“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Today’s column is written by Nico Neumann, senior research analyst for programmatic strategy and analytics at the University of South Australia.
With allegations that Russian hackers may have meddled in the US election, cybersecurity has made it back to the headlines and political main stages for 2017.
Many organizations have increased their budgets to fight and prevent cybercrime. The value of the cybersecurity software, hardware and service market is expected to top $100 billion by 2020. Banks, in particular, have become wary of hacking threats; Bank of America has even pledged an unlimited budget for combating cybercrime.
But it isn’t only the finance industry that needs to consider the downsides of our modern world, which is characterized by continuous technology progress, computerization and interconnectivity.
A few recent developments should certainly alarm the advertising industry that we may just be at the beginning of the next chapter of our war with cybercriminals.
Malware Shifting To Mobile Devices And IoT
Fraudsters follow consumer trends and money movements closely. With the rise of mobile use and commerce, malware development seems to increasingly focus on mobiles, too.
Rogue programmers can become very creative in spreading their malicious code, even mimicking timely new game releases, such as fake versions of “Super Mario Run,” which will be officially launched for Android in upcoming weeks. Moreover, Daniel Thomas, Alastair Beresford and Andrew Rice from the University of Cambridge found that 87.7% of Android devices are exposed to at least one critical vulnerability.
Likewise, the internet of things (IoT) offers new opportunities to do harm. In October, a botnet comprised of internet-connected devices, such as DVRs and surveillance cameras, was discovered. The botnet, named Mirai, caused one of the worst denial-of-service cyberattacks in recent years and reached 177 countries. Mirai even took out websites from powerful companies, such as Amazon, Spotify and Twitter.
Cross-Device Functions: A Bigger Security Threat?
In 2016, the largest Google account breach to date reportedly occurred. A new variant of Android malware, dubbed Gooligan, began stealing authentication tokens that allow data to be accessed from Gmail, Google Play, Google Drive, etc. You can check here to see if you are among the 1 million-plus accounts that have been infected.
Fortunately, a Google investigation revealed that no user information seemed to be compromised. Instead of extracting sensitive data, the malware-controlled devices apparently are used to install apps and earn ad revenue.
Nevertheless, this event illustrates that the power of being able to link various accounts and devices requires extra care and protection. Once the gate is open here, more damage could be done.
Resistant Adware Renders A Device Unusable
Just before Christmas, my own household became victim of a variant of the switcher Trojan virus, which infects Wi-Fi routers and then loads ads and fishy websites.
In our case, the redirects happened even for 4G network connections after being hacked, not only wireless surfing at home. My partner’s Android phone became largely unusable due to the hijacking of many browsers and apps. Even after a hard factory reset, the issues came back. She was absolutely devastated and wanted to throw away her Samsung S7. We contacted friends at Integral Ad Science and White Ops, who helped us identify and rectify the issues.
The scary lesson here is that new aggressive forms of ad fraud appear to directly affect customers and their products. For example, some adware is nearly impossible to remove once access to the root system has been established, essentially forcing consumers to get a new phone.
Brand Responsibilities
Similar to the worrisome increase in ransomware, which blocks and encrypts data on a device or PC and only releases it after receiving payments, destructive forms of adware affect the product usability directly and therefore reduce customer welfare. This trend presents the next escalation level in the warfare between companies and cybercriminals and is likely to attract further attention from regulators.
However, it’s not only politicians who should take ad fraud seriously.
In the past, some light-headed manager may have regarded ad fraud as a side cost of doing business, with no actual victims and only some big advertisers losing money. This logic has always been dangerous as the money is going to bad people, including organized crime, which could fund other illegal businesses from the ad-fraud money. In addition to societal harm, these funds could be linked back to a brand, damaging its reputation.
Countermeasures And Remedies
One of the most effective techniques for tackling ad fraud and cybercrime is education. Everyone should share information about new threats and inform themselves, for instance, via security blogs.
Customers will always need to be vigilant, use proper security measures, such as passwords and antivirus programs, and abstain from downloading anything from third-party sources on the web, even if it is something simple like a PDF converter or wallpaper. At the same time, hardware and software manufacturers need to do everything they can to deliver proactive and reactive security for their products.
Yet, we must realize that ad fraud is a concern for every brand because it’s a numbers game. As long as it is easy to generate revenue in scale, greedy hackers will keep pursuing inventive ways to inject ads or hijack browsers, at the expense of the customer.
Working collaboratively with industry groups, such as TAG, and using ad-fraud detection are the first steps to take action against this sort of cybercrime. But to reduce its profitability, change in everyday procedures is also required.
Most critically, the ecosystem must stop using KPIs and financial encouragements that contribute to the problem. Easy-to-game attribution – using clicks, attention or viewability as an optimization goal – short-sighted payment incentives, including pay per installments, and other questionable affiliate practices should be avoided.
Only if everyone aims to make ad fraud less lucrative overall, hackers’ motivation to find new scams will decrease, ideally to such a degree that the costs exceed the possible gains.
Follow the University of South Australia (@UniversitySA) and AdExchanger (@adexchanger) on Twitter.
