Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Virus Writers Target Google's Sponsored Links

Posted by samzenpus on Wed Apr 25, 2007 07:36 PM
from the snake-in-the-grass dept.
An anonymous reader writes "It looks like the bad guys are gaming Google's sponsored links to spread their junk to people who click on the ads with unpatched versions of Internet Explorer. Attackers apparently bought the rights to several high profile search terms, including searches that would return results for the Better Business Bureau, among others. The story notes this was bound to happen, given the way Google structures sponsored links: "The bad guys behind the attack appeared to capitalize on an odd feature of Google's sponsored links. Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.""
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by QuantumG (50515) <qg@biodome.org> on Wednesday April 25 2007, @07:43PM (#18878363) Homepage Journal
    I really wish people would put even a bit of effort into using the term correctly.

    Hell, this isn't even a Worm! It's just exploiting a browser bug to steal passwords.

    Yawn.

    Don't use Internet Explorer.
  • Screen? (Score:5, Interesting)

    by HomelessInLaJolla (1026842) * <lajollahomeless@hotmail.com> on Wednesday April 25 2007, @07:43PM (#18878369) Journal
    How are the google ad links created? Is there someone circulating a suite of templates or do companies which buy the ads simply provide a URL with which to link to?

    What's the procedure for selecting which particular ad a user will see? I imagine it's a little more complex than a completely random selection from one massive repository.

    Isn't there a way for Google to virus scan the ads before they're added to the potential pool and, if so, shouldn't there be a way for punishing advertisers who swap out a clean ad with a virus/malware laden one at a later date? Or is this a case of some malicious organizations actually hacking Google code?

    There's a datestamp on nearly everything and I'm sure someone has network activity records someplace.
    • Re: (Score:3, Informative)

      How are the google ad links created? Is there someone circulating a suite of templates or do companies which buy the ads simply provide a URL with which to link to?

      In my experience with AdWords, there are four lines of text to fill, and one URL. The first one is the "title" and is linked to a url you provide. The next two lines are just text. The last line is supposed to be part of the url, or something related to it in some way... but you can have "hello.org" displayed but actually link to "hello.org/

    • Re: (Score:3, Interesting)

      > Isn't there a way for Google to virus scan the ads before they're added to the potential pool and, if so, shouldn't there be a way for punishing advertisers who swap out a clean ad with a virus/malware laden one at a later date?

      Definitely. But the problem here is that the malicious person can change the contents of the website any time he/she wants. When placing the ad, put something normal there. Once the ad is live, put your malware there. After a few hours the ad will probably be dead ... but I'm af
  • by AlHunt (982887) on Wednesday April 25 2007, @07:45PM (#18878391) Journal
    Wouldn't it be easy for Google to track the virus writers by who paid for the search terms?

    • Re: (Score:3, Interesting)

      Well...

      1st - it's not a virus, it's a browser exploit.

      2nd - what's the point of tracking somebody down in Nigeria or Kazakhstan?

      and more importantly

      3rd - One would expect Google to police their sponsored links a tad bit better than slashdot polices their article submissions.
      At least have a prominent easy-to-use Bad Guy reporting tool. The first thing that comes to mind - a little link like the cached link under each sponsored add might do the trick.
    • by patio11 (857072) on Wednesday April 25 2007, @09:07PM (#18879255)
      They should send a SWAT team to bust down the door of a guy who steals identities for a living. No POSSIBLE downside there.
  • by fyoder (857358) on Wednesday April 25 2007, @07:46PM (#18878399) Homepage Journal

    right click on ad, copy link location, paste into a text editor

    http://pagead2.googlesyndication.com/pagead/iclk?s a=l&ai=BW4xM7-YvRqmJJaLImQTP6dXxApyVrB3A-Je9AsCNtw Gw4y0QAhgCILv-mQYoAjAAOABQ7aSR7P7_____AWD9mPuAzAOY AdO60RCyASJvZmludGVyZXN0LmJpbmFyeS1lbnZpcm9ubWVudH MuY29tugEJNDY4eDYwX2FzyAEB2gEqaHR0cDovL29maW50ZXJl c3QuYmluYXJ5LWVudmlyb25tZW50cy5jb20vqQKZ6jUcO-etPs gCnM3vAagDAcgDBw&num=2&ggladgrp=326118280&gglcreat =574052020&adurl=http://www.apple.com/ca/getamac/a ds/index.html%3Fcid%3DWWW-AMCA-GETAMACK060307-GROB 1&client=ca-pub-0841007318749811&nm=4

    look for: adurl=http://whatever

    Handy for finding ad urls when you don't want to click on them because they're on your own site because clicking on your own ads is against google's terms. Bit of a pain, but the information is in there if you want to dig it out.
  • NoScript helps (Score:5, Insightful)

    by bill_mcgonigle (4333) * on Wednesday April 25 2007, @07:52PM (#18878469) Homepage Journal
    Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.

    Google is doing something bad here - disabling a browser security feature with JavaScript (why? - that was fashionable a decade ago...). Firefox users can install NoScript [noscript.net] to prevent this kind of chicanery. I'm surprised Firefox doesn't have a preference to disable allowing JavaScript to do this in the first place.

    (yes, that was a taunt for somebody to post the little-known about:config preference to disable this mis-feature)
    • Re: (Score:3, Informative)

      (yes, that was a taunt for somebody to post the little-known about:config preference to disable this mis-feature)

      In SeaMonkey, it's:

      dom.disable_window_open_feature.status true keeps new windows from being opened without the status bar
      dom.disable_window_status_change true keeps the current window statusbar from being changed.

      The latter is available under prefs - advaned - scripts and plugins.
    • Re: (Score:3, Informative)

      I'm surprised Firefox doesn't have a preference to disable allowing JavaScript to do this in the first place.

      It does:

      Tools|Options| Click the Advanced button that is next to the checked box to enable JavaScript| Uncheck the box to Allow JavaScript to Change status bar text.
      • Re: (Score:3, Interesting)


        It does:

        Tools|Options| Click the Advanced button that is next to the checked box to enable JavaScript| Uncheck the box to Allow JavaScript to Change status bar text.


        Very interesting - on mine it's under Preferences, Content, Javascript, Advanced, but disallowing it there doesn't stop Google. Perhaps my NoScript permit rule is preempting Firefox's.
      • Re: (Score:3, Informative)

        Internet Explorer has a similar one:

        Tools > Internet Options > Security > Custom Level > (Scroll down to) Scripting > Allow status bar updates via script.

        (Im out of breath after quoting THAT maze)
    • Re: (Score:3, Informative)

      It doesn't help to deny changing the status bar text. The way google manages this is by rewriting the link on a mousedown event. So, it starts out going to the proper place, but when you click or right-click it is re-written to go to the redirect link. Ad links are a bit different in that the container of the ad prevents the status bar from changing by overwriting the normal mouseover event.

      Check out any search link on Google. Mouse over. See the text? Now right click on the link. See the new redirection

  • Well sorry to say (Score:5, Interesting)

    by Ilgaz (86384) * on Wednesday April 25 2007, @08:18PM (#18878807) Homepage
    Google had this coming for a long time. I know it will make some people mad but that "thing" they call Adwords must immediately change. They pay users like Amazon for filtering or do some advanced Ajax tricks, it is their choice.

    I am actually seeing spyware/grayware vendors advertising on Adwords and I am using Safari OSX, I am not at their target audience even. I can't imagine stuff actual target audience (IE users) get. These are the very same people who claims random rivals products "badware" just because poor thing tried to check for updates.

    They recently banned site of Jim Mitchell, a well known/popular OS X support engineer/developers page claiming he is playing some games with their advertising platform, polite way of saying guy is thief. It turns out, there are spammers featuring copies of popular blogs making money from them.

    http://jimmitchell.org/2007/03/08/is-google-adsens e-really-fair/ [jimmitchell.org]

    I go nuts when my frequently used tiny usenet group is spammed by spammers using Google groups with Google Mail (verified,real) address, when I head to pirate site to report them, I notice their one and only income is? Google Ads!

    So now actual Virus linked? Not big deal at all. Hope it would make them THINK and learn from a company thinking they can do anything and it won't harm them in 1990s.

    One last thing, if you are on a secure platform, go check http://zlashdot.org/ [zlashdot.org] , yes "Typosquatting", lowest form of online mafia. See the search bar on top? See the advertising provider? End of discussion :)
  • by Animats (122034) on Wednesday April 25 2007, @08:29PM (#18878921) Homepage

    It's worse than that. The URL Google displays for the link is, of course, not the actual link; the actual link goes to Google so they can log the click-through. But the link to Google may in fact cause redirection to a completely different third-party domain, usually some ad broker who is doing arbitrage on the click-through.

    Here's an example, obtained by searching Google for "mortgage rates". This is a direct Google result from Google's home page.

    <font size=+0>
    <a id=an4 href=/url?sa=L&ai=BMHn-CuwvRs7QLpOYgQO0vMmWBoO9jRX zgpWxAvvb3gfg3X0QBBgHKAg4AFDj9Mzv_v____8BYMn2-IbIo 6AZyAEByAL77xXZAw3PC8TgQncC&num=7&ggladgrp=2585635 35&gglcreat=543052995&q=http://pixel-user-1042.eve resttech.net/1042/rq/3/543052995_mortgage%2520rate s_s/url%3Dhttp%253A//www.lendingtree.com/stm3/offe rs/marketpromov34.asp%253Fpromo%253D00224%2526loan _type%253D1%2526esourceid%253D835910%2526source%25 3D835910%2526EF%253D1%2526partner%253DGoogle%25268 00num%253D800-460-8109%2526adtype%253D1&usg=AFrqEz f58V3yFBM0ywyFkKryLzAMqmIWRQ><b>Mortgage</b> Rate Offers</a>
    </font><br>
    $400,000 for Only $1,334/Month!<br>
    Refinance Now, Offers in Minutes.<br>
    <span class=a>www.LendingTree.com</span><br>
    <br>

    Note that field coded into the URL on the A tag: q="http://pixel-user-1042.everesttech.net". That's where Google is going to send you. Not to Lending Tree, but to EverestTech.net. Who's "Everesttech.net [everesttech.net]? An ad broker, or as they put it, "the leader in Search Engine Marketing".

    This creates a new attack vector. The Google ad often shows the name of some well-known business, but actually takes you to some place you never heard of. That gives the third party an opportunity to try browser-based attacks.

    This isn't just theoretical; it's in the wild. See this article on Webmaster World: " I just had my AdWords account hacked and it seems campaigns were setup with redirects pointing to places like orbitz.com and business.com that try to install some activex remote desktop program." [webmasterworld.com]

    It's not clear how to deal with this. The example above is from Google's main site, not "adwords.google.com".

  • Maybe I'm missing something here, but it seems that if these virus/worm/malware writers are buying Google Ads, then they're paying for the links.

    Shouldn't it be possible then to do these searches, find out which ones lead to the virus, and just click from a safe browser? Surely it's possible to cost these people tons of money (to pay Google), and no returns (because no one gets infected)? Or at the very least, we'll end up hitting their click limit and their ads don't show anymore.

    If it happens to be a hacked Google account, well, then maybe the owners will secure their site better (a third party hacked site distributing malware is just as bad)? At least it will get them off the rotation earlier so maybe they'd get a clue why their account needs money but there's no follow-through.
    • by martinX (672498) on Wednesday April 25 2007, @08:55PM (#18879153)
      Perhaps pr0n seekers, as a group, are more net savvy these days precisely because so much has been targeted at them. The new set of n00bs are the ones looking for the Better Business Bureau etc. Just a guess.