Trojan Horse targets Google Adsense

dorkygeek writes "The Register reports that nogoodniks have developed a Trojan horse program that produces fake Google ads posing as the real thing. The as-yet unnamed Trojan replaces legitimate ads served via Google AdSense with promos for penis pills, porn sites and the like. Techshout says the Google AdSense team confirms 'that these are fake Google ads, formatted to look like legitimate ads. We agree that this phenomenon is likely the result of malicious software installed on your computer.'"

Comments

How long...

[houstonbofh]

My question is, how long did it take before anyone noticed? "Hey! These adds are more relevant than usual!"

Does this mean?

[Wallstreetfighter.co]

I'm not going to get the penis pump I ordered from the ad? I guess I am worried about the wrong virus.

no surprise, Windows problem, again,

[rheotaxis]

The Techshout article fails to mention that this appears to affect Windows users only. The Register calls it the "latest Windows malware threat", while one comment on Techshout confirms it. I suspect, without further details, that the Trojan Horse affects IE somehow. Anyone else have links to more technical details?

Re: no surprise, Windows problem, again,

[porkThreeWays]

Details seem to be somewhat limited, but you are right. This seems to be malware that modifies the content IE presents. This is similiar to malware that goes through the pages you visit and looks for keywords such as "games" and automatically links them to whatever gambling site. These are difficult/impossible for website presenters to stop because the problem is with the infected machine, not the originating website.

It's somewhat refreshing that google seems to just fix problems instead of accepting any sort of blame. It's also sad to see that many google-haters take this as an acceptance of blame.

I'm a programmer, and I have to say, I probably would have just said "tough". I used to try and help the users of my sites with malware, but it just became a pointless battle. They didn't care and seem to put forth any effort. At one point I even forced them to do get scanned (forced is harsh. Automatically redirected to a anti-spyware online scan is better. They could close out the window at any time). I ended up supporting end users asking how to get the spyware off their computer and ended up taking blame for their spyware.

And sadly, I feel like a slashbot saying the same statements as 5 years ago, however... If users would get pissed and proactive at Microsoft instead of everyone but them, maybe something would happen. But so many people are complacent and keep buying their garbage and accept this bullshit as normal. Nothing will ever happen as long as the majority of users don't care. That is, until their credit card gets stolen. Then they get pissed at their bank.

Re:Marketing campaign?

[_Sharp'r_]

Google sets much higher restrictions on who they allow to become a premium publisher, such as a bare minimum of 10 million page views/month.

Google also gives many more options to their premium publishers, so most "regular" Adsense publishers would love to become one.

Thus, there is no incentive for Google to create a Trojan Horse because they want "more premium subscribers".

But the Adsense code is highly restricted for regular publishers, meaning you aren't allowed to change it from Google's provided format. Premium publishers have additional variable options and changes to the code that regular publishers don't.

Hence why the Trojan would be able to easily find regular Adsense code in a page, but may not identify a premium publisher's Adsense code as easily in order to replace it with a same-sized ad, for example.

As described in TFA

[Escogido]

"Most of the ads were about gambling or adult content, which are banned categories in Google AdSense, clearly indicating a suspicious origin." It looks like it doesn't take a Sherlock Holmes to figure things out...

A simple HOSTS modification could allow this

[gozar]

If you modify the users HOSTS file to point pagead2.googlesyndication.com to a different machine you can serve your own Google ads. Pretty clever, I'm surprised this hasn't happen before. I don't know how Google could stop this.

A word of advice

[Neoncow]

Google spokesblog advises users of The Internet to pay close attention to the Google ads. If you spot the obvious defacement, you are advised to Google your nearest Google representative and Gmail them about the issue. Remember only, attentive Google users will be able to prevent the spread of this virus.

Google.

Re:What's the difference?

[fm6]

We really need a downmod for parochial posts that say things like "This doesn't affect me, so nobody should care" and "X works for me, if it doesn't work for you then stupid".

Anyway, your attitude towards advertising is brainless. Lots of media — newspapers, magazines, TV — have always depended on it. It can be obnoxious, but it isn't the great evil that so many economically illiterate netizens think it is.

And if you actually buy stuff, which some of us overprivileged types have been known to do from time to time, advertising can be something you seek out. Recently I decided to buy a USB hard disk. I Googled those words because I wanted to see the Adsense ads. Does that make me a mindless slave of the advertisers? No, it makes me somebody who needed information, and used the most efficient way to get it.