PharmaLeaks: Understanding the Business of Online Pharmaceutical Affiliate Programs Damon McCoy Andreas Pitsillidis∗ Grant Jordan∗ Nicholas Weaver∗† Christian Kreibich∗† Brian Krebs‡ Geoffrey M. Voelker∗ Stefan Savage∗ Kirill Levchenko∗ Department of Computer Science ∗Department of Computer Science and Engineering George Mason University University of California, San Diego †International Computer Science Institute ‡KrebsOnSecurity.com Berkeley, CA Abstract driven by competition between criminal organizations), a broad corpus of ground truth data has become avail- Online sales of counterfeit or unauthorized products able. In particular, in this paper we analyze the content drive a robust underground advertising industry that in- and implications of low-level databases and transactional cludes email spam, “black hat” search engine optimiza- metadata describing years of activity at the GlavMed, tion, forum abuse and so on. Virtually everyone has en- SpamIt and RX-Promotion pharmaceutical affiliate pro- countered enticements to purchase drugs, prescription- grams. By examining hundreds of thousands of orders, free, from an online “Canadian Pharmacy.” However, comprising a settled revenue totaling over US$170M, even though such sites are clearly economically moti- we are able to provide comprehensive documentation on vated, the shape of the underlying business enterprise three key aspects of underground advertising activity: is not well understood precisely because it is “under- Customers. We provide detailed analysis on the con- ground.” In this paper we exploit a rare opportunity to sumer demand for Internet-advertised counterfeit phar- view three such organizations—the GlavMed, SpamIt maceuticals, covering customer demographics, product and RX-Promotion pharmaceutical affiliate programs— selection (including an examination of drug abuse as a from the inside. Using “ground truth” data sets includ- driver), reorder rates and market saturation. ing four years of raw transaction logs covering over $170 Advertisers. We quantitatively detail the role of third- million in sales, we provide an in-depth empirical anal- party affiliate advertisers (both email/forum spammers ysis of worldwide consumer demand, the key role of in- and SEO-based advertisers), the dynamics of their labor dependent third-party advertisers, and a detailed cost ac- market, their ability to drive revenue and the distribution counting of the overall business model. of their commission income. This analysis includes the 1 Introduction operators of many of the best-known botnets including MegaD, Grum, Rustock and Storm, and we document in- Much like the legitimate Internet economy, advertising dividual advertisers generating over $10M in sales. is a major driver for the “underground” criminal econ- Sponsors. We derive an empirical revenue and cost omy as well. For all their variety, spam, search-engine model, including both direct costs (sales commissions, abuse, forum spam and social spam—as well as the bot- supply, payment processing) and indirect costs (hosting, nets, fast-flux networks and other technical infrastruc- domain registration, program advertisements). We also ture that enable these activities—are all simply low-cost provide insight and validation about the most significant advertising platforms that monetize latent consumer de- overheads for the operators of such programs. mand. Consequently, an emerging research agenda has This is an unusual research paper. We introduce no developed around understanding the economic structure new artifact, we develop no new inference technique, of these businesses, both to understand the scope and we deploy no new measurement infrastructure. We do drivers for the problem [8,9, 13], as well as to help pri- none of these things because we don’t need to; we oritize interventions [14, 15]. Unfortunately, while clever have the actual data sets that we would otherwise try inference and estimation techniques can illuminate a few to measure, infer or estimate. Thus, while there are sig- of the key questions, much remains unclear. This is be- nificant methodological challenges that we must over- cause, as a rule, there is little “ground truth” data in the come (mainly around the forensic reverse engineering field for either validating such results or to provide finer- of database schemas and their semantics), ultimately the grained analytics that can be obtained via inference. contribution of this paper is in its results. However, we This paper provides a rare counter-point to this rule. believe these are both unique and significant, with impli- Under a variety of serendipitous circumstances (largely cations for best addressing this variety of Internet abuse. 1 2 Background wail, Storm, Waledac and others). The second advantage Abusive Internet advertising has existed virtually as long of this model, mobility, is that the loosely coupled nature as the Internet itself. In addition to well-defined adver- of their relationship with affiliate programs allows an ad- tising channels such as sponsored search [11, 12], rogue vertiser to switch programs at will (or even support mul- advertisers make use of a broad range of vectors to at- tiple programs at once). This low “switching cost” pro- tract customer traffic including email spam [1,6, 14, 17], vides bargaining power for the effective advertiser (in- search engine manipulation [7, 13, 23], forums and blog deed, we witness high-sales advertisers able to use this spam [19, 24] as well as online social networks [4, 22]. threat to drive higher commissions). More importantly, Due to pressure against these tactics, few legitimate mer- it reduces an advertiser’s exposure to business continuity chants will engage such advertisers and thus rogue adver- risk. If a particular affiliate program should shut down, tising and rogue products tend to go hand in hand. For advertisers can still monetize their investments (e.g., in a example, in one recent report on email spam, Syman- botnet) by advertising for a different sponsor. tec estimated that 80% of all such messages shilled for However, the benefits of this separation are strong for “prescription-free” pharmaceuticals [21]. the sponsoring affiliate program as well. By outsourcing However, the structure of this activity has changed sig- advertising they free themselves from direct exposure to nificantly over the last decade. In particular, market spe- the criminal risks associated with large-scale advertising cialization has largely eliminated the independent “soup- enterprises (e.g., mass compromise of computers and on- to-nuts” advertiser who previously handled the entirety line accounts). Second, because advertisers are paid on a of the sale process [16]. Instead the rise of the affil- commission basis, they also outsource “innovation risk”. iate program, or “partnerka”, model has separated the Program sponsors need not predict the best way to at- role of the advertiser, paid on commission to attract cus- tract customer traffic at a given point in time. Instead tomer traffic, from the sponsor who in turn handles Web hundreds of advertisers innovate independently; if many site design, payment processing, customer service and of them fail, so be it. Since advertisers are only paid com- fulfillment [18]. This evolution is not unique to abu- missions on successful sales, a sponsor will only end up sive advertising; indeed, large legitimate merchants such paying for effective advertising strategies and need not as Amazon also sponsor affiliate programs as a means distinguish among strategies a priori. of advertising. However, it has been deeply internalized Against this background, online pharmaceutical sales within the underground ecosystem including the pay-per- is one of the oldest and largest affiliate program markets. install [3], FakeAV [20], pornography [25], pharmaceuti- This market supports tens of affiliate programs and, as cals [2], herbal supplements [14], replica [14] and coun- we will see, thousands of independent advertisers (affili- terfeit software markets [9], among others. ates) and hundreds of thousands of customers. However, Counterfeit pharmaceuticals represent a typical ex- while the mechanics of this business model are well- ample. Here a range of sponsoring affiliate programs described in recent work [2, 14, 18], the dynamics of provide drugstore storefronts, drug fulfillment (typically the actors and the underlying constants that define the via drop shipping from India), payment processing, cus- cost structure (and hence the vulnerabilities in the busi- tomer service and so on. Independent advertisers, or af- ness) are not well understood at all. Indeed, even simple filiates, in turn promote the program (e.g., by using bot- questions such as “How big is sales turnover?” are imper- nets to send spam email or manipulating search engine fectly understood. For example, Kanich et al. used one results) and are paid a commission on each sale that re- method to estimate that the combined turnover across sults from a click on one of their ads. Commissions range seven leading pharmacy programs (constituting two- from 30%–40% of gross revenue, typically paid via a thirds of affiliate brands advertised in spam) is roughly quasi-anonymous online money transfer service such as 86,000 orders per month [9]. However, Leontiadis et al. WebMoney or Liberty Reserve. use a different technique to arrive at a much larger esti- This business model has two key advantages for the mate suggesting over 640,000 orders per month [13]. advertiser: focus and mobility.