Affiliate Code Hijacking

[titman]

50 people smarter than you

Originally posted by Sambo
Woudnt it depend on when the scumware was doing the hijacking?

yes most affiliate scams work like this..

altering the hosts file of a sponsor domain to the scam domain that just refreshes back to the original link but with the scam code in place

[AlienQ - BANNED FOR LIFE]

Originally posted by Lane
does it surprise you that spyware builders are thieves?

how about them turning so many peoples computers unstable and useless, and scaring away surfers from the web? hurting all online businesses alltogether.

who is ever gonna have the balls to fight these scumbags?

You can bet its comming...

If Rick is aware of it...

Its definatly comming.

This is one them sort of threads some people wish would go away, however I am sure this kind of issue will perpetually continue.

[titman]

Originally posted by titman
50 people smarter than you



yes most affiliate scams work like this..

altering the hosts file of a sponsor domain to the scam domain that just refreshes back to the original link but with the scam code in place

the ones i was referring to were the ones that disect the html of a page and search and replace affililiate code on the fly. these can be stopped by masking the url with any number of methods

[Rick Latona]

Originally posted by Lane
does it surprise you that spyware builders are thieves?

how about them turning so many peoples computers unstable and useless, and scaring away surfers from the web? hurting all online businesses alltogether.

who is ever gonna have the balls to fight these scumbags?

In about four months more than have the scumware apps will stop working on the PCs. Wait and see.

[leg4]

it would seem that a whole new infrastructure on how hits are tracked and recorded will need to be put in place????

[titman]

Originally posted by Rick Latona
In about four months more than have the scumware apps will stop working on the PCs. Wait and see.

This is prob true , but in 4 months the amount of new scumware will increase 4 fold resulting in an increase

[Rick Latona]

Originally posted by titman
the ones i was referring to were the ones that disect the html of a page and search and replace affililiate code on the fly. these can be stopped by masking the url with any number of methods

That's one of many methods for sure. As a webmaster you should spend your time protecting yourself from some of the more common techniques used like banner replacements. Just change your banner sizes by one off like 467x59, etc.

Make a list of what you would do if you were a criminal and do whatever you can to protect yourself. We have someone that spends most of their day on these things.

[Rick Latona]

Originally posted by titman
This is prob true , but in 4 months the amount of new scumware will increase 4 fold resulting in an increase

Also probably true. We do what we can.

[AlienQ - BANNED FOR LIFE]

The sad thing is that this kinda thing can not be fought by a starting, struggling webmaster.

They can not be expected to know how to combat it.

Most webmasters when actually working are in solitude as the best secrets are self learned and seldomly tought.

This kinda thing ruins the small guys in a big way.

If you don't make sales you don't grow and your work fills someone elses pocket as they use some cheap shot code.

Who wants to call that "Smart" marketing.
Its fucken outright theft.

[High Quality]

The solution is to switch to linux / freebsd EVERYONE!!!!!!!!!!!!!

[AlienQ - BANNED FOR LIFE]

Originally posted by High Quality
The solution is to switch to linux / freebsd EVERYONE!!!!!!!!!!!!!

Let me know when you can part water...

[leg4]

no, high quality! that wont work!!!

why dont you go to that parade tonight and shuddup!


lol

[Rick Latona]

Originally posted by High Quality
The solution is to switch to linux / freebsd EVERYONE!!!!!!!!!!!!!

That wouldn't help at all. It's the end users we are talking about.

[jimmyf]

I've been thinking about this stuff for months now, wondering how 2 stop it.

[High Quality]

Originally posted by Rick Latona
That wouldn't help at all. It's the end users we are talking about.

This was my sad attempt at the cliche NERD argument.

heh

[Rick Latona]

Originally posted by High Quality
This was my sad attempt at the cliche NERD argument.

heh

Gotcha

[AlienQ - BANNED FOR LIFE]

Originally posted by High Quality
This was my sad attempt at the cliche NERD argument.

heh

Why it was very sad...

You should know who you do business with...

[gornyhuy]

Originally posted by Rick Latona
The ultimate answer lies within the IPSPs monitorring referring URLs and the Sponsors monitering joins as Sambo suggested.

I have my own solution which is to combat the scumware guys directly. I won't tell any of you what that is though. But it's war if you have a lot of traffic so bring a big army to the battle fiield.

Its very easy to spoof the referring url to a page with a link containing the ref code of the hijacker.

By the way, the same ref spoof techique is used by plug-in stealers to bypass security there. zspoof and the like.

Rick - I swear to Jebus that I'm not using any of this scumware or cheating in any way, but I am pretty knowledgable in network enabled client side windoze code, and have knowledge of specific working examples of this kind of client-side hijacker. Let me know if there is any way I can help the war.

[Major (Tom)]

This affects mostly affiliates right? Is it possible for people to steal a join from the program itself? I would think that would be kind of hard if the sponsor pays out the affiliates him or herself. That would be totally crazy if someone could divert a join at the affiliate program level and have the join go to a different master account at the biller. I'm assuming affiliates are much more vernable to getting hijacked than the affiliate program is. What's good about affiliate software is you can monitor join form fill outs, so I would imagine that would help shed light on some things if the program was getting ripped off. Either way it sucks because affiliates are the backbone of any program, and once they loose revenue we all loose revenue.
Cheers,
Duke Skywalker

[jimmyf]

Originally posted by Rick Latona
We have a major problem with this as well. Has anyone here used this?

http://www.affiliatelinkcloaker.com/

I have not used it, but if you try it would post the results

[leg4]

its the new style... 4 and 3 and 2 and 1

[$5 submissions]

Originally posted by gornyhuy
I've seen a scumware plugin that looks for affiliate code patterns in the URL and replaces the refcode with someone elses.

What do you want to know?

Exactly. Cookies are also vulnerable because of this. However, the worst are trojans that act like one aspect of Gator.

[jawanda]

That affiliatelinkcloaker looks slightly interesting, but why not just use tinyurl.com ?? It does pretty much the exact same thing for free.

-P