The Methbot
Operation
December 20, 2016

1

The Methbot
Operation
White Ops has
exposed the largest
and most profitablead fraud operation
to strike digitaladvertising to date.

THE METHBOT OPERATION

2

Russian cybercriminals are siphoning
millions of advertising dollars per dayaway from U.S. media companies and thebiggest U.S. brand name advertisers inthe single most profitable bot operation
discovered to date. Dubbed “Methbot”
because of references to “meth” in its
code, this operation produces massive
volumes of fraudulent video advertising
impressions by commandeering criticalparts of Internet infrastructure andtargeting the premium video advertising
space.

At this point the Methbot operation has
become so embedded in the layers of
the advertising ecosystem, the only way
to shut it down is to make the details
public to help affected parties takeaction. Therefore, White Ops is releasing
results from our research with that
objective in mind.

Using an army of automated webbrowsers run from fraudulently acquired
IP addresses, the Methbot operation
is “watching” as many as 300 million
video ads per day on falsified websites
designed to look like premium publisher
inventory. More than 6,000 premium
domains were targeted and spoofed,
enabling the operation to attract millions
in real advertising dollars.

• IP addresses known to belong to
Methbot for advertisers and theiragencies and platforms to block.
This is the fastest way to shut down theoperation’s ability to monetize.

The following report illustrates thesophistication and rapid evolution of the
Methbot operation and its damaging
effect on the advertising ecosystem onboth the demand and supply sides. This
analysis is possibly only a fraction of
Methbot’s true impact. Because WhiteOps is only able to analyze data directly
observed by White Ops, the total ongoingmonetary losses within the greater
advertising ecosystem may be larger.

THE METHBOT OPERATION

Information available fordownload• Falsified domain list and full URL
list to show the magnitude of impact
this operation had on the publishingindustry. These publishers wereimpersonated and deprived of revenue
opportunities becauseof this operation.

3

A Snapshot of the
Methbot Operation
Volume and Estimated Financial Impact• $3 to $5 million in counterfeit inventory per day• CPMs ranged from $3.27 to $36.72 with the average being $13.04• 200 - 400 million video ad impressions generated per day on fabricated inventory• 250,267 distinct URLs spoofed to falsely represent inventory• 6,111 premium domains targeted and spoofed• High value marketplaces targeted including PMPs

Operational Infrastructure• 852,992 dedicated IPs, many falsely registered as US ISPs
• 800 - 1,200 dedicated servers operating from data centers in the
United States and the Netherlands

Advanced Techniques to Avoid Detection• Faked clicks, mouse movements, and social network login information tomasquerade as engaged human consumers• Manipulation of geolocation information associated with the IP addresses
under their control• Special case countermeasures against code from over a dozen different
ad tech companies• Fully custom http library and browser engine with Flash support, allrunning under Node.js

THE METHBOT OPERATION

4

Table of Contents

06

Introduction

08

Discovery and History

09

The Advertising Ecosystem (The Basics)

10		

How Methbot Infiltrates the Advertising Marketplace

11

Advances Bot Behaviors

12

A New Type of Bot Operation

14

Financial Impact

16

Looking Ahead - A Call Towards Transparency

17

Methbot - A Technical Analysis

19		
21

Bot Characteristics

Key Behaviors

22		

Countermeasures by Methbot to Avoid

24		

Dynamic Code Patching25		

Viewability and Behavioral Spoofing Behaviors

27		

Human Input Simulation28		

Forged IP Registration: Data Centers

29

About White Ops

THE METHBOT OPERATION

5

Introduction

In September, 2015 the White Ops
security research team noticed
a small amount of automatedweb traffic featuring a unique bot
signature which was quarantined
and placed into monitoring. Thissignature, internally called “C3”
showed little activity affecting
White Ops clients until Octoberof the following year when the bot
morphed into Methbot
and began to scale andadapt aggressively.

THE METHBOT OPERATION

6

The measured impact to the advertising ecosystem is unprecedented. By fabricating
as much as $5 million in video advertising inventory per day, Methbot far exceeds thefinancial damages done by previously discovered botnets. ZeroAccess is thought to havecollected as much as $900,000 per day1, the Chameleon Botnet up to $200,000 per
day2, and HummingBad up to $10,000 per day3.

BOT
OPERATION

ESTIMATEDLOSSES PER DAY

TYPE

FOCUS

Methbot

bot farm

Programmatic video
advertising$3,000,000

ZeroAccessmalwareAd fraud andbitcoin mining$900,000

Chameleon

malwareAd fraud$200,000

Avalanche 4

malwareIdentity theft,access control$39,139

Ponmocup 5

malwareTheft$27,778

Metuji andMariposa 6

malwareIdentity theft,access control

unknown

To avoid detection, the group developed and cultivated an array of infrastructure
dedicated to the Methbot ad fraud operation. Instead of the more traditional malware
botnet structures, which involve attacks on existing IP addresses and piggybacking on
residential computers, Methbot operators farm out their operations across a distributed
network based on a custom browser engine running out of data centers on IP addresses
acquired with forged registration data.
Using these forged IP registrations has allowed the Methbot operation to evade typical
datacenter detection methodology. This marks an innovation that transcends beyond
traditional botnets, allowing Methbot to scale beyond anything the industry has seen
before and placing it in a new class of bot fraud.
1. Jackson Higgins, Kelly. “ZeroAccess Botnet Surges.” Dark Reading. October

4. ARS Technica. “Legal raids in five countries seize botnet servers,

30, 2012. Accessed December 12, 2016. http://www.darkreading.com/risk/

sinkhole 800,000+ domains.” Sean Gallagher. December 1, 2016. Accessedzeroaccess-botnet-surges/d/d-id/1138615.

December 16, 2016. http://arstechnica.com/security/2016/12/legal-raids-in-five-

2. Spider.io. “Chameleon Botnet.” Spider.io. February 28, 2003.

countries-seize-botnet-servers-sinkhole-800000-domains/

Accessed December 12, 2016. http://www.spider.io/blog/2013/03/

5. Trend Micro. “The state of botnets in late 2015 and early 2016.”

chameleon-botnet/.

December 17, 2015. Accessed December 16, 2016. Noah Gamer. http://blog.

3. Polkovnichenko, Andrey, and Oren Koriat. “HummingBad: A Persistent

trendmicro.com/the-state-of-botnets-in-late-2015-and-early-2016/

Mobile Chain Attack.” Check Point Blog. February 05, 2016. Accessed De-

6. We Live Security. “Nine bad botnets and the damage they did. Karl Thomas.

cember 8, 2016. http://blog.checkpoint.com/2016/02/04/hummingbad-a-per-February 25, 2015. Accessed December 16, 2016.

sistent-mobile-chain-attack/.

http://www.welivesecurity.com/2015/02/25/nine-bad-botnets-damage/

THE METHBOT OPERATION

7

Discovery and History
In September 2016, White Ops detected
a mutation in a previously low volume
bot signature which had been flagged
as “C3” since September 2015. The
security research team continued to
track the evolution of C3 as it innovatedand grew into what would become
known as “Methbot.”
On October 5, 2016, Methbot began toscale aggressively, reaching as many as
137 million impressions per day by the endof the week. The operation continued to
expand rapidly. By mid-October, the White
Ops MediaGuard Prevention Service was
detecting three to five billion bid requests
per day from Methbot spread acrossmultiple ad platforms. By the end of themonth, the bot farm had spread to affect 32
distinct clients upon which White Ops had
detected or blocked activity.
Following the initial ramp in October,
Methbot continued to produce massive
amounts of impression volumes while
continuing to adapt its codebase daily
in an effort to elude fraud detection andviewability vendors and avoid discovery inorder to continue the operation.

Impression Request Volume from Methbot IP Ranges (as observed by White Ops MediaGuardTM)

Million Requests

5000

3750

2500

1250

10/01 10/04 10/07 10/10 10/13 10/16 10/19 10/22 10/25 10/28 10/31 11/03 11/06 11/09 11/12

THE METHBOT OPERATION

11/15

11/18

11/21 11/24

8

The Advertising Ecosystem(The Basics)
The Advertising Ecosystem
As the digital advertising landscape hascome to rely more heavily on technology
to transact advertising and media plans,
technology platforms built to facilitate
trading between advertisers (demand side)and publishers (supply side) have become
vital components. This has created a
traditional marketplace where demand sideand supply side meet in order to transact
and do business.

The Advertisers
Agencies, on behalf of their advertisers,
plan and execute media plans aimed atdelivering the highest quality targeted
audiences. These plans may be delivered
using technology called Demand
Side Platforms (DSPs) which connect
programmatic exchanges and publishers
to find audiences from the supply side.
Often, advertisers will layer in demographic

targeting data or look for premium inventory
inside of private marketplaces (PMPs) on
exchanges to deliver high value against
their media plan.

The Publishers
The Supply Side Platform (SSP) monetizes
content for publishers. Often it will gather
inventory from publishers and networks toprovide a wealth of audiences to the DSP
and other bidders inside of the exchange.
To meet specific advertiser needs, SSPs
and publishers may package up premium
segments of inventory and audiences tooffer up inside of a PMP. When the auction
is finalized, the highest bid is accepted,
the creative is loaded and sent to appear
to the consumer on the content they are
consuming.

The Adverting Ecosystem (The Basics)
1

2

3

4

5

6

7

Advertiser

AgencyDSP

Exchange

SSP

Network

Publisher

DATA

THE METHBOT OPERATION

DATA

8

CONSUMER

9The Methbot Profit Machine
How Methbot Infiltrates the Advertising Marketplace
Since both human audiences and premium publisher inventory are in high demand,
Methbot focuses on manufacturing both of these as its product. By supplying fakedaudiences and hijacking the brand power of prestigious publishers through fakeddomains and falsified inventory, Methbot is able to siphon away millions in real
advertising dollars.

BOT FARM
http://...

Impersonating
Internet Service
Providers

852,992 IP
Addresses

12

3

Advertiser

AgencyDSP

4Exchange

5

SSP

DATA

6

Network

DATA

7

8

Publisher

CONSUMER

How Methbot Profits:• Impersonate established sites and fabricate inventory• Runs on a custom built dedicated desktop browser• Fakes mouse movements and social network logins

THE METHBOT OPERATION

10Advanced Bot Behaviors
Appearing Human

Geolocation Provider Dataset
Manipulation

Advertisers often rely on data stored
on a user’s machine in cookies totarget advertising against demographic
information, browser histories, past
purchases, and many other data points.
Methbot operators use this industry
approach to their advantage and stuff
crafted cookies into fake web sessions byleveraging a common open source librarywhich allows them to maintain persistentidentities containing information known
to be seen electronically as valuable
to advertisers. In this way they takeadvantage of the higher CPMs advertisers
are willing to spend on more precisely
targeted audiences.

Programmatic advertising typically uses
geolocation providers to ensure ads aredelivered to desired geographic regions,
often at premium prices. Manipulating thisdata so it appears to have originated from
more “premium” regions can increase thevalue of the fraudulent inventory.

Counter-detection Behaviors
Methbot uses several techniques to evadedetection logic and spoof verification measurements in order to ensure high value
for the operation’s fabricated inventory.

Methbot operators also forge tried-andtrue industry measures of humanity. Cursor
movements and clicks are faked andmultiple viewability measures are faked tofurther mimic observed trends in humanbehavior. Additionally, sophisticatedtechniques are employed to provide aneven more convincing picture of humanity.
Methbot forges fake social network login
information to make it appear as if a user
is logged in when an impression occurs.

THE METHBOT OPERATION

11

Methbot is a New Typeof Bot Operation
Datacenter-based ad fraud operations are usually easy to detect. Therefore, mostadvanced ad fraud operations have traditionally relied on malware that infects residential
computers and sits on the same IP addresses as human users so the botnet can operate
fake browser sessions in the background and generate fraudulent advertising activity.
However, this approach has been a limiting factor because of the work needed tocontinually infect new home computers — especially while existing infections are being
discovered and cleaned by anti-malware vendors.
Knowing this scenario, Methbot operators invested significant time, research, development,
and resources to build infrastructure designed to remove these limitations and provide
them with unlimited scale. They used dedicated servers to run proxies in order to hide
the single origin source of their operation. Using falsified documents, the perpetrators
were able to obtain or lease 852,992 real IP addresses, putting them to work generating
fraudulent ad calls that appeared to come from legitimate residential Internet providers
such as Verizon, Comcast, Spectrum, and others. The value of these IP addresses alone
is over $4 million today, according to figures posted by IPv4 Market Group.

Traditional Botnets Rely on Malware-Infected Residential Computers

Source: 2015 Bot Baseline Study

THE METHBOT OPERATION

12The Methbot Bot Farm

Dedicated Infrastructure Provides Unlimited Scale• 800 - 1,200 dedicated Methbot servers• Distributed system to leverage parallel, reliable, and redundant operations• Browser impersonation to resolve against fabricated premium domains• Forged browser aspects including objects like screen information, plugin list,
built in functions, and supported events

THE METHBOT OPERATION

13

Financial Impact

White Ops consulted with AD/FIN, a programmatic
media intelligence company, for representative
cost data on the Methbot URL list. The analysis
produced through this partnership showedthat Methbot generated ad impressions sell foranywhere from $3.27 CPM to $36.72 CPM. The
average CPM for URLs manufactured by Methbot
was $13.04.
The financial repercussions of Methbot continue
to reverberate through the industry. Since early
October 2016 White Ops estimates it has beenrunning at a daily rate of 200 million to 300 million
impressions per day. AD/FIN’s CPM data places avalue of this daily activity between $3 million and$5 million dollars per day.

THE METHBOT OPERATION

14

Calculated Range for Methbot

LOW# Impressions/day

CPM
TOTAL

BEST ESTIMATE

HIGH

200,000,000

300,000,000

400,000,000$13.00$13.00$13.00$2,600,000$3,900,000$5,200,000

White Ops continues to monitor and detect this operation on behalf of its customers andclient platforms. However, given the size and reach of this enterprise, other companies
outside our purview may also have been affected. Our goal is to shut down Methbot andstop the monetization power of this enterprise. Therefore we are releasing our researchso that advertisers, agencies, platforms, and publishers, can arm themselves with thisdata and bring a stop to Methbot.

WE ARE RELEASING THE FOLLOWING FOR DOWNLOAD
AT WWW.WHITEOPS.COM/METHBOT
IP addresses known to belong to Methbot for advertisers, agencies,
and technology providers to block so they can prevent ads fromappearing on Methbot inventory.
Falsified domain list and full URL list to show the magnitudeof impact this operation had on the publishing industry. Thesepublishers were impersonated and deprived of revenue
opportunities because of this operation.

THE METHBOT OPERATION

15

Looking Ahead - A Call
To Transparency
The current complexity, interconnectivity,
and resulting anonymity of the advertising
ecosystem enabled the Methbot operators
to exploit the entire marketplace. An
impression may pass through many hands
before it lands on a page and the ad isserved. Tracing that complete path backthrough the various marketplaces provesdifficult due to walled gardens, reselling,competing interests, and limitations onhuman capital to devote to this initiative.
The industry can respond by aligning
supply and demand interests to protect
the entire ecosystem from these typesof specific threats. Close relationships
between publishers and their advertisers
may help circumvent much of thisobfuscation and increase transparency,
which will make it more difficult for evenadvanced operations like Methbot to takeadvantage of the system. Fraud is fluid

and adapts to pressures by mutating,changing its codebase, or, when blocked,
moving to target other unprotectedsources of revenue. A combination ofhuman best practices and technologicalvigilance by verification companies canhelp the industry close ranks against thesethreats and increase certainty throughtransparency for everyone across theadvertising spectrum.
White Ops has partnered with The
Trustworthy Accountability Group (TAG)
tagtoday.net industry associations tofacilitate the delivery and propagationof the data necessary to help bring the
Methbot operation to a halt. We hope thepublic release of this research will result ina rapid end to this enterprise as White Ops
remains on constant watch for new threatson the horizon.

Contact: threatintel@whiteops.com

THE METHBOT OPERATION

16

Methbot
A TechnicalAnalysis

THE METHBOT OPERATION

17

Methbot A Technical Analysis

What follows is a more technicalanalysis of the specific tools
tactics and procedures ( TTPs)
employed by Methbot operators
which resulted in the substantial
financial losses to the advertising
ecosystem as illustrated
in the preceding pages.

THE METHBOT OPERATION

18

Bot Characteristics
Methbot uses custom software runningon server-based infrastructure withdedicated IP space. White Ops detection
technology was able to use a JavaScript
language feature called “reflection” togather extensive, detailed information
about its inner workings. The bot runs
under Node.js, and uses several open
source libraries to add other features.
It operates primarily on a large scale
multi-data center distributed system toleverage parallel, reliable, and redundant
operations.

Methbot is able to camouflage itself
as any of the major desktop browsers
by spoofing their user agent strings.
Google’s Chrome is the browser identityof which White Ops detected the highest
volume, including minor versions 53 and54. Firefox 47, Internet Explorer 11 andSafari 9.1 and 9.2 are also represented.
Methbot operators also spoofed
operating system including Windows
10 — and some older versions — andseveral versions of Mac OS X from
10.6 to 10.12.1.

Some open source libraries and tools
used in the bot include:

In addition to browser impersonation,
Methbot uses a variety of methods tofool anti-fraud technologies, embedding
the appropriate contextual responses tofurther the illusion of a browser with ahuman user.

• tough-cookie for preserving
session data between executions• cheerio for parsing HTML• JWPlayer for running ad tags andrequesting video advertisements• Node.JS

THE METHBOT OPERATION

19

Distributed
HardwareMethbot nodes are physicalservers located in data centers
in Dallas, TX and Amsterdam.
Each server runs multiple
instances of the Methbot

browser component and aproxy. As of December 2016,
we estimate that there are 800
to 1,200 servers in use.

Proxy
Network

Contrary to most ad fraud
operations, Methbot acquires
IP diversity through proxies
operating on their servers.
Normally this single-source
approach is not effective
due to IP metadata providers
identifying such traffic asassociated with datacentersrather than end-user systems
and the advertising industry
recognizing this and blacklisting
compromised IP addresses
belonging to datacenters.

registration details so that they
appear to be residential ISPs
in the United States such as
Comcast, Cox, AT&T, Verizon,
Centurylink and others. Someof the earlier records foundshow completely fabricatedentities, such as “HomeChicago
Int”, or use names similar towell known companies suchas “AmOL wireless Net””, and“Verison Home Provider LTD”.
Based on the traffic observed,
White Ops has attributed
852,992 IP addresses under
IPv4 allocations controlled
by Methbot. For comparison,
Facebook only uses about half
this number.

Methbot operators have avoided
this problem by gaining directcontrol of large contiguous
IP allocations and falsifying

THE METHBOT OPERATION

20Key Behaviors
Video advertising on premium web sites fetches some of the highest prices in digitaladvertising. Methbot hijacks the brand power of premium publishers by spoofing URLs in
the call for a video ad in order to attract advertising dollars in the following way:
1

Counterfeit page: Methbot selects a domain or URL from a list of premium publishers,
and fabricates counterfeit pages. The page contains nothing more than what is needed
to support an ad, and the publisher’s server is never contacted.

2

Offer inventory: Using the industry standard VAST protocol, Methbot requests a video
ad from a network, using one of Methbot’s identifiers so they will get credit for it.

3

Produce fake views and clicks: The video ad is loaded through a proxy and “played”
within the simulated browser. Any specified anti-fraud and viewability verification codeis also loaded and fed false signals in order to make the activity seem legitimate.

To date White Ops has observed 250,267 distinct URLs across 6,111 distinct domains thatwere generated by Methbot in the act of impersonating a user visiting a web page.

Sample of Methbot generated URLs
*for the complete list, please refer to the accompanying documents• http://ibtimes.co.uk/video• http://vogue.com/video• http://economist.com/video• http://espn.com/video• http://www.cbssports.com/CBS_Air_Force_Falcons_Fall_Gear• http://fortune.com/2016/09/28/department-stores-closings/• http://foxnews.com/video

THE METHBOT OPERATION

21

COUNTERMEASURES BY METHBOT TO AVOIDFRAUD-DETECTION SERVICES
Methbot uses several techniques to fool anti-fraud andviewability companies.

Fraud detection firms commonly measurebrowser environments and look forinconsistencies in the collected data. For
example, the user agent string may claim to
be Firefox, but the browser may behave in
an inconsistent manner. By faking browser
behavior, Methbot’s goal is to maintain theability to operate and collect revenue by
providing fraud detection companies withenough data that their traffic will not be
flagged as fraud.

Methbot uses several techniques to evadethe logic of viewability measurement
and fraud detection companies. Theseemulated aspects of a browser include
objects like screen information, plugin list,
built-in functions and supported events.

Screen Object Construction

THE METHBOT OPERATION

22

Methbot defines
properties in thecontext to emulate
browser “window”
and “document”
objects

Code to allow third
party JavaScript toregister to context
eventsEvents are artificiallycreated and dispatched

THE METHBOT OPERATION

23

DYNAMIC CODE PATCHING

Where such emulation is too much trouble, Methbot dynamically modifies third party scripts
to return “known good” values instead, avoiding the need to implement complicated APIs.
This technique was used against various fraud detection measures, viewability code frommultiple vendors, and login-status functions from various social networks.

Attempting to defeat function analysis code by patching it

The White Ops security research teamfound traces of analysis code where
Methbot developers dissected the logic of
the most widely adopted fraud detection
vendors on the web. It’s apparent thatthey spent some time reverse-engineering

THE METHBOT OPERATION

these capabilities, manually running
portions of measurement code inside
legitimate browsers to learn what its
output looks like, and then porting the
logic to spoof those values in Methbot
execution context.

24

VIEWABILITY SPOOFING BEHAVIORS

Viewability is a technical measurement
used to verify if a digital ad was in viewon a screen and is often used as a billable
metric for advertisers to pay for ads. In
addition to code specifically designed todefeat viewability measurements usedby specific vendors, White Ops foundroutines for spoofing industry-standard
measurements. In particular, flash VPAID
events are expected and handled.
For example, depending on the event
received several spoofing actions are takenin the following functions:

Calling VAST tracking
URLs when the firstevent is received

Destroying flash objects
when an event is received

Organic humanbehavior is faked byrandomly interrupting
playback at different
points.

THE METHBOT OPERATION

25

Finally, clicks are
simulated in a randomly
generated fashion toachieve a realistic rate.

When execution is
not interrupted - andif linked images werecreated in the context,
as VAST companion
banners would be- human events are
simulated and clicks
in those images
are faked.

THE METHBOT OPERATION26

HUMAN INPUT SIMULATION
Several calls were found to a function called humanEvents,
all triggered via a randomized timer.

Click emulation, to foolclick validation logic
looking for input events.

Right after the DOM isinitialized, the onload
event is artificiallycreated and dispatched.

The White Ops security research team found code indicating that
Methbot is able to appear to be logged into popular social networks,
pushing the perceived value of its traffic even higher.

THE METHBOT OPERATION

27

FORGED IP REGISTRATION - DATA CENTERS
IMPERSONATING RESIDENTIAL ACTIVITY
While it’s common to see malware-infectedcomputers, as part of a botnet, used for IP
diversity, this is the first time data centers
have been observed impersonating
residential internet connections. This
makes the scale of this operation virtuallyunlimited, with none of the typical durability
issues of maintaining a constant base of
infected user machines.
The proxies used by Methbot allow its
traffic to originate from any of 852,992 IP
addresses. It avoids typical data centerdetection by falsifying registration detailsof those IPs so that they appear to belong

to residential ISPs in the United States.
White Ops discovered forged listings fororganizations such as Comcast, Cox, AT&T,
Verizon, Centurylink and others. In addition
to real companies, completely fabricatedentities such as “HomeChicago Int”,“AmOL wireless Net””, and “Verison Home
Provider LTD” were discovered.
Beyond simply avoiding blacklists, this typeof forgery allows Methbot operators to sell
to advertisers willing to pay a premium toreach US consumers.

One Example:• Falsely registeredto Time WarnerCable Inc, etc• US listed as
the country• Suspicious contact
email address• Seychelles
phone number

THE METHBOT OPERATION

28

About White Ops

White Ops is a global leader in advertising fraud
protection and offers verification and optimization
solutions to the advertising industry. Combining
data science with advanced solutions designed todetect and prevent fraudulent advertising activity,
our company’s mission is to stop the spread of
advertising fraud through our human verification
techniques. We work collaboratively with industry
groups who are dedicated to preventing malicious
activity in the advertising space and promoting
transparency for the industry as a whole. White Ops
is headquartered in New York City with satellite
nodes operating in countries around the world.
To learn more please visit www.whiteops.com

THE METHBOT OPERATION

29

The Methbot
Operation
CONTACT US
threatintel@whiteops.com

THE METHBOT OPERATION

30