Slashdot Mirror
Google Deletes Rogue Ads, Dangers Persist
An anonymous reader writes passed us a link to a PC World article about attempts by Google to curb malicious ads via their popular service. The article is somewhat bleak, though, because researchers see the fix as nothing more than temporary. "'Search engines are just too easy a target for bad guys,' says Roger Thompson of Exploit Security Labs. On April 25, Exploit Prevention Labs reported that malware distributors were using advertisements placed via Google's automated AdWords system to infect unsuspecting end-users with spyware designed to capture bank login user names and passwords."
I'm amazed at what you can, and cannot do with the service. Just today, I found that you cannot remove an old bank account from adwords. Amazing. Even Paypal gets that right.
But this is slashdot. A slashdoter who didn't build his own computer is like a Jedi who didn't build his own lightsaber!
About 6 months ago, a web site showed an AdBrite "please click up top to continue" full page ad. Except, this wasn't a picture, but an actual web page.
The ad itself looked like a blue, medical stock template with a nonsensical press release inside of it. It didn't look like an ad, but an unprofessional scam. Well, my antivirus went off either at that page, or when I clicked to investigate it. The home page itself consisted exactly of that same type of garbage.
So, Google Ads are dangerous because they take you to web sites of hundreds of thousands third party web sites nobody heard of before. AdBrite sticks those pages right into the ad so you can be infected even without clicking on anything; and because of that, you're screwed even if you have an ad-blocker software, because those ads are pulled straight from the advertiser's web sites.
Cover your eyes and click this link!
Microsoft's search excels in spreading malware. How's that for cold water on this Google slam?
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
This vulnerability in AdWords exists because Google made them "reseller-friendly." That needs to stop.
When you click on a Google AdWords ad link, the link goes to Google, not to the destination site. Then Google's ad link server looks at the URL, logs the click, and does a redirect to the site specified by the advertiser. That isn't necessarily the destination shown in the Google ad. It's often some "ad broker" or "affiliate", which wants to see the click event for "tracking". That's what created the vulnerability. Attackers can buy ads for "Bank of America" and have them redirect to "slimeballcentral.biz".
Google does check, when the ad is purchased and occasionally thereafter, that the link sold with the ad eventually redirects to the purported destination, or what Google calls the "landing site". But that's not good enough any more. Attackers can create ads which attract innocent users, run them past the attacker's site where the attacker gets a shot at them, then direct them invisibly to the destination. That's how this attack works.
It's time to cut the middlemen out of the loop. Google ad links need to go directly to the destination site, only. "Ad brokers" and "affiliates" will have to use Google's own ad tracking numbers. This might require outside auditing to be trustworthy.
That would cause some disruption in the ad-broker / "search engine optimization" business, although they'd adjust to it. It's going to be interesting to see whether Google chooses to protect its search customers or its ad brokers. That will tell us whether Google has abandoned "Don't be evil".
The philosophy is simple: Anyone who would take advantage of any sort of exploit to install software on an end user's machine is not peddling a legitimate product.
Of course, a semi-clever malware site admin can write a script that would deliver different content to a Google machine. But I am sure Google has enough disposable IPs and proxies that that won't be a problem. And even if it is, I'm sure they can just Google for a good IP spoofer. (Goofer?)
It's a trivial matter with an easily implemented solution.
UTF-8: There and Back Again
Now I remember why this topic seems familiar. M$'s search engines were recently shown to have far more malware than others. So it's a double M$ issue - they suck on the desktop and people take advantage of their search engine to blow out users of both.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
My question is, if a malicious piece of malware get delivered to someone via a Google Ad on my site am I going to get sued? If my AdWords are just a ticking litigious timebomb maybe I should take them down....
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
Re-directs, while disconcerting, are not the main problem. These exploits often find their way into trusted sites too. The Super Bowl site was hacked with the ANI exploit right before the Super Bowl. Thousands of trusted sites are hacked today, and they're in Google/Yahoo/MSN's organic search results. The criminals hack into a site, insert a simple link into the HTML, and voila, a portion of every unsuspecting visitor's browser's session is re-directed to an exploit server. Also, even if Google eliminated re-directs, the advertisers themselves will want to add their own. Advertisers need to measure somehow. What Google needs to do is apply a technology fix. There's anti-exploit technology available from nearly every security vendor, including the company mentioned in the story who discovered this exploit. In fact, the exploit was discovered by one of their users who was alerted to the malicious hyperlink.
From the fine article:
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
From the fine article:
The problem is that so many people use a crappy browser that allows the attacks. Malicious people are going to put their stuff on the web and that's not Google's fault. To top it all off, Google is doing a better job fighting the problem than Microsoft's own search.
The further away you get from M$, the better off you are.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
What? Is this supposed to mean something? Are you implying that going after websites with malicious ads will eventually lead to the eradication of freedoms? Because that's what the quote you are referring to means. Or are you just trying to be funny? Because you are not.
I even RTFA (!) and I couldn't determine whether or not Firefox is vulnerable or not. Based on things as usual, I'm assuming it isn't but I really cant tell!
-- You are in a maze of little, twisty passages, all different... --
no it doesn't. I've deleted multiple bank and credit card numbers from my paypal account, and they have a way of magically re-appearing. It's freaky, and I really don't like it. I'm sure others have experienced this too...
how many pairs of boxer shorts should you own?
How's that for cold water on this Google slam?
So reporting an issue is a "slam" now? That is, unless it's about "M$", right?
"This is bad, but look over here, some more bad stuff and creative spelling!!"
I bet you're a big fan of Faux News.
I guess that this gives a whole new meaning to "I'm Feeling Lucky".
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
*pats AdBlock on the head*
Good add-on. Here's a bone for ya.
Hey, is that a DoubleClick ad? Sic 'em, boy!
The Bungi Troll asks:
So reporting an issue is a "slam" now?
Yes, it's a slam if you only report half the issue. All of the search engines have this "problem" and M$ has it worse than others. The unmentioned root cause of the issue is a crappy browser and OS that's easy to exploit, yet somehow it's all Google's fault. That is a Google slam.
This is par for the course in the Wintel press world. The article ends up being an advertisement for Site Advisor, which is just another Windoze band-aid. The reporter who wrote this article needed to do some more research. Because they did not, they ended up slamming Google.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
An unpatched crappy browser.
To top it all off, Google is doing a better job fighting the problem
How do you figure that, twitter? You're linking to the story that details the problem, but did you find the one with the solution? Or are you implying that Microsoft never did anything about it, but Google did?
Of course, I love this part from that article, in the usual Register style:
Emphasis mine. Would you like some ketchup with your crow? I'd bet good money you made the same point when this first happened to Live.com.
Just like now you're trying to deflect criticism of Google by pointing out how "M$ is teh worse". You always claim Microsoft pays people to astroturf Slashdot and stalk you. Are you in Google's payroll? It sure seems that way. Why go to all this trouble otherwise?
If snorting beer through your nose after reading counts, mod parent up (funny).
I've been a customer of BofA for several years now and have zero complaints. They've always seemed on top of things.
I've also worked at WaMu (I was a system admin with root on all of their UNIX machines corporatewide). I don't think I would ever bank there.
For linux tips: http://www.linuxtipsblog.com
My question is, if a malicious piece of malware get delivered to someone via a Google Ad on my site am I going to get sued? If my AdWords are just a ticking litigious timebomb maybe I should take them down....
The title was, "Who's at fault?" The answer is obviously Microsoft. It's their browser getting blown out and no one else's. Their search engine is also turning up more malware than Google.
I can't imagine you being sued because someone tricked Google and then did something nasty to someone else's computer. Honyepot is going after the spammers right now and they are the people who will pay eventually. It would be nice if the companies that sponsored them and paid for their bad works would be held responsible, but I doubt American Express, Home Depot, American Airlines and others will ever pay. Don't deprive yourself of revenue because M$ IE has problems. Ultimately, this is someone else's fault and problem.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Wow, more than five modpoints wasted trying to eliminate this thread. I'm flattered by the attention, but annoyed by people not getting to read about how Microsoft's search engine is worse and how none of this would be a problem if IE and Windows were not such sorry systems.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Researchers realize that everybody would be safest if we all just sat in the dark and shunned communication with anyone.
i) Use a filtering proxy (like Proxomitron) to remove sponsored ads from search engine sites. Or, ignore these ads.
ii) The very trite - patch your software! The exploited MS IE hole was patched over a year ago.
.. paranoid crackpot leftover from the days of Amiga.
Google has killed less people than Stalin. I guess news about problems with Google's setup aren't relevant at Slashdot...
is here: http://www.youtube.com/watch?v=iD0wdzQb8XY Narrated by the researcher who first analyzed it.
Love Me! Feel Me! Google Me! MOst of all, Google Me! GooooooGllleee Me!
Your Dean Truly,
Marilee Jones
ive never noticed... mmm i love foxy and noscript/adblock ;)
This really goes back to an incident where "Erris" here (actually his other suckpuppet account) dared someone to provide proof that any "GNU/Linux" machine was in a botnet.
You are putting words into my mouth or someone else's. From other comments you've made, I'd say you were doing it on purpose as part of your pathetic Microsoft defense.
The truth of the matter is very simple. GNU/Linux comes out of the box spyware and malware free and is easy to keep that way. Windoze comes loaded with spyware and soon gets more without any help from the user other than normal browsing and email, sometimes from just plugging the box into a network. Windoze should never be used where data integrity or confidentiality is an issue. Even if it were possible to secure, it costs more and takes much more effort while delivering lower performance and fewer features. I can't imagine why anyone would deny this other than not knowing any better or working for Microsoft or both.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
you run sshd on any port other than 22 ... Joe and Josephine User don't run services, or at least shouldn't. Gone are the days of Linux shipping with tons of services turned on by default - they must be configured and started by the owner.
Off by default is a good policy but people should be encouraged to share and the ability to do so without being screwed is one of the biggest benefits of free software. OpenBSD's sftp is excellent and well implemented on GNU/Linux systems. It can only be brute force attacked by guessing passwords and a reasonable passphrase based password should be used rather than moving ports. Moving ports makes it hard for your friends to find what you want them to find, which adds to the difficulty already imposed by ISPs crimping upload speeds and forcing IP4 and dhcp. The bandwith wasted by ssh attacks is trial, but if you have a lot of that it's not an ssh attack, it's a denial of service. Browsers like konqueror navigate sftp as if it were a local protocol and this is a much nicer set up than the PHP based work around for html interactivity and sharing. People want a safe and secure way to share their pictures and other works. Free software gives them that with the small burden of choosing good passwords. Poblems incurred through linux file serving are trivial next to those the average Windoze user has to put up with from just plugging into the network. They have to get weekly patches, run multiple AV/spyware detectors but still can't share and still get screwed over.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Speaking as a current BoA customer, I tend to agree
Global warming is neither science, nor politics. It is a religion.