The Battle Against the Billion-Scale Internet Underground Industry: Advertising Fraud Detection

## Overview Presented by researchers from the Baidu Security X Team at Black Hat USA, this talk explores the mechanics of advertising fraud within the multi-hundred-billion-dollar global online advertising industry. Digital advertising serves as the foundational business model for platforms across search engines, social networks, app stores, and short-video services. To scale beyond first-party inventory (websites and apps), major platforms formed **advertising alliance platforms**, distributing ad inventory across third-party media. Under typical alliance revenue splits, an advertiser might spend $100, where the platform retains 30% ($30) and the third-party application earns 70% ($70). Common billing models include: - **CPC (Cost Per Click):** Billed per user click. - **CPM (Cost Per Mille):** Billed per ad impression/display count. - **CPA / CPI (Cost Per Action / Cost Per Install):** Billed upon installation or user activation.

The speakers outline two primary fraud dynamics: media fraudulently manipulating traffic to extract improper revenue shares from alliance platforms, and competitor-driven click fraud, where malicious clicks exhaust a rival advertiser's budget so competitors can acquire customers at lower acquisition costs.

---

## SDK Supply-Chain Exploitation & Delivery The presentation analyzes a highly complex real-world mobile click-fraud operation embedded inside a widely deployed third-party big data / message-push SDK integrated into numerous well-known mobile apps: - **Infiltration:** App developers integrate seemingly legitimate, harmless messaging or analytics SDKs without knowing malicious code is present. - **Dynamic Multi-Stage Payloads:** The base SDK dynamically downloads and invokes secondary DEX files (e.g., requesting updates/patches from cloud servers). If the environment passes safety checks, the server returns additional files (`.jar`, `.dex`, `.js`). - **Target Task Acquisition:** Cloud servers supply task configurations containing target URLs, target keywords, click ratios/rates, and operational parameters.

---

## Technical Mechanisms for Automated Click Execution The malicious code executes background clicks completely invisibly to avoid detection by both the device user and the operating system: - **Invisible Background Activities:** The malware creates invisible activity windows using activity container techniques. To prevent Android from discovering or managing the window, it implements a custom `WindowManager` and `ViewRootImpl`, while hooking core classes to run the activity within an isolated custom context. - **Automated Web Interaction:** Once loaded into the hidden view, target URLs are opened, and automated click scripts are injected after a delay to simulate natural browsing and execute clicks. - **JSBridge Communication:** To call native Android functions directly from injected JavaScript, the malware registers a JSBridge (e.g., named `base`). For instance, executing `base.getDeviceInformation` within JavaScript triggers the corresponding Java method on the host device.

---

## Underground Industry Ecosystem The researchers deconstruct the underground business structure driving this operation: - **Channel Arbitrage:** Upstream entities apply for or acquire authorized channel identifiers from advertising networks (e.g., `id_channel=ABCD` appended to ad URLs) to ensure attributed revenue shares. - **Payload Assembly & Brokering:** Malicious developers bundle automated click payloads and channel parameters into malicious `.jar`/`.dex` files. These modules are sold or supplied to big data and analytics SDK companies. - **Stealth Distribution:** The SDK companies merge these components into SDKs promoted to app developers, allowing the network to silently monetize real user devices at scale without app developer awareness.