Trojan Horse targets Google Adsense

dorkygeek writes "The Register reports that nogoodniks have developed a Trojan horse program that produces fake Google ads posing as the real thing. The as-yet unnamed Trojan replaces legitimate ads served via Google AdSense with promos for penis pills, porn sites and the like. Techshout says the Google AdSense team confirms 'that these are fake Google ads, formatted to look like legitimate ads. We agree that this phenomenon is likely the result of malicious software installed on your computer.'"

Comments

How long...

[houstonbofh]

My question is, how long did it take before anyone noticed? "Hey! These adds are more relevant than usual!"

Does this mean?

[Wallstreetfighter.co]

I'm not going to get the penis pump I ordered from the ad? I guess I am worried about the wrong virus.

no surprise, Windows problem, again,

[rheotaxis]

The Techshout article fails to mention that this appears to affect Windows users only. The Register calls it the "latest Windows malware threat", while one comment on Techshout confirms it. I suspect, without further details, that the Trojan Horse affects IE somehow. Anyone else have links to more technical details?

Re:Marketing campaign?

[_Sharp'r_]

Google sets much higher restrictions on who they allow to become a premium publisher, such as a bare minimum of 10 million page views/month.

Google also gives many more options to their premium publishers, so most "regular" Adsense publishers would love to become one.

Thus, there is no incentive for Google to create a Trojan Horse because they want "more premium subscribers".

But the Adsense code is highly restricted for regular publishers, meaning you aren't allowed to change it from Google's provided format. Premium publishers have additional variable options and changes to the code that regular publishers don't.

Hence why the Trojan would be able to easily find regular Adsense code in a page, but may not identify a premium publisher's Adsense code as easily in order to replace it with a same-sized ad, for example.

As described in TFA

[Escogido]

"Most of the ads were about gambling or adult content, which are banned categories in Google AdSense, clearly indicating a suspicious origin." It looks like it doesn't take a Sherlock Holmes to figure things out...

A simple HOSTS modification could allow this

[gozar]

If you modify the users HOSTS file to point pagead2.googlesyndication.com to a different machine you can serve your own Google ads. Pretty clever, I'm surprised this hasn't happen before. I don't know how Google could stop this.