GPWA
Welcome, Guest  [Log In -or- Join GPWA]
  Advanced Search

 
Go Back   Gambling Portal Webmasters Association > Public > Scumware and Predatory Advertising
Reply
 
LinkBack Thread Tools Search this Thread Display Modes

  #1 (permalink)  
Old 15th-April-2003, 04:43 PM
Drewbert Offline
Public Member
 
Join Date: Apr 2003
Location: Mexico
Posts: 19
Thanks: 0
Thanked 0 Times in 0 Posts
Default The problem of ad blocking

OK. There are two main ways that adblockers work. One is designed to stop pop-up/pop-under adverts, by intercepting the javascipt call that opens the pop-up window.

Some of them allow you to build a database of the people you will/won't accept pop-up's from.

Now, the nasty ad-blocking method - an explanation requires delving back into the dim dark past of the Internet...

In the early days, there were only a very small number of computers ("hosts") actually connected together via the Internet. So few, that each computer kept a list of ALL the other computers out there in a special file called "hosts". In Unix, it was stored in the location /etc/hosts. This file was updated regularly and sent to everyone who had a computer connected.

All it had in it was a list of host names, and the IP number they were using.

As the number of computers connected increased, this file updating became a chore, and the DNS was born. This allowed people to find the IP number of a host buy asking special computers ("name servers") what the IP number of a computer was.

Even though the DNS has exploded in growth, the "hosts" file still exists and is supported in most (I presume) computers that connect to the Internet. This includes Windows, Apple Mac and Linux.

Now, here's the rub. Most systems are configured so that they check entries in the hosts file BEFORE checking the DNS. So if a hostname appears in the hosts file, the IP # assigned to it in there will be used, ignoring what the DNS would say.

OK. So there exists a method to kill off a website, or divert it to a different location. If you managed to convince people to download a "poisoned" hosts file, you could divert all those users traffic destined to hotmail.com, aol.com, msn.com etc to an IP number of your choice. Luckily, it's a bit difficult to convince people to download a hosts file, and generally hen thye type in msn.com and get to your site instead, they're going to be a little peeved.

So along comes the famous file-sharing network Kazaa, which has been downloaded over 160 million times (just from the cNet download site alone). This software finances it's network by popping up ads. Some people get upset about this, so a Russian company released "Kazaa Lite" which does everything Kazaa does, but is stipped of the ad-display function.

Unfortunately, Kazaa Lite also distributes a poisoned hosts file, and this is installed by Kazaa Lite.

This poisoned host file contains a huge number of host names (domain names) together with the IP address 127.0.0.1

127.0.0.1 is a special IP address known as a "loopback" address. 127.0.0.1 points to your own local computer, no matter who you are. http://127.0.0.1 will display the web server running on your local machine (if one is running) or will just display nothing. Try it - you may find you have a web server running on your computer you didn't know was there!

Now, this hosts file supplied by Kazaa Lite contains the domain/host names of just about every known banner advert serving network on the planet. Commission Junction is listed. Befree is listed. Linkshare is listed.

All those banner ad networks are directed to the IP number 127.0.0.1

This means that when the person's browser asks for an image from a banner network, instead of the DNS telling the browser to get the banner from the correct host on the Internet, the browser asks for it from http://127.0.0.1 - the image doesn't exist at that location, so the banner never shows up.

This is all well and good, if all you want is to stop banners from appearing. The MAJOR problem occurs when you realise that almost ALL of these networks server their banner images from the same hostname as their main website. So if you have a textlink to one of these revenue networks, people with the poisoned hosts file on their computer CANNOT VISIT THAT SITE VIA THE TEXT LINK.

Even if the person has stopped using Kazaa Lite, even if they're de-installed the Kazaa Lite software, the hosts file remains and you will not see ANY revenue from that person when they try to get to blocked sponsors via your website.

Try to imagine just how many computers out there now have a poisoned hosts file on their computer. Try to imagine how much revenue you are losing because of it.

Even worse, it's not only Kazaa Lite that is installing poisoned hosts files. Even "pestpatrol", supposedly a scumware detector, installs a hosts file that blocks legitimate revenue networks.

Now, take a look at a couple of these poisoned host files, ad see if any of your networks or sponsors are listed: You'll need to download and unzip these files, but it's safe as long as you don't move thm into the exact location on your machine that the system expects that file to be.

http://www.kazaalite.com/ (listed as "Host file v1.29 - Blocks ad's and spyware")

http://www.pestpatrol.com/Support/Ho..._Block_Ads.asp contains handy instructions on how to block banner ads, including where the hosts file is located on most computers - the hosts file they recommend is at http://www.pestpatrol.com/Downloads/Misc/hosts

Unfortunately, short of going around and deleting all these poisoned hosts files from every infected computer on the planet, there is little we can do. There is no known way to detect when someone has a poisoned hosts file installed. I'm working on a possible detect javascript, but it's not working yet. :^(

The only way to fix this problem is to convince the ad netwrks and sponsors to stop sering adverts fromthe same domain as they host their website (or take clickthoughs) from.

If they leave their ad servers on the host/domain name that is included in the poisoned hosts file, but MOVE their main website or clickthrough servers to a different name, all this wasted traffic will return.

Commission Junction (the biggest affiliate aggregator?) is working on doing this right now.

Most of the rest don't even realise there's a problem. If you look in those hosts files and find one of your sponsors listed, EMAIL THEM, and tell them they have a problem. Point them to this thread if they don't understand what you're on about (a common problem, I'm afraid).
__________________
Captain Stupid
Reply With Quote

  #2 (permalink)  
Old 15th-April-2003, 04:57 PM
Dominique Offline
Public Member
 
Join Date: Mar 2002
Location: The Boonies
Posts: 4,103
Thanks: 17
Thanked 3 Times in 2 Posts
Default

Wow, I have learned a huge amount of info from you. Thank you for posting this!!!
__________________
Casino Games
Money Management
Reply With Quote

  #3 (permalink)  
Old 15th-April-2003, 06:30 PM
SlyCin56 Offline
Founder
 
Join Date: Dec 1969
Posts: 21,905
Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Captain Stupid?
If you're Captain Stupid, I must have an IQ of 1. :-?

Wow! I'm not one of the technically skilled here, but I managed to follow most of that - THANK YOU, immensely, for sharing your knowledge! It will be put to good use.
Reply With Quote

  #4 (permalink)  
Old 15th-April-2003, 07:03 PM
Spearmaster Offline
Private Member
 
Join Date: Nov 2002
Posts: 1,821
Thanks: 0
Thanked 14 Times in 6 Posts
Default

Brilliant, Drewbert... I knew about hosts.sam but that was a beautiful explanation you gave!

Detection should not be that difficult - the great, great majority of people do not use this file, and probably even less use it for ad-blocking purposes.

Normally, there is like one entry - if that - in the file, so a huge file containing certain domains should be automatically suspicious.

One way would to be detect certain domains, especially one which is not commonly blocked but is in kazaalite's list.

Another way would be to check the filesize - if over say 1-2K it is almost certainly poisoned.
Reply With Quote

  #5 (permalink)  
Old 16th-April-2003, 04:11 AM
Pam712 Offline
Asst. Manager
 
Join Date: Feb 2002
Location: England
Posts: 2,389
Thanks: 7
Thanked 1 Time in 1 Post
Send a message via AIM to Pam712 Send a message via MSN to Pam712
Default

Thanks Drewbert - that was great info
Reply With Quote

  #6 (permalink)  
Old 16th-April-2003, 02:28 PM
Drewbert Offline
Public Member
 
Join Date: Apr 2003
Location: Mexico
Posts: 19
Thanks: 0
Thanked 0 Times in 0 Posts
Default Phew

The good news is that I have managed to get the javascript detector running, and I've got it set up on a website that gets a fair whack of traffic. So tomorrow, I'll be able to say with some certainty just what percentage of surfers have the ad blocking hosts file set up on their system.
__________________
Captain Stupid
Reply With Quote

  #7 (permalink)  
Old 16th-April-2003, 03:13 PM
Spearmaster Offline
Private Member
 
Join Date: Nov 2002
Posts: 1,821
Thanks: 0
Thanked 14 Times in 6 Posts
Default

Why is Drewbert a non-member? LOL...

Can't wait to see these stats I just wish I had more time to test scripts... or about three more sets of hands...
Reply With Quote

  #8 (permalink)  
Old 17th-April-2003, 11:33 PM
Drewbert Offline
Public Member
 
Join Date: Apr 2003
Location: Mexico
Posts: 19
Thanks: 0
Thanked 0 Times in 0 Posts
Default The stats are in!

OK. For the 24 hour period encompassing all of Wednesday 16th April, I monitored how many browsers reported an error retrieving an image from qksrv.net.

Out of 17330 MSIE/Win users who had Javascript switched on, 471 of them couldn't get the image.

This indicates that around 2.7% of the computers out there have a poisoned hosts file installed that is blocking qksrv.net (and the rest).

For me, 2.7% of my CJ revenue is a fairly significant sum.

Especially when added to the amount being lost to BHO's and parasiteware.

Grrrrr.
__________________
Captain Stupid
Reply With Quote

  #9 (permalink)  
Old 18th-April-2003, 04:42 AM
Spearmaster Offline
Private Member
 
Join Date: Nov 2002
Posts: 1,821
Thanks: 0
Thanked 14 Times in 6 Posts
Default

Losing even one visitor, as far as I'm concerned, is too much - if he's the recently retired guy who was looking to do something with his money, he I do NOT want to lose

Next question - do we install something which either warns the user, or "fixes" his hosts file?
Reply With Quote

  #10 (permalink)  
Old 18th-April-2003, 09:59 PM
former member 2 Offline
Public Member
 
Join Date: Jun 2002
Posts: 1,531
Thanks: 0
Thanked 0 Times in 0 Posts
Send a message via AIM to former member 2 Send a message via MSN to former member 2 Send a message via Yahoo to former member 2
Default

Quote:
Losing even one visitor, as far as I'm concerned, is too much - if he's the recently retired guy who was looking to do something with his money, he I do NOT want to lose
Amen.

that's the thing about our niche; its not like shaving hits to porn sites where each click is roughly worth only X amount of dollars.

Each click possibly represents $1000s.

Its also the reason I am always after folks to police their sites for links to sponsors that don't pay. every single link is another possible route to supplying a big fish to a sponsor that cheats us; and what does that mean?

it enables those scumbags to hang around a little longer and that means they'll probably get another one of us before its over.

and if you're thinking well; I"ve already cleansed myself of those leeches; so what if it happens that they cheat someone else?

the answer to that is : if it proves a profitable practice ; more of them will be born and we will each have to find out the hard way which casinos are of that breed.
Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


All times are GMT -4. The time now is 01:01 PM.
Mark Forums Read | View Forum Leaders

 Contact Us  |  Top