News for hackers. Stuff that matters.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by ddebernardy on Thursday January 24, 2019 @03:31PM (#18992614)
Well, speaking as a marketer, I'd beg to ask what you're selling me if you're unable to show me what I'm getting for my ad spend. If I'm worrying about branding for a large company, then yeah, perhaps I'd happily pay for billboard ads, TV ads, radio ads, or some placement on a high traffic website. More realistically I'm working with an SMB and when they pay a few thousands on ads they want to know their ROI so they can decide if it's moving the needle or not.

Also, PPC and PPA are what SMBs prefer to buy. PPV only holds its ground when used for brand recognition purposes, with the caveat that it's hilariously easy for fraudulent publishers to stack ads on top of each other and get away with it.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by criddell on Thursday January 24, 2019 @03:41PM (#18992715)
> I'd beg to ask what you're selling me if you're unable to show me what I'm getting for my ad spend

How could we tell you that? You know better than anybody what your revenue numbers are. A billion impressions isn't worth anything if it doesn't affect anything you measure.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by ddebernardy on Thursday January 24, 2019 @04:12PM (#18993010)
> How could we tell you that?

As you just said: a billion impressions aren't worth anything if it doesn't affect anything you measure. And that's the whole problem in the ad industry. Are you buying ads to:

- Build your brand/awareness/mailing list?

- Get marketing qualified leads that your sales will handle?

- Get sales for your SaaS without going through sales?

- Something else?

Each of these require different type of tracking - views, clicks, actions. More importantly though, each is subjected to ad fraud. And simple text/image ads won't let you detect the latter to weed it out of your stats.

And the event you're thinking "so? as long as your ROI is positive you're fine" the answer is no, it's not good, because it incites more fraud and the budget might have been better spent on content marketing or other efforts.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by tracker1 on Thursday January 24, 2019 @06:09PM (#18993991)
And none of that requires JS to be delivered to the browser beyond the script that loaded the ad itself. The ad networks should pass whatever appropriate data to each other, not the browser.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by tracker1 on Thursday January 24, 2019 @06:08PM (#18993983)
The company/server that serves the images can count... they also get a referer for the host in question... and while I may be OK with google to load a script for the ads they serve, there is NO reason for anything inside what they serve to bring down any other JS.
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by jay_kyburz on Thursday January 24, 2019 @03:36PM (#18992661)
Well, how about you actually measure the ROI. Run the ad for a while, measure the click-throughs (and resulting sale). It's not rocket science.

I don't know what an SMB is btw.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by ddebernardy on Thursday January 24, 2019 @03:59PM (#18992898)
SMB is a small or medium business.

Per the answer I gave to a separate answer, there's more than meets the eye when you're measuring an online ROI. Text/image only ads would prevent adequate ad fraud tracking. Take the naive scenario where you add some utm parameters to your PPC campaign and call it a day. The next thing you know you can have a bunch of bots crawling your site owing to click bots and referral spam, alongside fake user bots building profiles by replaying bits and pieces of actual traffic sessions, the two combining to messing up your traffic stats. And if you're large enough to have sophisticated fraudsters target your site, another cohort of bots might show up registering to your SaaS to test stolen CC numbers, messing up your sign up stats to boot.

And, don't get me wrong here. I'm an engineer too and I've been using ad blockers for longer than I've been neck deep into marketing and sales. I just get where you're coming from. But the sorrier realities on the ground are not as simple as one might think from afar.

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by jay_kyburz on Thursday January 24, 2019 @07:00PM (#18994288)
I would have thought the only real solution to was to actually track money you make as a result of the ad spend.

Spend 10k advertising one month, measure your revenue increase in the following month.

This is how we were tracking our Facebook adverting.