Russian scam is defrauding digital advertisers of millions of dollars
An online scam that uses automated web browsers to siphon millions of dollars of advertising revenue from US media companies and advertisers has been discovered by US-based cybersecurity company White Ops. Dubbed "methbot", the sophisticated robot is said to be generating fake views of 300 million video ads per day, which advertisers are being tricked into paying for. Although White Ops has found the attack originated in Russia, the Russian government is not thought to be involved. The advertising industry, the US government and other cybersecurity firms are still to confirm White Ops' allegations.
watch now

A cybersecurity firm says it has uncovered a massive online scam that employs an army of automated web browsers to siphon millions of dollars of advertising per day away from U.S. media companies and brand-name advertisers. The firm, New York-based White Ops, has dubbed the operation "Methbot," because of references to meth buried in the computer code underlying the scam, and says it is the largest and most profitable fraud operation yet to strike digital advertising. The company says the scam, which it believes originated in Russia, is using a so-called bot net to fake views of as many as 300 million video ads per day and trick advertisers to pay for views that were never seen by humans. With Russian government hacking dominating headlines around the world, White Ops CEO Michael Tiffany said this scam is probably not being run by the Kremlin even though it has enormous size and sophistication.

Sample of a Methbot Generated URL for Vogue.com video advertisement. Source: Vogue.com

"We really see no signs of state sponsorship, it looks to us like this is really a private criminal group," Tiffany said. "They're just bada---s." Tiffany said someone with a deep understanding of the industry is likely behind the scam. "This shows an incredible, absolutely insider's mastery of digital advertising," he said. "It requires multiple skills." To be sure, the White Ops report is an allegation from a single cybersecurity firm and cannot be independently verified by CNBC. Confirmation of the allegation will depend on other security firms, possibly the U.S. government, and the online advertising industry itself. If true, the allegation means that there is significant fraud at the heart of the global online video industry. A "bot net" is a network of computers infected with malicious code that is controlled by hackers for a purpose that can be unknown to the actual owners of the computers. They are frequently used by online scammers to ramp up the scale of a cyberattack and hide the perpetrators.

The company said the scam works because of the fragmented nature of the online advertising marketplace, in which buyers and sellers of advertising no longer know each other, or even communicate with one another. "At this point the Methbot operation has become so embedded in the layers of the advertising ecosystem [that] the only way to shut it down is to make the details public to help affected parties take action," White Ops said in a paper released Tuesday. Tiffany told CNBC he is optimistic that the scam, which has been ongoing at high volume for several months, could be stopped by a coordinated ad industry effort. "I think we're going to respond and take away their ability to profit in record time," he said.

By farming out the operations across a wide network, Methbot has been able to avoid some typical detection methods, White Ops said, adding that the scam "marks an innovation that transcends beyond traditional bot nets allowing Methbot to scale beyond anything the industry has seen before and placing it in a new class of bot fraud." Here's how it allegedly works: The online advertising market depends on an automated auction system in order to match media companies with advertisers. Advertisers hire a vast array of ad buyers to purchase advertising time on websites across the internet. That process has been automated through software exchanges that match buyers and sellers of online video, with hundreds of transactions taking place in fractions of seconds. It's that process itself that is being attacked: The Methbot group offers fake advertising inventory into the system, and then generates phony views of the ads in an effort to collect money from the unwitting ad buyers.

