Why Connected TVs Have Become a Prime Target for Ad Fraud

Entertainment now reaches people on screens of every size. Viewing has shifted from scheduled broadcast television to on-demand streams watched on phones, tablets, laptops and smart TVs, largely because the experience is better.

Connected TVs (CTVs) cover all of these, and the number of people using CTV apps keeps rising, particularly while so many are stuck at home. A CTV, as the name suggests, needs an internet connection to reach any content. With people more connected than before, many prefer on-demand media to conventional TV and DVDs, since CTVs give them far more choice over what to watch and when.

Advertising follows the viewers

That growth in viewing gives advertisers new and more effective ways to reach potential customers. Some content providers charge subscriptions; others depend on advertising for their income.

One technique advertisers use is Server-Side Ad Insertion (SSAI), which stitches ads into content so smoothly that ad blockers are not a concern and the viewing experience is not spoiled. SSAI is becoming increasingly important in programmatic advertising because it automates ad impressions according to the "right context" at the right moment.

Ad technology brings in very large sums, but the industry also loses billions every year to ad fraud. Ryan Murray, Director, Asia Pacific at White Ops, told CSA in an interview that as marketing technology expands, fraudsters adapt with it, and campaigns face a growing list of threats. One trend White Ops tracked during the year was fraudsters suppressing less sophisticated ad verification technology so they could stay hidden. The consequence, he said, is that brands, platforms and consumers keep being abused and losing revenue, while dealing with infected value chains, reputational damage and drawn-out remediation talks.

Inside ICEBUCKET

Some criminal groups now run advanced bots that pose as smart TVs to generate video ad impressions. One of them, which White Ops discovered and named ICEBUCKET, is described by the company as the biggest and broadest CTV fraud operation seen to date.

White Ops' report says ICEBUCKET began in a corner of programmatic advertising where the supply chain is opaque, sellers are not listed in sellers.json files, and buyers and sellers usually have no direct relationship. The group mimicked SSAI servers, pushing traffic from edge devices that did not exist (CTVs and mobile devices in particular) into the ad tech ecosystem, and used about 2 million spoofed IP addresses from more than 30 countries.

According to Murray, the operation impersonated more than 300 publishers. It took advertisers' money by persuading them that real people were watching, when the viewers were bots pretending to watch TV. At its height ICEBUCKET made up over 28% of programmatic CTV traffic, which shows how heavily fraudsters can affect a young market.

"The lack of consistent standards and the surge in ad spending, driven by the rise of streaming content services and a proliferation of new connected devices, is leaving CTVs as an especially ripe target for fraud," Murray said, adding that bots are growing more sophisticated and carrying out a wide range of malicious activity on CTVs.

Why SSAI makes fraud harder to see

SSAI is still in its early days. It works well for serving ads, but as with any new technology, fraudsters keep finding gaps in its frameworks and getting through them. Murray pointed to a specific weakness: SSAI puts an extra layer between the ad and the measurement, because the tags of measurement vendors pick up signals from the SSAI service, not from the edge devices that actually display the ads. That obscuring layer makes it harder to analyse traffic and spot fraud.

ICEBUCKET is the largest CTV ad fraud scheme found so far, but the industry has exposed several other threats over the past year and new ones appear daily. Fraudsters draw on a growing set of tactics to take money from CTV advertising, among them device spoofing, app spoofing, device farms, hidden ads and incentivised ads. The CTV ecosystem is complicated and fragmented, which leaves it especially open to them.

Murray's recommendation is that advertisers and marketers cooperate with the rest of the industry to protect CTVs and make fraud too expensive to be worth monetising. Organisations that fight it alone spend their own time and money while the attackers simply turn the same tactics on another target, losing nothing and with plenty still to gain. "If the industry can rapidly apply knowledge gained from a particular attack for everyone's benefit, then that tactic will not work when adversaries move on to the next target," he said.