User:Mokadoshi/sandbox
On the World Wide Web, cookie stuffing is a deceptive technique employed in affiliate marketing, where individuals (affiliates) illegitimately set third-party cookies on users' web browsers to falsely claim credit for sales. In the typical affiliate marketing model, affiliates are compensated for driving sales through specially crafted URLs that set cookies on users' browsers. However, with cookie stuffing, affiliates use techniques like HTTP redirects, hidden iframes, or embedded Javascript code that discreetly sets cookies without the user's awareness.
Affiliate marketing programs widely prohibit the practice of cookie stuffing, and it can be considered fraud. The practice harms legitimate affiliates, and the loss of revenue for the retail company may cause increased prices, harming shoppers in general. Shawn Hogan, who was previously the top performer in eBay's affiliate program and earned over $28 million in commissions from the site, was found guilty of fraud for cookie stuffing in 2014 and was sentenced to five months in federal prison.[1] However, despite multiple high-profile cases, cookie stuffing is practiced by a relatively small number of rogue affiliates and regular users do not commonly encounter cookie stuffing in the wild.
Background
[edit]Affiliate marketing is a strategy employed by online giants like GoDaddy, Amazon, and eBay to amplify website traffic.[2] In this framework, third-party entities, or affiliates, receive compensation for promoting the retailer's products, aiming to draw in a more targeted audience and drive sales. The compensation model is predominantly performance-based, operating on a cost-per-sale (CPS) structure where affiliates are paid only upon the successful purchase of the advertised product. This method, requiring payment only after a confirmed sale, serves as a safeguard against potential fraud.[3][4]
The distinct advantage of this payment model lies in its percieved reduction of fraud risk compared to alternative advertising models. Notably, the entry barrier for affiliates is very low, making it an accessible revenue model for those establishing a website without significant assets or brand recognition. However, the efficacy of risk reduction hinges on the affiliate's ability to robustly track sales.[3] In reality, tracking by affiliates often falls short, paving the way for deceptive practices such as cookie stuffing.[2][4]
Mechanism
[edit]The technology via which affiliate marketing websites track how many products are sold by these affiliates is through third-party cookies. The marketing companies setup specially crafted URLs that sets a third-party cookie representing the publisher on the user's browser when the user visits the URL. When the user later makes a purchase, this cookie is read, and the affiliate who set the cookie is credited for the sale.[3]
Cookie stuffing works by illegitimately embedding the contents of the crafted URL in a iframe or by opening the website in a popup; an affiliate can trick the browser into setting a cookie on the online retailer's website, without any legitimate traffic being directed to the said website. Later, when the user makes a purchase, the latest affiliate to set a cookie is credited with the purchase without ever having directed people to the online retailer's website.[5][6]
Techniques
[edit]Fraudulent affiliate marketers use multiple techniques to perform cookie stuffing. In a 2015 study covering 11.7K domains, Chachra et al. found that over 91% of websites used redirects to perform cookie stuffing.[4] This was manifested in the form of both HTTP redirects (i.e., the use of the 302 and 301 status codes to redirect users to a different domain) or via the use of Flash or Javascript to redirect users. Other techniques used by fraudulent affiliates include using iframes to embed the online marketer's website in the code and using scripts and image tags to request specific resources that would set the cookie for the affiliate on the destination website.[4][2]
In the same study, Chachra et al. also found that over 84% of cookies set by fraudulent marketers employed referrer obfuscation to hide their activities from retail websites. By redirecting the user through several innocuous-looking domains, the fraudulent marketer can obscure the domain from which the request was sent. This evades detection since instead of an illegitimate website, a third-party website makes the last request, tricking browsers into believing that the third-party website was the originator of the request.[4]
Another technique used by some malicious actors includes hijacking or publishing malicious browser extensions on the Chrome and Firefox extension stores. By modifying requests sent to online retailers and setting cookies or redirecting users to affiliate websites on startup, the malicious extension can trick online marketers into thinking that the user legitimately clicked on an affiliate link to navigate to their marketplace.[7]
Fraud
[edit]Most affiliate marketing programs widely prohibit cookie stuffing because it tends to undermine genuine product advertising efforts.[3] In the United States, the Federal Trade Commission (FTC) has laid out advertising guidelines mandating the clear disclosure of financial relationships between advertisers and retailers. Cookie stuffing deliberately operates in an opaque manner for users, conflicting with these guidelines that emphasize transparency to the user in such arrangements.[4]
In certain cases, cookie stuffing has been considered a form of wire fraud. In 2006, when eBay collaborated with the Federal Bureau of Investigation (FBI) in a sting operation targeting top affiliate marketers, Shawn Hogan, eBay's largest affiliate marketer, was found to have engaged in cookie stuffing.[8] His strategy involved modifying his website to load resources from eBay's servers, thereby setting affiliate cookies on users' browsers. This technique falsely attributed subsequent eBay purchases to Hogan's site.[3] Despite making over $28 million through eBay's affiliate commissions,[4] it was determined that Hogan's activities did not contribute any substantial revenue to eBay.[3] In the subsequent legal proceedings, Hogan pleaded guilty to a single wire fraud charge, leading to a five-month federal prison sentence and a $25,000 fine.[1]
Around the same time, another incident involved eBay's second most prolific affiliate marketer, Brian Dunning, who employed similar tactics to defraud eBay of over $5 million during 2006-2007. Dunning's fraudulent activities came to light as he utilized methods akin to Shawn Hogan's cookie-stuffing scheme.[8] During the legal proceedings, Dunning admitted to collaborating with Hogan in executing the fraud, offering to teach him key techniques. However, Hogan denied this claim, alleging that Dunning ripped off his techniques. Dunning further alleged that he paid Andrew Way, an account manager at a affiliate management networks CJ Affiliates, for insider knowledge of how the affiliate network operated, although this claim was not officially confirmed.[3] Dunning, like Hogan, pleaded guilty to a single wire fraud charge and was sentenced to 15 months in prison, followed by three years of supervision.[9]
Impact
[edit]Despite several high-profile cases suggesting the contrary, a small number of users encounter cookie stuffing in the wild. This has led researchers to infer that the practice of cookie stuffing is confined to a very small group of affiliates.[4] Additionally, cookie stuffing and other forms of affiliate marketing fraud disproportionately impact larger affiliate marketing networks that oversee numerous affiliate marketing programs, as opposed to smaller in-house programs.[2] This is because smaller in-house affiliate programs are motivated by their parent companies to eradicate fraud, given its direct impact on their revenue. On the other hand, larger affiliate marketing networks, which earn a commission only when a transaction occurs between an affiliate and an online marketer, are incentivized not to actively police their programs and to avoid detecting fraudulent practices.[4][3] In certain cases, this behavioral practice has led to online marketers severing ties with affiliate marketing networks.[3]
Cookie stuffing also has adverse effects on both end users and legitimate affiliates.[3] For end users, a loss of revenue for the parent online retail company in the form of fraudulent affiliate commission payouts could result in items that would otherwise have been sold at a discount being listed at higher prices to offset the losses incurred by online marketers. Similarly, a decrease in the amount of traffic for an online marketing firm could lead to lower demand and, subsequently, higher prices for items.[2] Legitimate affiliates, who employ advertising to attract consumers, also suffer from the impact of cookie stuffing, as they lose out on conversions from affiliate sales that were manipulated due to the use of cookie stuffing to override legitimate affiliate cookies.[4]
References
[edit]- ^ a b Edwards, Jim. "eBay's Top Affiliate Marketer Was Just Sentenced To Federal Prison". Business Insider. Retrieved 2024-02-26.
- ^ a b c d e Snyder, Peter; Kanich, Chris (2016-12-22). "Characterizing fraud and its ramifications in affiliate marketing networks". Journal of Cybersecurity. 2 (1): 71–81. doi:10.1093/cybsec/tyw006. ISSN 2057-2085.
- ^ a b c d e f g h i j Edelman, Benjamin G.; Brandi, Wesley (2013). "Risk, Information and Incentives in Online Affiliate Marketing". SSRN Electronic Journal. doi:10.2139/ssrn.2358110. ISSN 1556-5068.
- ^ a b c d e f g h i j Chachra, Neha; Savage, Stefan; Voelker, Geoffrey M. (2015-10-28). "Affiliate Crookies: Characterizing Affiliate Marketing Abuse". Proceedings of the 2015 Internet Measurement Conference. IMC '15. New York, NY, USA: Association for Computing Machinery. pp. 41–47. doi:10.1145/2815675.2815720. ISBN 978-1-4503-3848-6.
- ^ Chua, Mark Yep-Kui; Yee, George O. M.; Gu, Yuan Xiang; Lung, Chung-Horng (2020-05-29). "Threats to Online Advertising and Countermeasures: A Technical Survey". Digital Threats: Research and Practice. 1 (2): 11:1–11:27. doi:10.1145/3374136.
- ^ Amarasekara, Bede; Mathrani, Anuradha; Scogings, Chris (2020). "Stuffing, Sniffing, Squatting, and Stalking: Sham Activities in Affiliate Marketing". Library Trends. 68 (4): 659–678. doi:10.1353/lib.2020.0016. ISSN 1559-0682.
- ^ Kapravelos, Alexandros; Grier, Chris; Chachra, Neha; Kruegel, Christopher; Vigna, Giovanni; Paxson, Vern (2014). Hulk: Eliciting Malicious Behavior in Browser Extensions. pp. 641–654. ISBN 978-1-931971-15-7.
- ^ a b Edwards, Jim. "How eBay Worked With The FBI To Put Its Top Affiliate Marketers In Prison". Business Insider. Retrieved 2024-02-25.
- ^ "Northern District of California | Laguna Niguel Man Receives Fifteen-Month Prison Term For Defrauding eBay | United States Department of Justice". www.justice.gov. 2014-11-18. Retrieved 2024-02-26.