Slashdot Mirror
Virus Writers Target Google's Sponsored Links
An anonymous reader writes "It looks like the bad guys are gaming Google's sponsored links to spread their junk to people who click on the ads with unpatched versions of Internet Explorer. Attackers apparently bought the rights to several high profile search terms, including searches that would return results for the Better Business Bureau, among others. The story notes this was bound to happen, given the way Google structures sponsored links: "The bad guys behind the attack appeared to capitalize on an odd feature of Google's sponsored links. Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.""
That's what you get for using IE.
well I guess that wasn't so smart of Google after all.
Who wants to bet that you can't click on a google Ad-Sense link w/o javascript turned on.
I really wish people would put even a bit of effort into using the term correctly.
Hell, this isn't even a Worm! It's just exploiting a browser bug to steal passwords.
Yawn.
Don't use Internet Explorer.
How we know is more important than what we know.
How are the google ad links created? Is there someone circulating a suite of templates or do companies which buy the ads simply provide a URL with which to link to?
What's the procedure for selecting which particular ad a user will see? I imagine it's a little more complex than a completely random selection from one massive repository.
Isn't there a way for Google to virus scan the ads before they're added to the potential pool and, if so, shouldn't there be a way for punishing advertisers who swap out a clean ad with a virus/malware laden one at a later date? Or is this a case of some malicious organizations actually hacking Google code?
There's a datestamp on nearly everything and I'm sure someone has network activity records someplace.
the NPG electrode was replaced with carbon blac
So people are paying to infect systems with a virus. How will the cost be recouped? Spam?
Wouldn't it be easy for Google to track the virus writers by who paid for the search terms?
1 in 4 Maine children in struggle with hunger.
right click on ad, copy link location, paste into a text editor
http://pagead2.googlesyndication.com/pagead/iclk?look for: adurl=http://whatever
Handy for finding ad urls when you don't want to click on them because they're on your own site because clicking on your own ads is against google's terms. Bit of a pain, but the information is in there if you want to dig it out.Loose lips lose spit.
Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.
Google is doing something bad here - disabling a browser security feature with JavaScript (why? - that was fashionable a decade ago...). Firefox users can install NoScript to prevent this kind of chicanery. I'm surprised Firefox doesn't have a preference to disable allowing JavaScript to do this in the first place.
(yes, that was a taunt for somebody to post the little-known about:config preference to disable this mis-feature)
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Internet Explorer has always been insecure. Anyone who uses it accepts that their system is essential public property.
The links appear just fine in Opera, with no need for plug-ins or to disable JavaScript.
At least have a prominent easy-to-use Bad Guy reporting tool. The first thing that comes to mind - a little link like the cached link under each sponsored add might do the trick. Why would google need to police their sponsored links? The worst that could be done to an unwilling mark is to pop up goatse, but that wouldn't make them much money.
If you choose to use a known insecure browser, the results are entirely your responsibility. You may as well be chastising the highway patrol for not checking everyone's break lines.
FTA:
They could have surely got better returns for the obvious p0rn keywords?
How long until someone makes an ad that buffer overflows IE. There are probably many out there, but it could be an actual internet attack if it also used Google's ad service.
God spoke to me.
Google had this coming for a long time. I know it will make some people mad but that "thing" they call Adwords must immediately change. They pay users like Amazon for filtering or do some advanced Ajax tricks, it is their choice.
s e-really-fair/
:)
I am actually seeing spyware/grayware vendors advertising on Adwords and I am using Safari OSX, I am not at their target audience even. I can't imagine stuff actual target audience (IE users) get. These are the very same people who claims random rivals products "badware" just because poor thing tried to check for updates.
They recently banned site of Jim Mitchell, a well known/popular OS X support engineer/developers page claiming he is playing some games with their advertising platform, polite way of saying guy is thief. It turns out, there are spammers featuring copies of popular blogs making money from them.
http://jimmitchell.org/2007/03/08/is-google-adsen
I go nuts when my frequently used tiny usenet group is spammed by spammers using Google groups with Google Mail (verified,real) address, when I head to pirate site to report them, I notice their one and only income is? Google Ads!
So now actual Virus linked? Not big deal at all. Hope it would make them THINK and learn from a company thinking they can do anything and it won't harm them in 1990s.
One last thing, if you are on a secure platform, go check http://zlashdot.org/ , yes "Typosquatting", lowest form of online mafia. See the search bar on top? See the advertising provider? End of discussion
It's worse than that. The URL Google displays for the link is, of course, not the actual link; the actual link goes to Google so they can log the click-through. But the link to Google may in fact cause redirection to a completely different third-party domain, usually some ad broker who is doing arbitrage on the click-through.
Here's an example, obtained by searching Google for "mortgage rates". This is a direct Google result from Google's home page.
Note that field coded into the URL on the A tag: q="http://pixel-user-1042.everesttech.net". That's where Google is going to send you. Not to Lending Tree, but to EverestTech.net. Who's "Everesttech.net? An ad broker, or as they put it, "the leader in Search Engine Marketing".
This creates a new attack vector. The Google ad often shows the name of some well-known business, but actually takes you to some place you never heard of. That gives the third party an opportunity to try browser-based attacks.
This isn't just theoretical; it's in the wild. See this article on Webmaster World: " I just had my AdWords account hacked and it seems campaigns were setup with redirects pointing to places like orbitz.com and business.com that try to install some activex remote desktop program."
It's not clear how to deal with this. The example above is from Google's main site, not "adwords.google.com".
Approximately concurrently with this, some Adwords advertisers have discovered that their accounts have been hijacked using a similar technique. Ads that they did not write were added.
0 21.htm#msg3321934
Oddly, in at least one case the hijacker added their OWN credit card information to the account to pay for the ads! (Perhaps to try to avoid detection when the advertiser's credit card bill arrives.)
There are some first-person accounts by advertisers at WebmasterWorld:
http://www.webmasterworld.com/google_adwords/3320
Google had this coming for a long time.
You're saying that it's Google's fault that IE has security issues? What color is the sky in your world?
Now Google is going to jack up their search price to compensate for all the people that won't click on their ads... what are we thinking here... $2 per search? Maybe they'll do a bargain deal. $10/day of unlimited searching?
You talk better than you fool!
Because people that are running unpatched IE installations are totally checking the status bar every time they click a link to see if it's legit.
They should send a SWAT team to bust down the door of a guy who steals identities for a living. No POSSIBLE downside there.
Help poke pirates in the eyepatch, arr.
It's called Redirect Remover.
Link, please? I'd be interested in reading about these exploits.
The story isn't about viruses. It's about exploits. See the blog post from the security researcher at Exploit Prevention Labs who discovered this: http://explabs.blogspot.com/2007/04/google-sponsor ed-links-not-safe.html
The technology is out there for Google to prevent this.
Virus Writers Taint Google Ad Links
Virus writers have been gaming Google's "sponsored links" -- the paid ads shown alongside search engine results. They are aiming to get their malicious software installed on computers whose users click onto ad links after searching for legitimate sites such as BBBonline.org, the official Web site of the Better Business Bureau.
Sponsored links allow customers to buy advertisements attached to a particular search term. When a Google user enters a term into the firm's search engine, the ad belonging to the advertiser that bid the highest price for that search term appears at the top of the list of search results.
According to a report at Exploit Prevention Labs, while the top sponsored links that showed up earlier this week when users searched for "BBB," "BBBonline" or "Cars.com" appeared to direct visitors to those sites, they initially would route people who clicked on the ads through an intermediate site. The intermediate site attempted to exploit a vulnerability in Microsoft Windows to silently install software designed to steal passwords and other sensitive information from infected PCs. The attackers exploited a flaw in Microsoft's Internet Explorer Web browser, a problem that the company issued a patch to fix last June.
As Exploit Labs's Roger Thompson notes in his blog, the bad guys behind the attack appeared to capitalize on an odd feature of Google's sponsored links. Normally, when a viewer hovers over a hyperlink, the name of the site that the computer user is about to access appears in the bottom left corner of the browser window. But hovering over Google's sponsored links shows nothing in that area. That blank space potentially gives bad guys another way to hide where visitors will be taken first.
According to Thompson, Google has taken down the offending sponsored links. In fact, searching for "betterbusinessbureau" in Google no longer turns up any sponsored links at the moment.
This certainly is not the first time virus writers have used ads to spawn their wares. Last summer, Security Fix discovered that more than a million Windows users had been infected with spyware thanks to a malicious banner advertisement shown for several days on high-traffic sites like MySpace.com and Webshots.com.
to boycott and block google, doublecrook and any related sites.
Smoothwall + adzapper = happy days!
I disallow anything related to google on my lan.
No machine on my lan can access anything that google owns, operates, controls, manipulates, etc..
Google = EVIL..
Linux here, and using a moz browser, seamonkey. You still get the "nosee'um" effect with the adsense links. JS "blackhole, are ya feelin lucky?" nonsense. They should ALWAYS show up with a hover, any OS, any browser. That they don't is a security issue, fullstop.
philo
Browser toolbars like AdBlock and other security tools probably now need to filter AdWords. Something like this would work:
Do all this at the DOM level, so any Javascript that creates ad entries is evaluated before filtering.
With this, legitimate AdWords will work, but ones that redirect through other questionable sites won't. This may interfere with some brokered ads, but from an consumer perspective, you probably didn't want to go there anyway.
Maybe I'm missing something here, but it seems that if these virus/worm/malware writers are buying Google Ads, then they're paying for the links.
Shouldn't it be possible then to do these searches, find out which ones lead to the virus, and just click from a safe browser? Surely it's possible to cost these people tons of money (to pay Google), and no returns (because no one gets infected)? Or at the very least, we'll end up hitting their click limit and their ads don't show anymore.
If it happens to be a hacked Google account, well, then maybe the owners will secure their site better (a third party hacked site distributing malware is just as bad)? At least it will get them off the rotation earlier so maybe they'd get a clue why their account needs money but there's no follow-through.
> Who wants to bet that you can't click on a google Ad-Sense link w/o javascript turned on.
Well, yes, you won't see the link without Javascript enabled for the website displaying the ads. But if you use Firefox + NoScript, you can have Javascript enabled only for that website, so you can click on the link (relatively) safely.
I do it all the time when I see an interesting ad from trusted websites, in order to generate a little income for them. I'd say >95% of the pages I arrive at don't work properly since Javascript and Flash aren't enabled for them when I arrive there, and I never enable Javascript or Flash for them just to see advertising.
I guess this gives a whole new meaning to "I'm Feeling Lucky".
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
So people who are newbiesque enough to run old versions of IE are likely to look at the status bar and mentally parse the URL before clicking on a link?
-b
If I wanted a sig I would have filled in that stupid box.
... can I get some of the search terms you were typing in? ;-)
Paul B.
And here I was thinking that the fact that a tiny bit of javascript can put anything you want into the status bar when you hover over a link were common knowledge, and has been for at least 10 years.
Assorted stuff I do sometimes: Lemuria.org
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
So yeah in 2006 IE had 38 new bugs and firefox had 47 new bugs.
It seems to me that when someone, or some group of someones, makes it their 'business' to do something illicit regarding tampering with software systems we would express outrage and make every attempt to find - and punish - this someone (or group). Period!
Rather than say "oh well" and "that's someone else's problem", why not insist on hacked-free systems?
A Suggestion: Developers could place a signature code, including a bit-digitalized indicator of their untampered-with software, in every program they sell. Altering this signature would indicate fraud, a hack, and render the product untrustworthy. I don't know what the answer is, but I know what the attitude should be - zero tolerance for hackers!
I always hated that they didn't show the link on hover. That's just not nice. Another thing I hate is that for some Google ads, a huge amount of whitespace around it is also the ad link. I click on them sometimes when I'm trying to click empty space. That's just more deception there. If they want to be the nice guy company they supposedly are they shouldn't deceive users like that. Maybe this will convince them to change a bit.
simple, fast homepage with your links: http://www.ngumbi.com/