Suggestion for CCBill and other Billing companies - GoFuckYourself.com

RawAlex · 11-08-2007, 08:34 PM

The billing companies need to take action to stop the erosion of sales through toolbars, spyware, and other tricks being used by third parties in interrupt or intercept the sales process.

The scammers are triggering on domain names (apparently join.ccbill.com is a real good trigger) and has allowed these guys to easily set up popups, redirects, hijacks, and affiliate code substitutions tricks to steal sales from honest affiliates and programs.

Right now, it would appear that this common join page URL is a real issue that needs to get addressed rapidly. Linkster's tests suggest that site using the new beta.ccbill.com joinup link are not getting hit.

Perhaps it would be time to fight fire with fire, rather than waiting to see how it turns out?

Sebastian Sands · 11-08-2007, 08:36 PM

Amen... !

notoldschool · 11-08-2007, 08:37 PM

sucks. examples?

RawAlex · 11-08-2007, 08:40 PM

Quote:

Originally Posted by notoldschool

sucks. examples?

According to Linkster:

Quote:

Went back and verified the pop on the CCBill join page for one site - the url was the bill.ccbill page - when checking the newer type join page I didnt get it for another site - with the url at beta.ccbill

They woudl attack the third level because attacking the second level would mean an expensive popup on every ccbill click, including many who use the counting system to track gallery views.

Mutt · 11-08-2007, 09:26 PM

where is this Linkster information? my sales have been brutal the last two days.

thonglife · 11-08-2007, 09:33 PM

See sig....

Barefootsies · 11-08-2007, 09:40 PM

I am not a server dude, programmer, or tech but..

Couldn't there be something simple where the cookie has to match the referring site? If it doesn't, then it's flagged for review?

TampaToker · 11-08-2007, 09:53 PM

Quote:

Originally Posted by Mutt

where is this Linkster information? my sales have been brutal the last two days.

You and everyone else's this is getting old very fuckin quick! Talked to alot of sponsors today and they are down 50% to 80% as well.... We are hovering around the 70% mark ourselfs . I have only seen one decent size sponsor actually say anything about this and i applaud them.

RawAlex · 11-08-2007, 10:00 PM

Toker, one of the problems of the adult business is the big dick mentality. Nobody wants to admit their dick is smaller or shrinking. Everyone just keeps stuffing their codpiece and saying "my dick is big" even when many programs aren't making 30% of what they made 2 years ago.

The traffic and the business is being swept out from under our feet. Easy, simple attack points need to be secured. This is getting out of hand.

RawAlex · 11-08-2007, 10:41 PM

knock this back up for more discussion

Chio · 11-08-2007, 10:45 PM

Good idea Alex. We'll implement some counter measures on ours.

woj · 11-09-2007, 12:00 AM

Quote:

Originally Posted by Barefootsies

I am not a server dude, programmer, or tech but..

Couldn't there be something simple where the cookie has to match the referring site? If it doesn't, then it's flagged for review?

Spyware pretty much has complete control over the browser, so it can submit any cookie and any referer url they want to ccbill...

RawAlex · 11-09-2007, 12:17 AM

Quote:

Originally Posted by woj

Spyware pretty much has complete control over the browser, so it can submit any cookie and any referer url they want to ccbill...

That's why my idea goes back to triggers. CCBill is a perfect target for these things, because literally thousands of paysites call thier join page in the same manner. It's a nice big juicy target. Either redirect the surfer to another join page altogether (simple) or inject alternate affiliate codes (harder, you need a long list) and the trick is done. The traffic is stolen when it is the ripest, when the surfer has pulled out the CC and is getting ready to join.

NATS based sites also face the same issue: signup/signup.php is the weakness, easily spotted and used as a trigger for substitutions or redirections. Traffic sucked away from those pages would be primo stuff.

It's not hard to see how it can be done because much of the industry is now working with the same small set of tools.

woj · 11-09-2007, 12:23 AM

Quote:

Originally Posted by RawAlex

That's why my idea goes back to triggers. CCBill is a perfect target for these things, because literally thousands of paysites call thier join page in the same manner. It's a nice big juicy target. Either redirect the surfer to another join page altogether (simple) or inject alternate affiliate codes (harder, you need a long list) and the trick is done. The traffic is stolen when it is the ripest, when the surfer has pulled out the CC and is getting ready to join.

NATS based sites also face the same issue: signup/signup.php is the weakness, easily spotted and used as a trigger for substitutions or redirections. Traffic sucked away from those pages would be primo stuff.

It's not hard to see how it can be done because much of the industry is now working with the same small set of tools.

It's not clear what solution you are proposing... Are you proposing that different sites would have different ccbill urls? For example: 26512342.ccbill.com, 36542134.ccbill.com, etc

If so, it would take at most perhaps a day or 2 for spyware guys to figure this out, and then they would just trigger on any subdomain on ccbill.com

RawAlex · 11-09-2007, 12:33 AM

woj, actually, no, something a little more complex than that.

ccbill's system could distribute a list of acceptable domains to send joins to, perhaps communicating with the various partner systems in a push method to keep that list up to date. Every week or so, switch out the valid ones with other ones, and keep going. Essentially, don't keep your single signup domain as a simple target.

So for this week, ccbill21.com, ccbill22.com billbycc.com, ccbilling.com, cc22bill.com and joinnowcc.com are active. next week, they get replaced with new ones. The new ones would always be the best to use because the toolbar people won't have them. Switch them often enough, and the toolbar guys will get tired.

A similar thing could be done with the click counting. Instead of a long CCBill link, that could be replaced with simple code that goes on the domain of the paysite, which in turn triggers the count with the affiliate code. So instead of the long ccbill link, your link would be (and always be: www.paysite.com?9233745 (whatever your affiliate code is) and that system would translate it and push it through the most recent ccbill active domain for clicks.

With a rotating list of about 200 or 300 domains, and new ones added from time to time, it would be pretty hard for the toolbar guys to keep up. With the system in place, all join hits could easily be sent to another domain within minutes, and in fact that domain could be different for every join request.

It would be extremely hard (if not impossible) for Zango to trigger, example, in that circumstance, and it would require people to bid on all 200 or 300 domains to have a hope. Then you drop all those domains and replace them and they are fucked again. When it becomes too much work for them to attack you, they will move on to something easier.

NATS has the same problem with their default structure, which makes it very easy to trigger on the join pages. With one buy at Zango, I could pop a join page for another site over every single default install NATS site out there right now.

Why do you think your sales are evaporating, even as the traffic stays strong or increases?

RawAlex · 11-09-2007, 12:34 AM

Oh, woj, let me add this: they don't want to trigger on any ccbill call, because then they would pop on the initial click and not the join page. The join page is CREAM, and they want the cream.

woj · 11-09-2007, 12:42 AM

Quote:

Originally Posted by RawAlex

Oh, woj, let me add this: they don't want to trigger on any ccbill call, because then they would pop on the initial click and not the join page. The join page is CREAM, and they want the cream.

I'm over simplifying thing a little, but it doesn't really take a PhD in computer science to figure this out... geee, if domain=ccbill.com AND page contains <form> elements, then it's a join page, otherwise it's not...

woj · 11-09-2007, 12:51 AM

The other idea has some potential, BUT
1. domains cost money, takes time to set them up, etc... + all of them would need a SSL cert = additional bs to deal with + additional costs
2. if surfer sees asdf3war3432.com he may not be as confident signing up as if they saw ccbill.com, so most likely conversions would drop a little
3. nothing is stopping spyware guys from starting a bogus paysite, so they would get a list of the allowed domains directly?
4. they don't even need any lists, simple logic: if the url is https and page contains the word "ccbill" then it's a join page

Blackrose · 11-09-2007, 03:49 AM

bump this important thread to the top!

aico · 11-09-2007, 03:53 AM

we should all just change it to mail in cash subscriptions.

V_RocKs · 11-09-2007, 04:41 AM

They make money no matter what.

RawAlex · 11-09-2007, 06:14 AM

Quote:

Originally Posted by woj

The other idea has some potential, BUT
1. domains cost money, takes time to set them up, etc... + all of them would need a SSL cert = additional bs to deal with + additional costs
2. if surfer sees asdf3war3432.com he may not be as confident signing up as if they saw ccbill.com, so most likely conversions would drop a little
3. nothing is stopping spyware guys from starting a bogus paysite, so they would get a list of the allowed domains directly?
4. they don't even need any lists, simple logic: if the url is https and page contains the word "ccbill" then it's a join page

The urls don't have to be alkdjslkjlksdfsd.com , they can be differences on "ccbill" and that would be a start. I haven't done an SSL cert, but I am betting there is a way to handle "variations" on a domain name.

As for getting a list via a bogus paysite, that would be possible, but then that information have to be passed to all of thier individual end installations, and that would take time. More importantly, in a situation like someone using Zango to target CCBill, they would have to keep buying space on more and more domains to keep up. At some point, the amount of manual labor required to stay current would be more than they would want to tolerate.

As a side, I would also suggest that all programs (NATS, CCBill, and others) make them names of certain pages somewhat random during install. Instead of join.php, why not sdfkskfljsdf.php for one install and dfkieridk.php for the next? these guys are all using URLs as the triggers, so why make it easy?

QTbucks_Mark · 11-09-2007, 07:43 AM

Quote:

Originally Posted by RawAlex

The urls don't have to be alkdjslkjlksdfsd.com , they can be differences on "ccbill" and that would be a start. I haven't done an SSL cert, but I am betting there is a way to handle "variations" on a domain name.

Actually no, there isn't - that's the point of a SSL cert. You can get a wildcard cert which works for all subdomains of one domain (*.ccbill.com), but that's about it as far as I know.

Quote:

Originally Posted by RawAlex

As a side, I would also suggest that all programs (NATS, CCBill, and others) make them names of certain pages somewhat random during install. Instead of join.php, why not sdfkskfljsdf.php for one install and dfkieridk.php for the next? these guys are all using URLs as the triggers, so why make it easy

That's actually not a bad idea I think - at least for those running NATS/MPA3 and the like. CCBill is still handled by another domain (i.e. *.ccbill.om) so you don't have much influence there.

RawAlex · 11-09-2007, 09:14 AM

I would say anything that makes your coding unique would be a very good start.

As for CCBill, this may be the proof that they need to move to a system that runs on the paysite tour server and pulled the join page into that site, making it appear to be part of the site. This is a very serious situation, CCBill is such a juicy target.

RawAlex · 11-09-2007, 10:36 AM

back to page 1.

Mutt · 11-09-2007, 12:37 PM

Quote:

Originally Posted by RawAlex

I would say anything that makes your coding unique would be a very good start.

As for CCBill, this may be the proof that they need to move to a system that runs on the paysite tour server and pulled the join page into that site, making it appear to be part of the site. This is a very serious situation, CCBill is such a juicy target.

that's not going to do anything to slow them down - how hard is it for scumbags smart enough to code this crap to get a list of the top 1000 adult paysites? very easy to do.

RawAlex · 11-09-2007, 02:13 PM

Mutt, it is easy to do, but harder to maintain, more work, etc. Most of what I suggest is the same as remembering to lock you car doors. It won't stop detemined theives, but it will discourage some and have other move on to easier pickings.

My opinion right now is that CCBill and NATS sites are easy pickings, and they should not want to be.

RawAlex · 11-09-2007, 05:11 PM

Recycled to the top.

StarkReality · 11-09-2007, 05:41 PM

Another bump for a real problem.

Zebra · 11-09-2007, 06:40 PM

I'm surprised this thread isn't more active. Is there something being done behind the scenes and nobody is wanting to talk about it for fear of giving the crooks a warning? Or is just nothing being done about it?

RawAlex · 11-09-2007, 06:49 PM

Zebra, I think as much as anything, nobody wants to acknowledge that this is a major, huge, critical weak point at a very key point in the sales transaction. Zango allowing people to guy bill.ccbill.com is only a small percentage of the true toolbar / malware / scumware potential to trigger off that domain.

I very much doubt that CCBill would discuss this out there, but making people aware is the first step towards a solution coming along, either because CCBill wants to make things better, or because the program owners and affiliates get upset enough to ask for something to be done.

webmasterchecks · 11-10-2007, 05:13 PM

rawalex, they can simply target any page with ccbill on it to get around that. Ive worked in spyware for some time

anything you throw up as a possible general method that ccbill or any other processor or even paysite can use to "stop" this, there is a simple and effective way around. however, i am not going to post those publicly.

zango has been around for many years, and while everyone here in adult has been busy learning about hosting, traffic, content, affiliates, etc this whole time, zango has been doing their thing, and learning how to effectively monetize their installs. they expect companies to try to stop them and they figure out multiple layer processes to get around those attempts

they are huge public company and this is a huge mainstream problem as well, but zango makes a lot off of adult and have a lot of installs on adult surfers computers, they are #1 result on yahoo for porn.

they control the surfers computer, the only real way to address the problem is to get the software off the users computers, make sure they install firewalls, keep their anti-virus software up to date, etc

if the industry “really” wants to stop the problem, promote products like pctools/ kaspersky

In May 2007, Zango filed a lawsuit against PC Tools alleging tortious interference with its business and trade libel, because the PC Tools product Spyware Doctor at that time classified Zango software as malicious and removed it without informing users. Zango dropped the suit after the judge ruled that the suit was "unlikely to succeed on the merits of any of its three causes of action" and refused to grant Zango a temporary restraining order.

Also in May 2007, Zango filed in the same court a similar lawsuit against Kaspersky Lab, accusing it of tortious interference, trade libel and unjust enrichment for blocking the installation of Zango software. Kaspersky defended itself by invoking the Communications Decency Act (CDA), saying it was immune from civil liability based on the paragraph of the CDA headed "Protection for 'Good Samaritan' blocking and screening of offensive material". The judge agreed, granting Kasperky's motion for summary judgment.

http://en.wikipedia.org/wiki/Zango

11-08-2007, 08:37 PM	#3
notoldschool Confirmed User Join Date: Aug 2007 Posts: 5,687	sucks. examples? __________________ No doubt one may quote history to support any cause, as the devil quotes scripture. -- Learned Hand http://www.bjpenn.com

11-08-2007, 09:26 PM	#5
Mutt Too lazy to set a custom title Industry Role: Join Date: Sep 2002 Posts: 34,431	where is this Linkster information? my sales have been brutal the last two days. __________________ I moved my sites to Vacares Hosting. I've saved money, my hair is thicker, lost some weight too! Thanks Sly!

11-08-2007, 09:40 PM	#7
Barefootsies Choice is an Illusion Industry Role: Join Date: Feb 2005 Location: Land of Obama Posts: 42,635	I am not a server dude, programmer, or tech but.. Couldn't there be something simple where the cookie has to match the referring site? If it doesn't, then it's flagged for review? __________________ Should You Email Your Members? Link1 \| Link2 \| Link3 Enough Said. "Would you rather live like a king for a year or like a prince forever?"

11-08-2007, 10:45 PM	#11
Chio Confirmed User Join Date: Oct 2002 Location: ICQ: 39-183769 Posts: 8,002	Good idea Alex. We'll implement some counter measures on ours. __________________ I seo'd my hair yesterday and today it's pr7! RIP Texas Dreams Are you a content producer or program owner sick of tube sites? Contact me on ICQ: 39-183769

11-09-2007, 12:51 AM	#18
woj <&(©¿©)&> Industry Role: Join Date: Jul 2002 Location: Chicago Posts: 47,882	The other idea has some potential, BUT 1. domains cost money, takes time to set them up, etc... + all of them would need a SSL cert = additional bs to deal with + additional costs 2. if surfer sees asdf3war3432.com he may not be as confident signing up as if they saw ccbill.com, so most likely conversions would drop a little 3. nothing is stopping spyware guys from starting a bogus paysite, so they would get a list of the allowed domains directly? 4. they don't even need any lists, simple logic: if the url is https and page contains the word "ccbill" then it's a join page __________________ Custom Software Development, email: woj#at#wojfun#.#com to discuss details or skype: wojl2000 or gchat: wojfun or telegram: wojl2000 Affiliate program tools: Hosted Galleries Manager Banner Manager Video Manager Wordpress Affiliate Plugin Pic/Movie of the Day Fansign Generator Zip Manager

11-08-2007, 08:34 PM	#1
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Suggestion for CCBill and other Billing companies The billing companies need to take action to stop the erosion of sales through toolbars, spyware, and other tricks being used by third parties in interrupt or intercept the sales process. The scammers are triggering on domain names (apparently join.ccbill.com is a real good trigger) and has allowed these guys to easily set up popups, redirects, hijacks, and affiliate code substitutions tricks to steal sales from honest affiliates and programs. Right now, it would appear that this common join page URL is a real issue that needs to get addressed rapidly. Linkster's tests suggest that site using the new beta.ccbill.com joinup link are not getting hit. Perhaps it would be time to fight fire with fire, rather than waiting to see how it turns out?

11-08-2007, 08:36 PM	#2
Sebastian Sands Confirmed User Industry Role: Join Date: Mar 2005 Location: ICQ: 211-417-740 Posts: 5,223	Amen... !

11-08-2007, 09:33 PM	#6
thonglife So Fucking Banned Join Date: Oct 2004 Location: Midwest, US Posts: 1,566	See sig....

11-08-2007, 10:00 PM	#9
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Toker, one of the problems of the adult business is the big dick mentality. Nobody wants to admit their dick is smaller or shrinking. Everyone just keeps stuffing their codpiece and saying "my dick is big" even when many programs aren't making 30% of what they made 2 years ago. The traffic and the business is being swept out from under our feet. Easy, simple attack points need to be secured. This is getting out of hand.

11-08-2007, 10:41 PM	#10
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	knock this back up for more discussion

11-09-2007, 12:33 AM	#15
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	woj, actually, no, something a little more complex than that. ccbill's system could distribute a list of acceptable domains to send joins to, perhaps communicating with the various partner systems in a push method to keep that list up to date. Every week or so, switch out the valid ones with other ones, and keep going. Essentially, don't keep your single signup domain as a simple target. So for this week, ccbill21.com, ccbill22.com billbycc.com, ccbilling.com, cc22bill.com and joinnowcc.com are active. next week, they get replaced with new ones. The new ones would always be the best to use because the toolbar people won't have them. Switch them often enough, and the toolbar guys will get tired. A similar thing could be done with the click counting. Instead of a long CCBill link, that could be replaced with simple code that goes on the domain of the paysite, which in turn triggers the count with the affiliate code. So instead of the long ccbill link, your link would be (and always be: www.paysite.com?9233745 (whatever your affiliate code is) and that system would translate it and push it through the most recent ccbill active domain for clicks. With a rotating list of about 200 or 300 domains, and new ones added from time to time, it would be pretty hard for the toolbar guys to keep up. With the system in place, all join hits could easily be sent to another domain within minutes, and in fact that domain could be different for every join request. It would be extremely hard (if not impossible) for Zango to trigger, example, in that circumstance, and it would require people to bid on all 200 or 300 domains to have a hope. Then you drop all those domains and replace them and they are fucked again. When it becomes too much work for them to attack you, they will move on to something easier. NATS has the same problem with their default structure, which makes it very easy to trigger on the join pages. With one buy at Zango, I could pop a join page for another site over every single default install NATS site out there right now. Why do you think your sales are evaporating, even as the traffic stays strong or increases?

11-09-2007, 12:34 AM	#16
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Oh, woj, let me add this: they don't want to trigger on any ccbill call, because then they would pop on the initial click and not the join page. The join page is CREAM, and they want the cream.

11-09-2007, 03:49 AM	#19
Blackrose Confirmed User Join Date: Aug 2001 Location: Carnal City Posts: 344	bump this important thread to the top! __________________ The die is cast... The dice are rolled... You look like shit... I feel like gold -- Uh, me?

11-09-2007, 03:53 AM	#20
aico Moo Moo Cow Join Date: Mar 2004 Location: Washington State Posts: 14,748	we should all just change it to mail in cash subscriptions.

11-09-2007, 04:41 AM	#21
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,421	They make money no matter what.

11-09-2007, 09:14 AM	#24
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	I would say anything that makes your coding unique would be a very good start. As for CCBill, this may be the proof that they need to move to a system that runs on the paysite tour server and pulled the join page into that site, making it appear to be part of the site. This is a very serious situation, CCBill is such a juicy target.

11-09-2007, 10:36 AM	#25
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	back to page 1.

11-09-2007, 02:13 PM	#27
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Mutt, it is easy to do, but harder to maintain, more work, etc. Most of what I suggest is the same as remembering to lock you car doors. It won't stop detemined theives, but it will discourage some and have other move on to easier pickings. My opinion right now is that CCBill and NATS sites are easy pickings, and they should not want to be.

11-09-2007, 05:11 PM	#28
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Recycled to the top.

11-09-2007, 05:41 PM	#29
StarkReality Confirmed User Join Date: May 2004 Location: 4 8 15 16 23 42 Posts: 4,444	Another bump for a real problem.

11-09-2007, 06:40 PM	#30
Zebra Banned from Kimmy's couch Industry Role: Join Date: Oct 2001 Location: Down at Fraggle Rock Posts: 5,091	I'm surprised this thread isn't more active. Is there something being done behind the scenes and nobody is wanting to talk about it for fear of giving the crooks a warning? Or is just nothing being done about it? __________________ Old School

11-09-2007, 06:49 PM	#31
RawAlex So Fucking Banned Join Date: Oct 2003 Location: In a house. Posts: 9,465	Zebra, I think as much as anything, nobody wants to acknowledge that this is a major, huge, critical weak point at a very key point in the sales transaction. Zango allowing people to guy bill.ccbill.com is only a small percentage of the true toolbar / malware / scumware potential to trigger off that domain. I very much doubt that CCBill would discuss this out there, but making people aware is the first step towards a solution coming along, either because CCBill wants to make things better, or because the program owners and affiliates get upset enough to ask for something to be done.

11-10-2007, 05:13 PM	#32
webmasterchecks Confirmed User Join Date: Oct 2006 Location: Phoenix Posts: 1,685	rawalex, they can simply target any page with ccbill on it to get around that. Ive worked in spyware for some time anything you throw up as a possible general method that ccbill or any other processor or even paysite can use to "stop" this, there is a simple and effective way around. however, i am not going to post those publicly. zango has been around for many years, and while everyone here in adult has been busy learning about hosting, traffic, content, affiliates, etc this whole time, zango has been doing their thing, and learning how to effectively monetize their installs. they expect companies to try to stop them and they figure out multiple layer processes to get around those attempts they are huge public company and this is a huge mainstream problem as well, but zango makes a lot off of adult and have a lot of installs on adult surfers computers, they are #1 result on yahoo for porn. they control the surfers computer, the only real way to address the problem is to get the software off the users computers, make sure they install firewalls, keep their anti-virus software up to date, etc if the industry “really” wants to stop the problem, promote products like pctools/ kaspersky In May 2007, Zango filed a lawsuit against PC Tools alleging tortious interference with its business and trade libel, because the PC Tools product Spyware Doctor at that time classified Zango software as malicious and removed it without informing users. Zango dropped the suit after the judge ruled that the suit was "unlikely to succeed on the merits of any of its three causes of action" and refused to grant Zango a temporary restraining order. Also in May 2007, Zango filed in the same court a similar lawsuit against Kaspersky Lab, accusing it of tortious interference, trade libel and unjust enrichment for blocking the installation of Zango software. Kaspersky defended itself by invoking the Communications Decency Act (CDA), saying it was immune from civil liability based on the paragraph of the CDA headed "Protection for 'Good Samaritan' blocking and screening of offensive material". The judge agreed, granting Kasperky's motion for summary judgment. http://en.wikipedia.org/wiki/Zango __________________ Webmasterchecks Affiliate Payments - fully compatible with nats/mpa3