Slashdot Log In
Virus Writers Target Google's Sponsored Links
Posted by
samzenpus
on Wed Apr 25, 2007 06:36 PM
from the snake-in-the-grass dept.
from the snake-in-the-grass dept.
An anonymous reader writes "It looks like the bad guys are gaming Google's sponsored links to spread their junk to people who click on the ads with unpatched versions of Internet Explorer. Attackers apparently bought the rights to several high profile search terms, including searches that would return results for the Better Business Bureau, among others. The story notes this was bound to happen, given the way Google structures sponsored links: "The bad guys behind the attack appeared to capitalize on an odd feature of Google's sponsored links. Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.""
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
What do you expect? (Score:2, Insightful)
Re: (Score:2)
In No Way Is This A Virus (Score:5, Informative)
Hell, this isn't even a Worm! It's just exploiting a browser bug to steal passwords.
Yawn.
Don't use Internet Explorer.
Re: (Score:3, Insightful)
Re:In No Way Is This A Virus (Score:5, Funny)
Parent
Screen? (Score:5, Interesting)
What's the procedure for selecting which particular ad a user will see? I imagine it's a little more complex than a completely random selection from one massive repository.
Isn't there a way for Google to virus scan the ads before they're added to the potential pool and, if so, shouldn't there be a way for punishing advertisers who swap out a clean ad with a virus/malware laden one at a later date? Or is this a case of some malicious organizations actually hacking Google code?
There's a datestamp on nearly everything and I'm sure someone has network activity records someplace.
Re: (Score:3, Informative)
In my experience with AdWords, there are four lines of text to fill, and one URL. The first one is the "title" and is linked to a url you provide. The next two lines are just text. The last line is supposed to be part of the url, or something related to it in some way... but you can have "hello.org" displayed but actually link to "hello.org/
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
Definitely. But the problem here is that the malicious person can change the contents of the website any time he/she wants. When placing the ad, put something normal there. Once the ad is live, put your malware there. After a few hours the ad will probably be dead
Whole new meaning (Score:2)
Who bought the ads? (Score:4, Insightful)
Re: (Score:3, Interesting)
1st - it's not a virus, it's a browser exploit.
2nd - what's the point of tracking somebody down in Nigeria or Kazakhstan?
and more importantly
3rd - One would expect Google to police their sponsored links a tad bit better than slashdot polices their article submissions.
At least have a prominent easy-to-use Bad Guy reporting tool. The first thing that comes to mind - a little link like the cached link under each sponsored add might do the trick.
Why? (Score:2)
One would expect Google to police their sponsored links a tad bit better than slashdot polices their article submissions.
At least have a prominent easy-to-use Bad Guy reporting tool. The first thing that comes to mind - a little link like the cached link under each sponsored add might do the trick.
Why would google need to police their sponsored links? The worst that could be done to an unwilling mark is to pop up goatse, but that wouldn't make them much money.
If you choose to use a known insecure browser, the results are entirely your responsibility. You may as well be chastising the highway patrol for not checking everyone's break lines.
Re: (Score:2, Insightful)
I noticed the other day that one of my search results included a note about a particular link being potentially "unsafe" -- presumably because there were signs that the content at the other end contained ex
And... (Score:2)
Paul B.
Re: (Score:2)
I'd love to believe that the FBI is out there tracking down anybody dumb enough to pay for these with their own money, or at least tying this crime to somebody whom they catch in possession of the stolen credit cards. I'm also pretty sure that the reason my boss wants to talk to me privately in his
Thats a great idea (Score:4, Funny)
Parent
copy link location, paste into text editor (Score:5, Informative)
right click on ad, copy link location, paste into a text editor
http://pagead2.googlesyndication.com/pagead/iclk?look for: adurl=http://whatever
Handy for finding ad urls when you don't want to click on them because they're on your own site because clicking on your own ads is against google's terms. Bit of a pain, but the information is in there if you want to dig it out.Re: (Score:3, Funny)
Re:copy link location, paste into text editor (Score:4, Funny)
No offense but if right clicking and copying and pasting a link location is +5 informative, then this must be a phishing site. Where did the real slashdot go?
Parent
Re: (Score:2, Interesting)
http://userscripts.org/scripts/show/8346 [userscripts.org]
along with McAfee's SiteAdvisor to see a red/yellow/green icon next to all Google ad links.
Its not the best Greasemonkey script, but it gets the job done.
Re:copy link location, paste into text editor (Score:4, Funny)
Parent
done (Score:4, Informative)
Parent
Re: (Score:2)
CustomizeGoogle https://addons.mozilla.org/en-US/firefox/addon/74
NoScript helps (Score:5, Insightful)
Google is doing something bad here - disabling a browser security feature with JavaScript (why? - that was fashionable a decade ago...). Firefox users can install NoScript [noscript.net] to prevent this kind of chicanery. I'm surprised Firefox doesn't have a preference to disable allowing JavaScript to do this in the first place.
(yes, that was a taunt for somebody to post the little-known about:config preference to disable this mis-feature)
Opera helps (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
In SeaMonkey, it's:
dom.disable_window_open_feature.status true keeps new windows from being opened without the status bar
dom.disable_window_status_change true keeps the current window statusbar from being changed.
The latter is available under prefs - advaned - scripts and plugins.
Re: (Score:3, Informative)
It does:
Tools|Options| Click the Advanced button that is next to the checked box to enable JavaScript| Uncheck the box to Allow JavaScript to Change status bar text.
Re: (Score:3, Interesting)
It does:
Tools|Options| Click the Advanced button that is next to the checked box to enable JavaScript| Uncheck the box to Allow JavaScript to Change status bar text.
Very interesting - on mine it's under Preferences, Content, Javascript, Advanced, but disallowing it there doesn't stop Google. Perhaps my NoScript permit rule is preempting Firefox's.
Re: (Score:3, Informative)
Tools > Internet Options > Security > Custom Level > (Scroll down to) Scripting > Allow status bar updates via script.
(Im out of breath after quoting THAT maze)
Re: (Score:2)
Why would Gmail make no effort to identify where a sent e-mail is received from (no X-Originating-IP or HTTP received from)?
Why would Google (probably) put a whole bunch of referential material [slashdot.org], potentially at odds with common personal privacy policies, in web ad links?
Inquiring minds...
Re: (Score:3, Informative)
It doesn't help to deny changing the status bar text. The way google manages this is by rewriting the link on a mousedown event. So, it starts out going to the proper place, but when you click or right-click it is re-written to go to the redirect link. Ad links are a bit different in that the container of the ad prevents the status bar from changing by overwriting the normal mouseover event.
Check out any search link on Google. Mouse over. See the text? Now right click on the link. See the new redirection
Who cares? (Score:2)
I've always wondered (Score:2)
Well sorry to say (Score:5, Interesting)
I am actually seeing spyware/grayware vendors advertising on Adwords and I am using Safari OSX, I am not at their target audience even. I can't imagine stuff actual target audience (IE users) get. These are the very same people who claims random rivals products "badware" just because poor thing tried to check for updates.
They recently banned site of Jim Mitchell, a well known/popular OS X support engineer/developers page claiming he is playing some games with their advertising platform, polite way of saying guy is thief. It turns out, there are spammers featuring copies of popular blogs making money from them.
http://jimmitchell.org/2007/03/08/is-google-adsen
I go nuts when my frequently used tiny usenet group is spammed by spammers using Google groups with Google Mail (verified,real) address, when I head to pirate site to report them, I notice their one and only income is? Google Ads!
So now actual Virus linked? Not big deal at all. Hope it would make them THINK and learn from a company thinking they can do anything and it won't harm them in 1990s.
One last thing, if you are on a secure platform, go check http://zlashdot.org/ [zlashdot.org] , yes "Typosquatting", lowest form of online mafia. See the search bar on top? See the advertising provider? End of discussion
It's not the browser, it's at Google's end. (Score:5, Informative)
It's worse than that. The URL Google displays for the link is, of course, not the actual link; the actual link goes to Google so they can log the click-through. But the link to Google may in fact cause redirection to a completely different third-party domain, usually some ad broker who is doing arbitrage on the click-through.
Here's an example, obtained by searching Google for "mortgage rates". This is a direct Google result from Google's home page.
Note that field coded into the URL on the A tag: q="http://pixel-user-1042.everesttech.net". That's where Google is going to send you. Not to Lending Tree, but to EverestTech.net. Who's "Everesttech.net [everesttech.net]? An ad broker, or as they put it, "the leader in Search Engine Marketing".
This creates a new attack vector. The Google ad often shows the name of some well-known business, but actually takes you to some place you never heard of. That gives the third party an opportunity to try browser-based attacks.
This isn't just theoretical; it's in the wild. See this article on Webmaster World: " I just had my AdWords account hacked and it seems campaigns were setup with redirects pointing to places like orbitz.com and business.com that try to install some activex remote desktop program." [webmasterworld.com]
It's not clear how to deal with this. The example above is from Google's main site, not "adwords.google.com".
Re:It's not the browser, it's at Google's end. (Score:5, Informative)
There's more. Definitely read the blog section at Webmaster World linked above [webmasterworld.com], which is being updated rapidly. Apparently it really is a virus. "It spreads by installing the activex on the computer that clicks the ad and looking to see if the infected host uses adwords, then does the same to their account." The pay per click people are panicking, because they're billed by Google for the ads. "The daily budget was increased to a number that would have produced a 7 figure Monthly payout." The details of exactly how this all works are still sketchy, though. Here's an early technical analysis. [blogspot.com]
It just hit the mainstream press, in the Washington Post [washingtonpost.com]
Parent
Re: (Score:2, Interesting)
Adwords accounts are being hijacked as well (Score:2, Interesting)
Oddly, in at least one case the hijacker added their OWN credit card information to the account to pay for the ads! (Perhaps to try to avoid detection when the advertiser's credit card bill arrives.)
There are some first-person accounts by advertisers at WebmasterWorld:
http://www.webmasterworld.com/google_adwords/33200 21.htm#m [webmasterworld.com]
Great... (Score:2)
And again, another good reason (Score:2)
Smoothwall + adzapper = happy days!
I disallow anything related to google on my lan.
No machine on my lan can access anything that google owns, operates, controls, manipulates, etc..
Google = EVIL..
How to filter Google AdWords (Score:2)
Browser toolbars like AdBlock and other security tools probably now need to filter AdWords. Something like this would work:
Re: (Score:2)
That's going to be a problem. Now that there's an attack which works through redirects, the ad-tracking industry may have to stop using them, or Google may have to limit them to "trusted third parties". (DoubleClick?) Probably wouldn't bother Google if they had to enforce that rule for security reasons.
Right now, Google seems to claim [google.com] that the destination URL and landing URL should be the same, so AdWords users can't really complain if they start enforcing that rule.
It's useful to examine those redir
Doesn't this make the virus writers pay? (Score:4, Insightful)
Shouldn't it be possible then to do these searches, find out which ones lead to the virus, and just click from a safe browser? Surely it's possible to cost these people tons of money (to pay Google), and no returns (because no one gets infected)? Or at the very least, we'll end up hitting their click limit and their ads don't show anymore.
If it happens to be a hacked Google account, well, then maybe the owners will secure their site better (a third party hacked site distributing malware is just as bad)? At least it will get them off the rotation earlier so maybe they'd get a clue why their account needs money but there's no follow-through.
Er... (Score:2)
-b
errr? News from 1997? (Score:2)
Re: (Score:2, Informative)
Firefox + NoScript (Score:2, Informative)
Well, yes, you won't see the link without Javascript enabled for the website displaying the ads. But if you use Firefox + NoScript, you can have Javascript enabled only for that website, so you can click on the link (relatively) safely.
I do it all the time when I see an interesting ad from trusted websites, in order to generate a little income for them. I'd say >95% of the pages I arrive at don't work properly s
Re:Better Business Bureau (Score:4, Insightful)
Parent