunately, other malware is frequently packaged with the click fraud malware, leaving victims open to intellectual property and account theft. Beneficiaries Criminals: Authors of click fraud malware may benefit through direct sales of exploits or via ad revenue from fraudulent clicks. Organized crime syndicates are known to establish websites with the express intent of perpetrating click fraud. One common method is to infect unsuspecting consumers and enterprise users with a combination of click fraud and other malware, turning their machines into bot networks that serve as launching pads for other criminal activities. Web Site Owners: Web site owners may perpetrate click fraud as they get paid a proportion of ad revenue when users click ads that are displayed on their site. This includes organized crime syndicates that establish websites with the express intent of perpetrating click fraud. Business rivals may purposely use click fraud to deplete their competitors marketing budget. Ad Publishers: Ad publishers passively benefit from click fraud, as they earn a portion of revenue every time one of their ads is clicked, fraudulently or not. They also benefit as click fraud artificially inflates click rates, reducing confidence in their competitors and causing ad purchasers to defect to their ad network. 2

3 According to Adometry, an organization specializing in click forensics and click fraud detection, In an environment where more clicks equals more money, limiting total clicks implicitly means ad networks reduce revenue. 3 Test Results The average lifespan of a click fraud URL was 32 hours with over 50% expiring within 54 hours. This shows us that click fraud is distributed via quick strike campaigns. Protection technologies must respond within this timeframe in order to be effective. 100% Decay of Malicious URLs Over Time. Percent URLs Expired / ReRred 80% 60% 40% 20% 57% 0% LifeRme in Hours Figure 1 Cumulative Distribution 3 3

4 Figure 2 highlights the browser block rates by class of malware purpose. Internet Explorer exhibits the highest block rate, followed by Google Chrome, and then either Firefox or Safari. However, there is significant difference in the ability of each browser to block the different types of malware. This report applies to click fraud only, and should not be used as the sole basis for browser selection. Block Rate Unique Payload (MD5) Firefox Chrome Internet Explorer Safari ClickFraud 0.8% 1.6% 96.6% 0.7% Not ClickFraud 6.3% 25.9% 92.4% 6.6% Safari 0.7% 6.6% Internet Explorer 96.6% 92.4% Chrome Firefox 1.6% 0.8% 6.3% 25.9% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Figure 2 Block Rate Unique Payload (MD5) While it is apparent from these results that click fraud is a leading purpose of browser malware, it is surprising and concerning that there is such a large difference between blocked rates for other malware types vs. click fraud from browser to browser. As seen in Figure 2, NSS Labs found Chrome blocked only 1.6% of click fraud as compared to its block rate of other malware of 25.9%. 4

5 Impact 70% 60% 50% 40% 30% 20% 10% 0% Internet Explorer Firefox Chrome Safari Opera Other Figure 3 Market Share by Browser Chrome s adoption rate has established it as the leader in overall browser market share 4 as of the latter half of Unless Chrome improves its protection against click fraud, NSS predicts an increase in fraudulent click transaction rates given Chrome s dominant and increasing market share. 35% 30% 25% 20% 15% 10% 5% 0% Firefox Safari Chrome Internet Explorer Figure 4 Click Fraud Downloads by Browser This graph represents the overlay of our test results when applied to the change in market share of each of the tested browsers since NSS predicts an increase in fraudulent click transaction rates given Chrome s increasing market share. With the growth of online advertising revenues, the profitability of click fraud, and the weakness of leading browsers to protect end users, NSS predicts major growth in click fraud in

6 Contact Information NSS Labs, Inc. 206 Wild Basin Rd Building A, Suite 200 Austin, TX USA +1 (512) This analyst brief was produced as part of NSS Labs independent testing information services. Leading products were tested at no cost to the vendor, and NSS Labs received no vendor funding to produce this analyst brief NSS Labs, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the authors. Please note that access to or use of this report is conditioned on the following: 1. The information in this report is subject to change by NSS Labs without notice. 2. The information in this report is believed by NSS Labs to be accurate and reliable at the time of publication, but is not guaranteed. All use of and reliance on this report are at the reader s sole risk. NSS Labs is not liable or responsible for any damages, losses, or expenses arising from any error or omission in this report. 3. NO WARRANTIES, EXPRESS OR IMPLIED ARE GIVEN BY NSS LABS. ALL IMPLIED WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON- INFRINGEMENT ARE DISCLAIMED AND EXCLUDED BY NSS LABS. IN NO EVENT SHALL NSS LABS BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES, OR FOR ANY LOSS OF PROFIT, REVENUE, DATA, COMPUTER PROGRAMS, OR OTHER ASSETS, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. 4. This report does not constitute an endorsement, recommendation, or guarantee of any of the products (hardware or software) tested or the hardware and software used in testing the products. The testing does not guarantee that there are no errors or defects in the products or that the products will meet the reader s expectations, requirements, needs, or specifications, or that they will operate without interruption. 5. This report does not imply any endorsement, sponsorship, affiliation, or verification by or with any organizations mentioned in this report. 6. All trademarks, service marks, and trade names used in this report are the trademarks, service marks, and trade names of their respective owners. 6