Google Online Security Blog: November 2018

140 captures

15 Jan 2019 - 17 Jun 2026

Mar	APR	May
	25
2025	2026	2027

success

fail

About this capture

COLLECTED BY

Collection: Independent Media Afghanistan

TIMESTAMPS

The Wayback Machine - https://web.archive.org/web/20260425122236/https://security.googleblog.com/2018/11/

Security Blog

The latest news and insights from Google on security and safety on the Internet

Announcing the Google Security and Privacy Research Awards

November 29, 2018

Posted by Elie Bursztein and Oxana Comanescu, Google Security and Privacy Groupfaculty research grantscloud creditsworking with visiting scholarsresearch interns2017 AwardeesLujo BauerResearch area: Password security and attacks against facial recognitionDan BonehResearch area: Enclave security and post-quantum cryptographyAleksandra KorolovaResearch area: Differential privacyDaniela OliveiraResearch area: Social engineering and phishingFranziska RoesnerResearch area: Usable security for augmented reality and at-risk populationsMatthew SmithResearch area: Usable security for developers

2016 AwardeesMichael BaileyResearch area: Cloud and network securityNicolas ChristinResearch area: Authentication and cybercrimeDamon McCoyResearch area: DDoS services and cybercrimeStefan SavageResearch area: Network security and cybercrimeMarc StevensResearch area: Cryptanalysis and lattice cryptographyGiovanni VignaResearch area: Malware detection and cybercrime

Industry collaboration leads to takedown of the “3ve” ad fraud operation

November 27, 2018

Posted by Per Bjorke, Product Manager, Ad Traffic QualityWhite Opsannouncedhere
All about 3ve: A creative and sophisticated threat
Through our investigation, we discovered that 3ve was comprised of three unique sub-operations that evolved rapidly, using sophisticated tactics aimed at exploiting data centers, computers infected with malware, spoofed fraudulent domains, and fake websites. Through its varied and complex machinery, 3ve generated billions of fraudulent ad bid requests (i.e., ad spaces on web pages that advertisers can bid to purchase in an automated way), and it also created thousands of spoofed fraudulent domains. It should be noted that our analysis of ad bid requests indicated growth in activity, but not necessarily growth in transactions that would result in charges to advertisers. It’s also worth noting that 3+ billion daily ad bid requests made 3ve an extremely large ad fraud operation, but its bid request volume was only a small percentage of overall bid request volume across the industry.

Our objective
3ve’s focus, like many ad fraud schemes, was not a single player or system, but rather the whole advertising ecosystem. As we worked to protect our ad systems against traffic from this threat, we identified that others also had observed this traffic, and we partnered with them to help remove the threat from the ecosystem. The working group, which included nearly 20 partners, was a key component that shaped our broader investigation into 3ve, enabling us to engage directly with each other and to work towards a mutually beneficial outcome.

Industry collaboration helps bring 3ve down
While ad fraud traditionally has been seen as a faceless crime in which bad actors don’t face much risk of being identified or consequences for their actions, 3ve’s takedown demonstrates that there are risks and consequences to committing ad fraud. We’re confident that our collective efforts are building momentum and moving us closer to finding a resolution to this challenge.
For example, industry initiatives such as the Interactive Advertising Bureau (IAB) Tech Lab’s ads.txt standard, which has experienced and continues to see very rapid adoption (over 620,000 domains have an ads.txt), as well as the increasing number of buy-side platforms and exchanges offering refunds for invalid traffic, are valuable steps towards cutting off the money flow to fraudsters. As we announced last year, we’ve made, and will continue to make investments in our automated refunds for invalid traffic, including our work with supply partners to provide advertisers with refunds for invalid traffic detected up to 30 days after monthly billing.
Industry bodies such as the IAB, Trustworthy Accountability Group (TAG), Media Rating Council, and the Joint Industry Committee for Web Standards, who are serving as agents of change and collaboration across our industry, are instrumental in the fight against ad fraud. We have a long history of working with these bodies, including ongoing participation in TAG and IAB leadership and working groups, as well as our inclusion in the TAG Certified Against Fraud program. That program’s value was reinforced with the IAB’s requirement that all members need to be TAG certified by the middle of this year.

Successful disruption
A coordinated takedown of infrastructure related to 3ve’s operations occurred recently. The takedown involved disrupting as much of the related infrastructure as possible to make it hard to rebuild any of 3ve’s operations. As the graph below demonstrates, declining volumes in invalid traffic indicate that the disruption thus far has been successful, bringing the bid request traffic close to zero within 18 hours of starting the coordinated takedown.

Looking ahead
We’ll continue to be vigilant, working to protect marketers, publishers, and users, while continuing to collaborate with the broader industry to safeguard the integrity of the digital advertising ecosystem that powers the open web. Our work to take down 3ve is another example of our collaboration with the broader ecosystem to improve trust in digital advertising. We are committed to helping to create a better digital advertising ecosystem — one that is more valuable, transparent, and trusted for everyone.

Combating Potentially Harmful Applications with Machine Learning at Google: Datasets and Models

November 15, 2018

Posted by Mo Yu, Damien Octeau, and Chuangang Ren, Android Security & Privacy Team[Cross-posted from the Android Developers Blog]previous blog postPotentially Harmful Applications (PHAs)

Using Machine Learning to Scale
PHA behaviorGoogle Play ProtectData Sources
embeddingfeature selectionfeature engineeringModels

Looking forward
successfully detected 60.3% of PHAs identified by Google Play Protect

Acknowledgements

Labels: android security

Introducing the Android Ecosystem Security Transparency Report

November 8, 2018

Posted by Jason Woloz and Eugene Liderman, Android Security & Privacy TeamUpdate: We identified a bug that affected how we calculated data from Q3 2018 in the Transparency Report. This bug created inconsistencies between the data in the report and this blog post. The data points in this blog post have been corrected.What's new in Android securityannual Android Security Year in ReviewAndroid Ecosystem Security Transparency ReportTransparency ReportGoogle Play ProtectPotentially Harmful ApplicationsDevices with Potentially Harmful Applications installed by market segment
2017 Year in ReviewDevices with Potentially Harmful Applications installed by Android version
Devices with Potentially Harmful Applications rate by top 10 countries
Year in ReviewDevices with Potentially Harmful Applications rate by top 10 countriesCheck out the report
Android Ecosystem Security Transparency ReportFAQs section of the Transparency Reportblog postvideo

Labels: android security , android tr

A New Chapter for OSS-Fuzz

November 6, 2018

Posted by Matt Ruhstaller, TPM and Oliver Chang, Software Engineer, Google Security TeamOSS-FuzzGoogle Cloud Platformlaunching9,000manually reportedresolvedPatch Rewards Programideal integrationherereviewOur goal is to admit as many OSS projects as possible and ensure that they are continuously fuzzed.
fuzz target

Labels

Archive

2026
- Apr
- Mar
- Feb
- Jan

2025
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2024
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2023
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2022
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2021
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2020
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2019
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2018
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2017
- Dec
- Nov
- Oct
- Sep
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2016
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2015
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2014
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- Apr
- Mar
- Feb
- Jan

2013
- Dec
- Nov
- Oct
- Aug
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2012
- Dec
- Sep
- Aug
- Jun
- May
- Apr
- Mar
- Feb
- Jan

2011
- Dec
- Nov
- Oct
- Sep
- Aug
- Jul
- Jun
- May
- Apr
- Mar
- Feb

2010
- Nov
- Oct
- Sep
- Aug
- Jul
- May
- Apr
- Mar

2009
- Nov
- Oct
- Aug
- Jul
- Jun
- Mar

2008
- Dec
- Nov
- Oct
- Aug
- Jul
- May
- Feb

2007
- Nov
- Oct
- Sep
- Jul
- Jun
- May

Feed

Give us feedback in our Product Forums.

Google
Privacy
Terms

✕

Wait! Don't Go Yet 🚀

Get our FREE eBook "10 Programming Tips That Changed Everything" when you subscribe!

No spam. Unsubscribe anytime.