They're not looking for the presence/absence of JS/Flash but other things that can be measured by it. I assume their approach is similar to Spider.io (since acqui-hired by Google) which found (if I'm remembering correctly) that certain javascript calls ran differently or at different speeds depending on whether the browser instance was real. Similar to how software can detect whether it's running inside a VM because of subtle differences in how instructions are executed.

That said, if I had a botnet I'd just figure out what domains belonged to WhiteOPs and null-route them.

> That said, if I had a botnet I'd just figure out what domains belonged to WhiteOPs and null-route them.

That and bots that don't execute javascript would be a problem, yes. Our clients can account for that by comparing their traffic numbers with ours.

(full disclosure: I work at White Ops on the 'botprinting' team)

I'd be very interested in knowing more about how the technology works. It's pretty difficult to assess it without more information. Specifically it feels like the good old software protection conundrum where you have to give the keys along with the lock. How do you prevent a bot operator to send the right signal (or not send it) to the (whichever) measuring party ?

Here's a short explanation of spider.io's approach that might interest you: https://www.youtube.com/watch?v=RSWhvNdjAAE

Ok so the library performs a kind of timing attack to detect whether it runs in a legitimate browser or not, and phones home { bot: true }. I make a bot that detects the script on the page and sends { bot: false }. You could try to obfuscate the signal by sending the raw collected browser behavior data but I still could reverse engineer its format or replay data from a legitimate session. I still don't understand how this could possibily work.

If that is what it does, they should have clearly stated that in the article. Instead, its in a completely separate press release :/

EDIT:

Its apparently stated here: http://www.marketwired.com/press-release/White-Ops-Secures-7...

"White Ops offers the world's first systematic solution for accurately isolating and eliminating bot-infected traffic. By applying the techniques of Side Channel Analysis across thousands of real-time user session variables, White Ops differentiates between a human and machine-driven request -- regardless of the sophistication of the bot programmer and across the full spectrum of impression and click fraud techniques. This approach is vastly more effective than methods generally employed by legacy fraud detection services, which rely largely on historical data and statistical and predictive analysis to detect bot activity. "

This is correct. If you ever look into how social media botnets are constructed and run, the good ones already do all the command and control through headless webkit tools. It's one of the primary reasons that it is so difficult to filter out whether or not a social profile is indeed a person or not from a statistical observation at mass.

I recommend reading about Dan a bit. He's not an amateur in the security world :-)

Which makes it weirder, in a way. Surely such a security guru is going to be tweaking his personal browser, especially JS and Flash settings, and probably finding himself locked out of something for not looking enough like a typical clueless netizen. Or, he knows better than most how sophisticated and adaptive lucrative botnets are, so why would he think JS and Flash are deep magic the bots can't do?

But, as others have noted, it's probably been boiled down into something dumb for the layperson, and their algorithms are more complex than you would think from that quote.

Edit: Actually, given their target users, I guess he wouldn't be locked out, just falsely identified as a fake ad consumer.

I don't care how well known he is. If that quote is accurate, he is peddling something that is known to not work in practice for the more sophisticated botnets.

These quotes are never accurate because it's marketology spread by a PR firm :-)

Then maybe he should invest in making sure the PR quotes him accurately?

If your PR firm can get a story about your company on a NY Times blog, I don't think you worry about how a few tech pedants might interpret some innocuous quote.

That might be. I guess I'm just being a dick about it then?

Is there any research on how many botnets use Selenium? I would guess that most of them use something more basic just because it's a lot easier to put together.

How many use Selenium specifically? No.

It was just a random example that was intended to not point in an easily weaponized direction.

I figured it was both common and known in tech circles that Flash/Javascript executing botnets for ads existed and have for year(s):

http://www.spider.io/blog/2013/03/chameleon-botnet/

They were acquired by Google so it isn't just random blog spam:

http://techcrunch.com/2014/02/21/google-acquires-spider-io-t...

Installing Selenenium on infected machines is not very stealthy. The new malware usually tries to stay in the kernel to avoid detection. Try stuffing Selenium in the kernel :-)

My personal experience with comment/forum spam bot networks is that at least 90% do not understand javascript. The ones that do tend to have extremely realistic traffic patterns and the ability to solve captchas. I suspect those are actually real people with incredibly crappy jobs, not super-intelligent Selenium-powered bots.

Comment/forum spam is different game than botnet ad fraud. The latter executes JavaScript by design since it's often necessary to load the ads.

see the charts from Incapsula in this article which show a third of the bots are not executing javascript https://www.linkedin.com/today/post/article/20140623200557-8...