Adwords Flaw

[VinnyL]

Hi All

This is my first post on WW - I'm a new memeber. I think I have found a big security hole in Adwords recently, which can (and probably does) lead to click fraud abuse. I discovered it while trying to figure out why Google could not find click fraud in our account, and our logs reported such. I think it's quite serious.

I have spoken to our people (client reps/API guys, etc) at Google, but the flaw is not fixed and no one has gotten back to me. I have tested this flaw by click frauding our Google account and Google does not detect this (although, in reality, they can't).

What's the best way of getting Google to close this hole in their system? Do I publish a report about it? Obviously, I'd rather keep it quiet, but I'm not getting anywhere with them.

Any advice?

[Shak]

hmmm...

Welcome to WebmasterWorld

Shak

[MarkHutch]

They may yet catch you. Sometimes there is a delay in when the fraud is done and when the charge backs start flowing. Don't you think that suggesting that there is a way to beat their system and there is NO way they can catch it, is maybe a bit arragant? Not sure I would be doing such a thing with my Adwords account.

[AdWordsAdvisor]

I have spoken to our people (client reps/API guys, etc) at Google, but the flaw is not fixed and no one has gotten back to me.

I second Shak in welcoming you to WebmasterWorld, VinnyL

In your post you mention having a rep at Google, and I'm assuming that you mean that you have a rep for your AdWords account.

If that's correct, then my best suggestion would be for you to put your information in an email, contact your rep once again, and ask them to forward the email to AdWordsAdvisor, per my request on WebmasterWorld.

(I notice that you're new to the Forum as of earlier this month - so perhaps I should mention that I am a long-time AdWords employee, and that I've posted here for some time as a Google representative, with the blessings of the Forum owner and moderators.)

In any case, I'd be happy to put your information in front of the right folks.

AWA

[DavidDeprice]

Why not post the actual description of the flaw in several high profile forums and light fire under Google's ass. That's how it works with Microsoft - people find vulnerabilities, report them to media and after that you can't just ignore that. Why don't you send an e-mail to Clickz.Com - I can guarantee it that if the flaw is real indeed they'll right about it and Google's VP will know the next morning about it.

[VinnyL]

Thanks Shak & AdwordsAdvisor!

David: The last thing I want is anyone finding out how else to click fraud our account! We have enough problems as it is!

Mark: I did not do anything wrong, I can't explain what though on the board. It wasn't even multiple clicks.

Thanks AdwordsAdvisor - I will be sending a mail through explaining everything in detail - maybe I'm wrong?

[VinnyL]

AdwordsAdvisor: I have sent the email to my rep - hopefully he will get it to you today.

Dave: Please see my previous post!

[AdWordsAdvisor]

AdwordsAdvisor: I have sent the email to my rep - hopefully he will get it to you today.

Thanks VinnyL. Your email was actually forwarded to me earlier this morning, and I've already sent it along to the right folks.

I appreciate your concern, and also the time you've spent.

AWA

[VinnyL]

Hi AWA

Any word yet from your team? Any idea of when I can expect a response?

Regards

Vinny

[DavidDeprice]

See, dude? You obviously never worked with corporate PR machine. Have you followed my advice, your problem would have been fixed by noon next day. Good luck now getting "we at Google take bla-bla-bla very seriously" e-mails.

[Shak]

David

now isn't that a silly attitude to take in life?

Shak

[DavidDeprice]

I don't know - it's the journalist inside. I've worked as a TV reporter and wrote for a local newspaper. I know that you can use media very effectively to solve all kinds of problems - fast. My guess is that Vynils problem just isn't very improtant to him. Google is a big corporation and their reaction will be slow to none, as of any big corporation. However, if the supposed flaw is real he could simple post his findings at appropriate forums and send an e-mail to PPC professional comminities, like Clickz.Com and that would lit the fire under Google's ass. My guess is that "the flaw" is not existant and Google's staff just does not have any time to deal with the supposed flaws, because they are busy as is, so they are just going to ignore him or send e-mails that say "we at Google ..."
You may dislike my attitude (which is fine), but let me tell you this - if your pregnant wife started to bleed all of a sudden - you'll you call 911 or drive your to hospital OR would you post at medical forum or leave a message at your doctor's answering machine "Hi, this is Vinyl and my pregnant wife is bleeding. She's lost about a pint and I wonder if that's bad? Please call me at ..."
Get used to the idea that your grandma is the only person who cares about you (that's if you did not forget to send her a Christmas card) in the entire world, and that YOU are the only person responsible for solving YOUR problem.

[Shak]

:)

the reporter in you V the entrepeneur in me

ringside seats going cheap when ever you want

and I have no wife or grandma ...

Shak

[DavidDeprice]

How about a friendly bet and an experiment?

<snip>
Well, I am going to do NOTHING, except for posting the message here and hoping somebody from google reads the message (I would kindly ask the moderator not to erase the URL).
Meanwhile, I urge you to find a site that violates google's TOS and contact them directly. Let's see who gets google to act first.

[edited by: Brett_Tabke at 8:48 pm (utc) on June 16, 2005]
[edit reason] no specific sites please [/edit]

[Steve6]

I looked at the site you posted (which, by the way, has the title "Overture Keyword Tool" and is the first UK site in the SERP when you search for that title quoted in your favorite search engine).

It appears they put a random image to the left of each AdWords text ad to make it seem like an image ad, in order to increase the CTR.

Well, it worked on me. I clicked an ad just to see if that's where the full-size image was. It wasn't.

[DavidDeprice]

Wow! Moderators are fast here! Well, should any one be interested, <removed: please don't out sites. Read TOS> Once again I have not reported the site, I am just doing an experiment, posting a message about supposed violation here and seeing how long it will take before Google takes action (if any). The action will be judged by the owner of the side removing images.
Then, another we'll compare that reaction time to reporting (another) abuser to Google direction. As non-logical as it may seem, I am suggesting that using high-profile forums will be faster and more effective, but we'll find out.

[edited by: eWhisper at 9:23 pm (utc) on June 16, 2005]
[edit reason] No Outing Sites [/edit]

[DavidDeprice]

It appears they put a random image to the left of each AdWords text ad to make it seem like an image ad, in order to increase the CTR.

I don't think it was done to make it appear as an image ad, but it's a technique developed by Joel Comm, the author of AdSense Secrets.
Google has rules about ad captions

"Publishers may not label the ads with text other than "sponsored links" or "advertisements." This includes any text directly above our ads that could be confused with, or attempt to be associated with Google ads."

What you see is an image that reads "Games" right above the block of ads. Obviously, Joel's site got viewed by Google's staff a thousand times because of his e-book, and what he does does not really violate Ad Labeling section. So a lot of people started using images creatively to increase their CTR - and it works very well. But his person (discussed in prior post) went too far. I think it violates Google's TOS ("drawing any undue attention to the ads.")
I don't really care and won't report the site to Google directly, my only intention is to find out if and how fast you can get reaction from Google by simply posting detailed information about a perceived problem in a professional forum, like this one.

[edited by: eWhisper at 9:24 pm (utc) on June 16, 2005]
[edit reason] Don't drop URLs. [/edit]

[DavidDeprice]

Wow, folks, you edited my posts to the point where it does not make sense. Do people know that Joel's main site is <snip>? And the way he employes images to increase CTR is legal? Without URLs people won't know what I am referring to.

[edited by: engine at 9:39 pm (utc) on June 16, 2005]
[edit reason] TOS [/edit]

[engine]

Please, do not out any sites here at WebmasterWorld. Thank you.

[VinnyL]

Sigh!

David - I know what you are saying, however cynical, but somehow, I'd rather exhaust all other options before publishing my findings for public review. Pointing out flaws on public forums normally causes more harm than good - in the case of Microsoft, it results in innocent people getting viruses, etc.

I'm pretty sure that AWA will come back to us with something soon. Who knows - maybe I'll get a reward for keeping it quiet ;-)

Failing any response from Google or if they don't think it's serious, I'll post the email I sent to AWA and you guys can check it out. I could be wrong, but I tested everything before I sent it off and it definitely looked flawed.

MOD Note - Please Read the WebmasterWorld TOS and do not post e-mails. Thanks

[edited by: engine at 10:35 pm (utc) on June 16, 2005]
[edit reason] Terms Of Service [webmasterworld.com] [/edit]

[AdWordsAdvisor]

VinnyL, I'm just now getting here to post for the first time today - and for just a short time at that. It's been quite a busy day, all in all.

I see that this thread has been pretty active today - and just wanted you know that your information was received and was passed on, as I mentioned earlier.

Because I'm not a part of the team looking into this, I'm not certain when you'll hear back, although I suspect it will be soon. Once I saw this thread, though, I briefly chatted with a couple of the folks who are looking into your email, and I am certain that it's being investigated thoroughly.

AWA

[eyeinthesky]

Any update yet, AWA?

I'm getting more useless clicks. Could the email be leaked ;)

[AdWordsAdvisor]

Any update yet, AWA?

eyeinthesky, I actually don't anticipate having an update on this myself. I've passed on VinnyL's info, but beyond that I am not a part of the research happening at this end. Any further communication would come from the team doing the research, and would go directly to VinnyL.

AWA

[eyeinthesky]

Thanks, AWA :)

Now got to wait for VinnyL's update ...

[VinnyL]

Hey Guys

I haven't heard anything yet. If I don't hear from them soon, I'll just assume it wasn't serious and I'll post the email to you guys. I'm busy making a screen recording of the "flaw", just in case it gets fixed and we get a "it was never broken" reply :-).

I think we're all experiencing enough uncredited click fraud to worry about this issue, and as good as Google's systems are and as honorable as their intentions, if there's a flaw, they're not going to be able to detect the fraud, hence my concerns.

AWA - can we say that if I don't hear a response back from them that I post the email to the forum on Friday?

V

[AdWordsAdvisor]

AWA - can we say that if I don't hear a response back from them that I post the email to the forum on Friday?

VinnyL, I probably should not be a part of your decision making loop on this. Were it my decision, however, I guess I'd ask myself what is to be gained by posting, and go from there.

As an update, I've pinged the team to whom I forwarded your info - and am told that they'll contact your rep shortly.

AWA

[llarson00]

I'm now in David's corner!

[VinnyL]

Thanks AWA

Thanks. I look forward to hearing from them. As long as I'm comfortable that it's being taken seriously by them (or I'm just talking crap), then I'm happy to keep it quiet. As previously metioned, my aim is NOT to divulge it - and I will definitely keep it under wraps!

Thanks for following up.

[VinnyL]

Hi Todd

The flaw still exists. I have just tested it again.

Regards

Vinny

[toddb]

I am a long term user of Google adwords. Soon to be 3 years. they have huge strenghts but for some reason they are also very blind to treating us as customers. Please AWA light a fire on stuff like this.