Virus Writers Target Google's Sponsored Links

An anonymous reader writes "It looks like the bad guys are gaming Google's sponsored links to spread their junk to people who click on the ads with unpatched versions of Internet Explorer. Attackers apparently bought the rights to several high profile search terms, including searches that would return results for the Better Business Bureau, among others. The story notes this was bound to happen, given the way Google structures sponsored links: "The bad guys behind the attack appeared to capitalize on an odd feature of Google's sponsored links. Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.""

What do you expect?

That's what you get for using IE.

In No Way Is This A Virus

I really wish people would put even a bit of effort into using the term correctly.

Hell, this isn't even a Worm! It's just exploiting a browser bug to steal passwords.

Yawn.

Don't use Internet Explorer.

Re:In No Way Is This A Virus

On the stupidity scale, using unpatched IE is only slightly above using IE at all.

Screen?

How are the google ad links created? Is there someone circulating a suite of templates or do companies which buy the ads simply provide a URL with which to link to?

What's the procedure for selecting which particular ad a user will see? I imagine it's a little more complex than a completely random selection from one massive repository.

Isn't there a way for Google to virus scan the ads before they're added to the potential pool and, if so, shouldn't there be a way for punishing advertisers who swap out a clean ad with a virus/malware laden one at a later date? Or is this a case of some malicious organizations actually hacking Google code?

There's a datestamp on nearly everything and I'm sure someone has network activity records someplace.

Who bought the ads?

Wouldn't it be easy for Google to track the virus writers by who paid for the search terms?

Thats a great idea

They should send a SWAT team to bust down the door of a guy who steals identities for a living. No POSSIBLE downside there.

copy link location, paste into text editor

right click on ad, copy link location, paste into a text editor

http://pagead2.googlesyndication.com/pagead/iclk?s a=l&ai=BW4xM7-YvRqmJJaLImQTP6dXxApyVrB3A-Je9AsCNtw Gw4y0QAhgCILv-mQYoAjAAOABQ7aSR7P7_____AWD9mPuAzAOY AdO60RCyASJvZmludGVyZXN0LmJpbmFyeS1lbnZpcm9ubWVudH MuY29tugEJNDY4eDYwX2FzyAEB2gEqaHR0cDovL29maW50ZXJl c3QuYmluYXJ5LWVudmlyb25tZW50cy5jb20vqQKZ6jUcO-etPs gCnM3vAagDAcgDBw&num=2&ggladgrp=326118280&gglcreat =574052020&adurl=http://www.apple.com/ca/getamac/a ds/index.html%3Fcid%3DWWW-AMCA-GETAMACK060307-GROB 1&client=ca-pub-0841007318749811&nm=4

look for: adurl=http://whatever

Handy for finding ad urls when you don't want to click on them because they're on your own site because clicking on your own ads is against google's terms. Bit of a pain, but the information is in there if you want to dig it out.

Re:copy link location, paste into text editor

I smell a browser extension

Sorry. My fox farted.

done

It's called Redirect Remover [mozdev.org].

Re:copy link location, paste into text editor

Holy jumping Jesus on a pogo stick!
No offense but if right clicking and copying and pasting a link location is +5 informative, then this must be a phishing site. Where did the real slashdot go?

NoScript helps

Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.

Google is doing something bad here - disabling a browser security feature with JavaScript (why? - that was fashionable a decade ago...). Firefox users can install NoScript [noscript.net] to prevent this kind of chicanery. I'm surprised Firefox doesn't have a preference to disable allowing JavaScript to do this in the first place.

(yes, that was a taunt for somebody to post the little-known about:config preference to disable this mis-feature)

Who cares?

Internet Explorer has always been insecure. Anyone who uses it accepts that their system is essential public property.

Better Business Bureau

Why did the 'virus' writers target these keywords??
FTA:

"BBB," "BBBonline" or "Cars.com"

They could have surely got better returns for the obvious p0rn keywords?

Re:Better Business Bureau

Perhaps pr0n seekers, as a group, are more net savvy these days precisely because so much has been targeted at them. The new set of n00bs are the ones looking for the Better Business Bureau etc. Just a guess.

I've always wondered

How long until someone makes an ad that buffer overflows IE. There are probably many out there, but it could be an actual internet attack if it also used Google's ad service.

Well sorry to say

Google had this coming for a long time. I know it will make some people mad but that "thing" they call Adwords must immediately change. They pay users like Amazon for filtering or do some advanced Ajax tricks, it is their choice.

I am actually seeing spyware/grayware vendors advertising on Adwords and I am using Safari OSX, I am not at their target audience even. I can't imagine stuff actual target audience (IE users) get. These are the very same people who claims random rivals products "badware" just because poor thing tried to check for updates.

They recently banned site of Jim Mitchell, a well known/popular OS X support engineer/developers page claiming he is playing some games with their advertising platform, polite way of saying guy is thief. It turns out, there are spammers featuring copies of popular blogs making money from them.

http://jimmitchell.org/2007/03/08/is-google-adsens e-really-fair/ [jimmitchell.org]

I go nuts when my frequently used tiny usenet group is spammed by spammers using Google groups with Google Mail (verified,real) address, when I head to pirate site to report them, I notice their one and only income is? Google Ads!

So now actual Virus linked? Not big deal at all. Hope it would make them THINK and learn from a company thinking they can do anything and it won't harm them in 1990s.

One last thing, if you are on a secure platform, go check http://zlashdot.org/ [zlashdot.org] , yes "Typosquatting", lowest form of online mafia. See the search bar on top? See the advertising provider? End of discussion :)

It's not the browser, it's at Google's end.

It's worse than that. The URL Google displays for the link is, of course, not the actual link; the actual link goes to Google so they can log the click-through. But the link to Google may in fact cause redirection to a completely different third-party domain, usually some ad broker who is doing arbitrage on the click-through.

Here's an example, obtained by searching Google for "mortgage rates". This is a direct Google result from Google's home page.

<font size=+0>
<a id=an4 href=/url?sa=L&ai=BMHn-CuwvRs7QLpOYgQO0vMmWBoO9jRX zgpWxAvvb3gfg3X0QBBgHKAg4AFDj9Mzv_v____8BYMn2-IbIo 6AZyAEByAL77xXZAw3PC8TgQncC&num=7&ggladgrp=2585635 35&gglcreat=543052995&q=http://pixel-user-1042.eve resttech.net/1042/rq/3/543052995_mortgage%2520rate s_s/url%3Dhttp%253A//www.lendingtree.com/stm3/offe rs/marketpromov34.asp%253Fpromo%253D00224%2526loan _type%253D1%2526esourceid%253D835910%2526source%25 3D835910%2526EF%253D1%2526partner%253DGoogle%25268 00num%253D800-460-8109%2526adtype%253D1&usg=AFrqEz f58V3yFBM0ywyFkKryLzAMqmIWRQ><b>Mortgage</b> Rate Offers</a>
</font><br>
$400,000 for Only $1,334/Month!<br>
Refinance Now, Offers in Minutes.<br>
<span class=a>www.LendingTree.com</span><br>
<br>

Note that field coded into the URL on the A tag: q="http://pixel-user-1042.everesttech.net". That's where Google is going to send you. Not to Lending Tree, but to EverestTech.net. Who's "Everesttech.net [everesttech.net]? An ad broker, or as they put it, "the leader in Search Engine Marketing".

This creates a new attack vector. The Google ad often shows the name of some well-known business, but actually takes you to some place you never heard of. That gives the third party an opportunity to try browser-based attacks.

This isn't just theoretical; it's in the wild. See this article on Webmaster World: " I just had my AdWords account hacked and it seems campaigns were setup with redirects pointing to places like orbitz.com and business.com that try to install some activex remote desktop program." [webmasterworld.com]

It's not clear how to deal with this. The example above is from Google's main site, not "adwords.google.com".

Re:It's not the browser, it's at Google's end.

There's more. Definitely read the blog section at Webmaster World linked above [webmasterworld.com], which is being updated rapidly. Apparently it really is a virus. "It spreads by installing the activex on the computer that clicks the ad and looking to see if the infected host uses adwords, then does the same to their account." The pay per click people are panicking, because they're billed by Google for the ads. "The daily budget was increased to a number that would have produced a 7 figure Monthly payout." The details of exactly how this all works are still sketchy, though. Here's an early technical analysis. [blogspot.com]

It just hit the mainstream press, in the Washington Post [washingtonpost.com]

Adwords accounts are being hijacked as well

Approximately concurrently with this, some Adwords advertisers have discovered that their accounts have been hijacked using a similar technique. Ads that they did not write were added.

Oddly, in at least one case the hijacker added their OWN credit card information to the account to pay for the ads! (Perhaps to try to avoid detection when the advertiser's credit card bill arrives.)

There are some first-person accounts by advertisers at WebmasterWorld:

http://www.webmasterworld.com/google_adwords/33200 21.htm#msg3321934 [webmasterworld.com]

Great...

Now Google is going to jack up their search price to compensate for all the people that won't click on their ads... what are we thinking here... $2 per search? Maybe they'll do a bargain deal. $10/day of unlimited searching?

Washington Post didn't get it quite right

The story isn't about viruses. It's about exploits. See the blog post from the security researcher at Exploit Prevention Labs who discovered this: http://explabs.blogspot.com/2007/04/google-sponsor ed-links-not-safe.html [blogspot.com] The technology is out there for Google to prevent this.

And again, another good reason

to boycott and block google, doublecrook and any related sites.
Smoothwall + adzapper = happy days!

I disallow anything related to google on my lan.
No machine on my lan can access anything that google owns, operates, controls, manipulates, etc..

Google = EVIL..

slashdot's comments do it too

ever notice that the new slashdot site now does the same thing to urls listed in the comments sections? what's the justification? i can't think of a single reason why they shouldn't show the link when you hover.

philo

How to filter Google AdWords

Browser toolbars like AdBlock and other security tools probably now need to filter AdWords. Something like this would work:

• When a link to a Google AdWords site is found in an HTML "a" tag, extract the "q" and "adurl" fields from the URL. Extract the base domain (i.e. www.example.com => example.com) from whichever of those fields is present.
• Extract the text within the A tag. Strip blanks and convert to lower case. Extract the base domain from that.
• If they don't match, the ad doesn't go where it says it does. Make it un-clickable.

Do all this at the DOM level, so any Javascript that creates ad entries is evaluated before filtering.

With this, legitimate AdWords will work, but ones that redirect through other questionable sites won't. This may interfere with some brokered ads, but from an consumer perspective, you probably didn't want to go there anyway.

Doesn't this make the virus writers pay?

Maybe I'm missing something here, but it seems that if these virus/worm/malware writers are buying Google Ads, then they're paying for the links.

Shouldn't it be possible then to do these searches, find out which ones lead to the virus, and just click from a safe browser? Surely it's possible to cost these people tons of money (to pay Google), and no returns (because no one gets infected)? Or at the very least, we'll end up hitting their click limit and their ads don't show anymore.

If it happens to be a hacked Google account, well, then maybe the owners will secure their site better (a third party hacked site distributing malware is just as bad)? At least it will get them off the rotation earlier so maybe they'd get a clue why their account needs money but there's no follow-through.

Er...

So people who are newbiesque enough to run old versions of IE are likely to look at the status bar and mentally parse the URL before clicking on a link?

-b

errr? News from 1997?

And here I was thinking that the fact that a tiny bit of javascript can put anything you want into the status bar when you hover over a link were common knowledge, and has been for at least 10 years.

they're also targeting more popular brands

Try a search for "Skype" on Google. You'll get a sponsored link with the following text:

Skype Official Site www.skype.com Download Latest Software Free Now! Free Unlimited Calls Today.

Safari on Mac OS X doesn't obey Google's javascript trick, and the full link is shown in the status bar (you need to make Safari display the status bar by choosing View / Show status bar). You'll get this link:

http://www.google.com/url?sa=L&ai=BM0_5JpAwRvmgK5n 4nAOQ7NSEBpyS8B3k6Y77BqrdzTuQTggAEAEYASC5VDgBUIfPl u0HYIMFmAHPlwOqAQJlbsgBAcgCyJPxAdkDi2-sFlTdzu4&q=h ttp://www.tkqlhce.com/fc81tenkem13635578132644864% 3Fsid&usg=AFrqEzemKMPDCiKePQKhd-4pdmR_VmzZOQ

Notice the deceiving site, specifically the "tkqlhce" in the addres bar. Pretty tricky to detect. Black ball for Google on this.

Zero tolerance for hackers

How can we continue to 'accept' hackers without focusing on what we really want - a hacked-free internet.

It seems to me that when someone, or some group of someones, makes it their 'business' to do something illicit regarding tampering with software systems we would express outrage and make every attempt to find - and punish - this someone (or group). Period!

Rather than say "oh well" and "that's someone else's problem", why not insist on hacked-free systems?

A Suggestion: Developers could place a signature code, including a bit-digitalized indicator of their untampered-with software, in every program they sell. Altering this signature would indicate fraud, a hack, and render the product untrustworthy. I don't know what the answer is, but I know what the attitude should be - zero tolerance for hackers!

About time

I always hated that they didn't show the link on hover. That's just not nice. Another thing I hate is that for some Google ads, a huge amount of whitespace around it is also the ad link. I click on them sometimes when I'm trying to click empty space. That's just more deception there. If they want to be the nice guy company they supposedly are they shouldn't deceive users like that. Maybe this will convince them to change a bit.

Re:OOPS

Well, not being able to click on them isn't really the problem. Adsense ads rely on JS to be displayed in the first place. I'm not sure about the sponsored links, though. I doubt that those rely on any JS to be displayed, or even to be clicked on... just redirects for counting purposes.

Re:Pay for click....for a virus?

That or selling access to the zombie botnet.

Firefox + NoScript

> Who wants to bet that you can't click on a google Ad-Sense link w/o javascript turned on.

Well, yes, you won't see the link without Javascript enabled for the website displaying the ads. But if you use Firefox + NoScript, you can have Javascript enabled only for that website, so you can click on the link (relatively) safely.

I do it all the time when I see an interesting ad from trusted websites, in order to generate a little income for them. I'd say >95% of the pages I arrive at don't work properly since Javascript and Flash aren't enabled for them when I arrive there, and I never enable Javascript or Flash for them just to see advertising.