Google Analytics Bombing

Google Analytics Bombing

By | July 19, 2010 at 8:22 am | 15 comments | SEO | Tags: , ,

We work with Google Analytics daily; it provides us with lots of amusement, but also frustrations. During a query that arose in the Mediaworks office surrounding uninviting an invited account from Google Analytics, Dan Hoggan brought to light a slightly annoying, yet deceptively brilliant problem with Google Analytics. Looking into it in a little more detail, we discovered a great little trick that you can carry out with Google Analytics to cause chaos and mayhem to a fellow user you don’t like, be it a competitor, an ex-employer or whoever you hold a grudge against.

The process is simple and all you require is the email address of their GA account. You don’t need to know the password or anything else, just the email.

Disclaimer: This post is for information only. Do not try this. I do not condone anybody trying this to cause problems be it with malicious intent or otherwise. I’m not responsible for the consequences.

How does it work?

As part of Google Analytics you have the ability to grant other GA users’ access to your accounts via a method called Report Access Only.  This enables the person you invited to see the specific profile but not carry out any administrative tasks such as setting up goals.

Since the user cannot choose to accept the invite, let alone remove the invite once the need has passed, they are essentially at your mercy.

Limitations and Hindrances

Whilst being unable to remove the account is an annoyance in itself, GA has further limitations that make Google Analytics Bombing even more devastating if a malicious user was to hit your GA account. These currently include:

  • a 50 account limit
  • a default view of 10 accounts
  • no way to see the email of the user who provided you access
  • an ordering system of 1, A

These provide a perfect working environment to create mayhem for any Google Analytics users in a variety of ways and the worst part is: there is really no way to combat them…

GA Bombing Scenarios

Competitor Hijacking

Imagine you found out what email address your competitor was using to access their Google Analytics account.

You could create 10 new accounts following a numbered list to create a defamatory message when they login…

Google Analytics Bombing - Example 001: Slag Off Your Competitors

You guys are so bad at SEO that you rank yourselves at night whilst crying about how bad you SUCK!

Conference/Webinar Humiliation

Imagine if during a conference, you’re bored of the speaker and they start browsing their analytics account live and show their analytics email address.  Don’t like their speech?  Not a problem, send them this for when they refresh…

Google Analytics Bombing - Example 002: Conference Speaker

Does anyone else think that Speaker X looks a bit like a bored Elephant Man sucking salt through a straw?????

Ex-Client who just didn’t “get it”

Not a problem, send them a report access only screenshot like the one below…

Google Analytics Bombing - Example 003: The Ex Client

The reason you did not rank on the 1st page of Google is 'cause you're a tight arse! Spend more than £100 next time!!! P.S. Pay My Invoice!

The possibilities are endless, and the annoyance you could carry out is too high to be annoyed. Imagine flooding an agency analytics account with 50 of your own accounts rendering their own account useless; imagine if that agency shared their entire account with someone else and they saw the knock on message? Exactly!

Google Analytics should fix this

The team at Google Analytics are a very receptive bunch and love hearing new ideas, but they should definitely look at addressing this problem. Even if they simply fix the ability to remove yourself once you have been invited that would solve the problem.



About the Author

Kev Strong

Kev Strong is an online marketing consultant at Newcastle Upon Tyne based digital marketing agency, Mediaworks. A lover of all things search and an ex-web developer, Kev Strong (a.k.a Goosh) is a specialist in advanced search engine optimisation.

15 Comments

  1. Duncan (3 years ago)

    Great post. I love little loopholes like this. It’s like discovering God with his flies undone

    • Goosh (3 years ago)

      Thanks Duncan. Was a hoot writing it.

  2. Jeroen van Eck (3 years ago)

    Nice one! The lack of possibility to remove an account you aren’t an administrator from, is bugging me out as well. Why is that? And the limit, why is that?

    There are more issues with GA though. How about implementing the UA code of your competitor’s website in a few other websites? Of course they can filter it out eventually, but it will trash their statistics for a while.

    • Goosh (3 years ago)

      You just need to look at the Google Webmaster Forums Jereon to see you’re not alone. In all seriousness, they really need to enable the ability for either double opt-in or easy removal.

  3. LordManley (3 years ago)

    This is lovely – I am most amused.

  4. Dean (3 years ago)

    Cheers for this Kev, nice weapon information to have if i ever need it ;)

  5. Dark Analyst (3 years ago)

    @Goosh

    Lol, love the post. Made me giggle ;)

    * You should read this forum thread I wrote about Blackhat Analytics:
    http://www.google.com/support/forum/p/Google+Analytics/thread?tid=76b3bd95476477e9

    * Also the Pdf presentaiton I did at Web Analytics Wednesday is here:
    http://tinyurl.com/32a5vrk [10 slides]

    Thanks

    D.

    • Goosh (3 years ago)

      Thanks for dropping by Phil. Excellent post you have there. I’ll had a read of that one of lunch tomorrow as it definately looks up my street!

  6. Rob (3 years ago)

    haha, this is great! Excellent revenge scheme

  7. Michael Abramovitz (3 years ago)

    Hehe!!!

  8. Chris Gotzmann (3 years ago)

    Great Artikel. Like reeding s.th. ind the early morning in Germany. :-)

  9. Doug Boisvert (3 years ago)

    If your truly good at what you do, you don’t have to stoop to these levels

  10. Shane Brown (3 years ago)

    Hope Google have sorted this now. You would have thought Google would have had this sort of stuff sorted years ago.

  11. Luke Wildman (3 years ago)

    Great post I love knowing things like this! Great to drop in random convos!

Comments