Monday, November 26, 2007

Google's Security Flaw

Table of contents:

u What is Google AdSense?

u What is Click Fraud?

u Is it safe and reliable to show ads via Google AdSense?

u Google sued for invalid clicks!!

u Background of my findings about the flaw in Google's system


What is Google AdSense? [Source: https://www.google.com/adsense/]

"Google AdSense is a fast and easy way for website publishers of all sizes to display relevant Google ads on their web site's content pages and earn money. Because the ads are related to what your visitors are looking for on your site — or matched to the characteristics and interests of the visitors your content attracts — you'll finally have a way to both monetize and enhance your content pages.

It's also a way for website publishers to provide Google web and site search to their visitors, and to earn money by displaying Google ads on the search results pages."

To explain it in detail, [Source: Dr. Tuzhilin’s report (Professor of Information Systems at the Stern School of Business at New York University) ]

Google AdSense is a program for the website owners (known as publishers) to display Google’s ads on their websites and earn money from Google as a result. To participate in this program, website publishers need to register with Google and be accepted into the program by Google. These ads shown on the publishers’ websites are administered by Google and generate revenue on either per-click or per-thousand-ads-displayed basis.

Since we are interested in click fraud, we will limit our considerations only to clicks and to the PPC (Pay Per Click) payment method. AdSense was launched in March 2003 and constituted the second major milestone in Google’s PPC advertising model that generated significant additional revenues for the company.

There are two ways for publishers to participate in the AdSense program:

AdSense for Search (AFS): publishers allow Google to place its ads on their websites when the user does keyword-based searches on their sites. In other words, as a result of a search, relevant ads are displayed as links sponsored by Google, and these links are produced using the same methods as on Google.com. Examples of such publishers include AOL and EarthLink. Moreover, the search results pages containing the ads are customizable to fit with the publisher’s site theme, and may have a different “flavor” than the ads on Google.com.

AdSense for Content (AFC): the system that automatically delivers targeted ads to the publisher’s web pages that the user is visiting. These ads are based on the content of the visited pages, geographical location and some other factors. These ads are usually preceded by statement “Ads by Google.” Google has developed methods for matching the ads to the content of the pages that also take into account the CPC (Cost Per Click) values when selecting the best ads to place on the page. The whole idea is to display ads that are relevant to the users and to what the users are looking for on the site so that they would click on the displayed ads. This is also combined with financial considerations (the CPC factor) to maximize the expected revenues for Google from displaying the ad.

In both the AFS and the AFC cases, the publishers and Google are being paid by the advertisers on the PPC basis. Google does not disclose how it shares the clicking revenues with the publishers. What the publishers can see though, are the detailed on line reports helping the publishers to track their earnings. These reports contain several statistics of clicking activities on the ads displayed on publisher’s website. These statistics help the publisher to get an idea of how well his or her website is performing in the AdSense program and how much the publisher is expected to earn over time.

As we can see from this description, there is a direct incentive for the publishers to attract traffic to their websites and encourage the visitors to click on Google’s ads on the site to maximize their own AdSense income. They can do this in three ways:

Build a valuable content on the site that attracts the most highly paid ads.

Use a wide range of traffic generating techniques, including online advertising.

Encourage clicks on ads using legitimate means (Google has a list of prohibited activities for the publishers, such as explicit requests to click on Google’s ads, that can lead to terminations of their accounts).

Unfortunately, overzealous and unethical users can “stretch” or directly abuse this system in the effort to maximize their revenues from the AdSense program. This leads to the invalid clicks problem discussed in the next section.

It is interesting to note that AdWords and AdSense have different motivations for the unethical users to abuse the programs. Unethical users on AdWords constitute advertisers or their partners whose motivation is to hurt other advertisers. In contrast to this, the main motivation of the AdSense unethical publishers is to enrich themselves through certain prohibited means. Therefore, motivations of these two groups of unethical users are significantly different.

Although both motivations are important and should be addressed in the most serious manner, greedy motivations of unethical AdSense publishers constitute more serious problem for Google than the desire to hurt the competitors by unethical advertisers or their partners. This results in a significantly greater percentage of invalid clicks being generated by unethical AdSense publishers than by unethical AdWords advertisers (however, it is not clear if this statement is still true in terms of absolute numbers of invalid clicks generated by these two sources because of different volumes of clicks for the two programs).


What is Click Fraud? [Source: http://www.clickz.com/showPage.html?page=3453201]

Overture (Company, now part of Yahoo!) defines click fraud as, "clicks arising for reasons other than the good-faith intention of an Internet user to visit a Web site to purchase goods or services or to obtain information," according to spokesperson Dina Freeman.

Google is a bit more specific, defining click fraud, "or invalid clicks, as any method used to artificially and/or maliciously generate clicks or page impressions," according to Salar Kamangar, director of product management.

Examples of invalid clicks, according to Kamangar, include: manual clicks on an ad to purposefully increase the ad spend; deliberate clicks on an ad to increase profits by site owners hosting the ads; and automated clicking tools, 'bots, or other deceptive software.”

Is it safe and reliable to show ads via Google AdSense?

According to Google spoke person [Source: http://www.clickz.com/showPage.html?page=3453201],

"Our system automatically distinguishes between clicks generated through normal use by users, and clicks generated by unethical users and automated robots, enabling us to filter out invalid clicks," Kamangar said.

Google provided three examples of techniques it uses to detect invalid click activity. First, it employs standard click monitoring techniques; examining every click into its system based on signals such as IP address, duplicate clicks, and other basic click patterns for invalid click activity.

Second, Google uses advanced monitoring techniques developed by a team holding PhDs in computer science, statistics, and mathematics to detect and handle invalid click activity. "This group has developed innovative and effective proprietary security mechanisms which we continually augment and improve to adapt to changes in invalid click behavior," Kamangar said. "We invest in research and development to continually upgrade our detection mechanisms to proactively combat invalid click activity."

Finally, Google employs a team of technical specialists whose job is to manually investigate individual cases where click fraud is suspected. "The team uses specialized tools and a wide variety of techniques based on extensive experience tracking and monitoring invalid click activity," Kamangar said. "When signs of invalid click activity are detected, this team has advanced resources for identifying the perpetrators of this activity."


Google sued for invalid clicks!!

To the contrary of their claim, in year 2005 one lawsuit were filed to claim reimbursement of invalid clicks and in year 2006 Google had settled the matter of invalid clicks in $90 million. Please refer the links below for more details,

1). http://seattlepi.nwsource.com/business/279182_clickfraud28.html

2). http://www.msnbc.msn.com/id/11734026/

3). http://www.usatoday.com/tech/news/2006-07-27-google-clickfraud_x.htm?csp=34


Background of my findings about the flaw in Google's system

I own a website and have a Google AdSense account. In the early days when I was getting information about earning money via my website, I came to know about Google AdSense. Being an engineer I am always curious about what is happening behind the scenes, so I went through the AdSense ad generator code which can be easily download from Google's server, which they used to generate Ads.

To know more about PPC model of advertisement I had gone through number of articles/reports on Pay Per Click mechanism including the report of Dr. Tuzhilin (Professor of Information Systems at the Stern School of Business at New York University), who evaluated Google’s invalid click detection efforts (Attached PDF Report [Source: http://ebiquity.umbc.edu/blogger/2006/07/25/revealed-how-google-manages-click-fraud/]).

After going through all those articles and analyzing Google’s code I found a way to simulate human behavior in click generation and page impressions in proper (acceptable) ratio from different geographic location (IP address) and was able to credit thousands of dollars in my AdSense account (By not a single human being generated click).

This all could be possible with a simple trick... execute Google's Ad Generator code on server and retrieve all ad links at web server only (with the help of html parser). Then send those Ad links to client and navigate them from client side.