Trojan Horse targets Google Adsense

dorkygeek writes "The Register reports that nogoodniks have developed a Trojan horse program that produces fake Google ads posing as the real thing. The as-yet unnamed Trojan replaces legitimate ads served via Google AdSense with promos for penis pills, porn sites and the like. Techshout says the Google AdSense team confirms 'that these are fake Google ads, formatted to look like legitimate ads. We agree that this phenomenon is likely the result of malicious software installed on your computer.'"

Comments

no surprise, Windows problem, again,

[rheotaxis]

The Techshout article fails to mention that this appears to affect Windows users only. The Register calls it the "latest Windows malware threat", while one comment on Techshout confirms it. I suspect, without further details, that the Trojan Horse affects IE somehow. Anyone else have links to more technical details?

Re: no surprise, Windows problem, again,

[rheotaxis]

another link http://thirdsquare.com/adsense-hijacked-118

Re:Marketing campaign?

[_Sharp'r_]

Google sets much higher restrictions on who they allow to become a premium publisher, such as a bare minimum of 10 million page views/month.

Google also gives many more options to their premium publishers, so most "regular" Adsense publishers would love to become one.

Thus, there is no incentive for Google to create a Trojan Horse because they want "more premium subscribers".

But the Adsense code is highly restricted for regular publishers, meaning you aren't allowed to change it from Google's provided format. Premium publishers have additional variable options and changes to the code that regular publishers don't.

Hence why the Trojan would be able to easily find regular Adsense code in a page, but may not identify a premium publisher's Adsense code as easily in order to replace it with a same-sized ad, for example.

As described in TFA

[Escogido]

"Most of the ads were about gambling or adult content, which are banned categories in Google AdSense, clearly indicating a suspicious origin." It looks like it doesn't take a Sherlock Holmes to figure things out...

Re:My complaint against Slashdot

[Millenniumman]

That post was made using a complaint generator.

I have seen something like this before

[Chronos56]

A couple of years ago I was asked to look at a heavily infected machine. One unusual spyware program that was on this PC would intercept Google search requests and respond with several pages of ad based related hits that looked just like valid Google pages. I never did figure out what the underlying piece of spyware was causing it but was eventually successful removing it with Hijack This.

You should have a look.

[twitter]

An advert is an advert, I block them all. I doesn't matter whether it's linking to some porn site or to some site selling digital cameras, it's all bollocks as far as I'm concerned.

Some quick differences between a Google and Porn Ad:

1. See the image in the linked article and compare that to carefully selected text from google.
2. Spam adverts fund spam and yet more trojans, Google ads fund content on small websites.
3. Following a spam link will almost certainly lead you to a malicious web site that will install yet more crap on your wimpy Windoze computer, speeding it's demise.

Those are a few of the differences.