Slashdot Mirror
Google's Top Search Result For 'Target' Was A Tech Support Scam (bleepingcomputer.com)
An anonymous reader quotes BleepingComputer:
Malicious ads displayed in Google search results for Target -- the US retailer -- redirected users to a tech support scam. The malvertising campaign was spotted on Friday by a US user who posted his observations to a StackExchange thread. The rogue ad appeared when users searched for the term "target," right at the top of all search results, [and] used a feature of the Google Ads service that allows ad publishers to display a URL but redirect users to another link. For example, in the rogue ad, the displayed link was "target.com," but users were redirected to "tech-supportcenter.us." Surprisingly, this got past Google's ad quality control service... The page users landed on was mimicking the style of Microsoft's real website, but was urging users to call a phone number to remove a non-existent "HARDDISK_ROOTKIT_TROJAN_HUACK.EXE" file.
The article points out the same thing happen in February when Google's top search result for Amazon was a spoof site with another tech support scam.
The article points out the same thing happen in February when Google's top search result for Amazon was a spoof site with another tech support scam.
Smart slashdotters bing their searches.
Noticed today on the news.google.com site that two "stories" under the "Health" section were gibberish (kind of like covfefe) and when I clicked on them one led to an online casino site and another to a "Canadian drug" seller. The news headlines appeared legitimate. Not as dangerous but still disturbing.
I don't read your sig. Why are you reading mine?
People expecting to find Target, found themselves a mark.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
I'm so fucking tired of these tech support filth.
Once and for all, find those scumbags and kill them all.
I always skip the ad results.
We need to aadress its readers and the point more
"used a feature of the Google Ads service that allows ad publishers to display a URL but redirect users to another link [...] Surprisingly, this got past Google's ad quality control service"
How is it surprising that a feature used as intended got past QC?
Lol.
Anyway, killing google's ads is easy. Killing the gratuitous anti-Trump propaganda mixed in with basically every google search (including a search for "Target"), not so much. I'd even settle for being able to turn off the "Top Stories" section that appears over most searches, which they seem to have coded in a filter-proof way (or I'm just a noob with custom filters). Someday I'll whip up a greasemonkey script to get rid of it, if nothing else.
Most all ads are as bad as link shorteners in that the final destination is hidden. On a related note, many links on the web these days are hidden / spoofed via javascript. It's beyond time for ad networks to assume some liability for hosting / distributing malware ads. One simply can't trust clicking on any ad. I emphasize this to others whenever the topic of computer security comes up. An ad blocker is increasingly a necessity.
People are fucking idiots - but lets blame someone else
I couldn't agree more, everywhere you look. It's completely covfefe.
0.0.0.0 googleadservices.com
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
It ruins it when your enemies laugh at the joke too.
I suggest going back to "ORANGE BALD TURBOHITLER SMALL HANDS DRUUMMMPPPFFFF!!!"
>used a feature of the Google Ads service that allows ad publishers to display a URL but redirect users to another link.
What could ever go wrong with a feature like that?
When I got the pop-up message this morning, I thought it was from a French website that some asshat posted my picture. Must have came from somewhere else. The French website respected my DMCA takedown notice and took down my picture this afternoon.
"Surprisingly, this got past Google's ad quality control service"
Actually, it's not surprising if you've ever had to deal with Google's ad quality control service. It's worse than Dell support in the 90's.
-- I'm old enough to have lived through six different meanings of the word "hacker."
Since when? Oh people still browse without an AdBlocker. Silly people.
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
Google use to have "don't be evil" as the code of conduct. Now the new code perhaps should be "be as evil as possible". They are doing all evil things in order to chase the ad money. Look at how they structured youtube playback, you can see how bad they are. Somebody also pointed out the timing they announced the TPU 2 hardware, isn't it too close to the coming out party of NVIDIA's Volta?
Drone strike on American soil PROVEN
Blast effects from Indianapolis explosion prove it was a military bombing.
Jim Stone, freelance journalist, updated May 15 2014
Initial report:
Indianapolis blast caused by high velocity explosive
There is little information coming out of Indianapolis, but all of what is coming out indicates that it was a high velocity detonation which occured a few feet off the ground.
There is little concrete foundation remaining at the house the explosion happened at, which totally rules out gas. The lack of high definition photos is damning, we are getting nothing of the blast epicenter and only the debris in the streets. I managed to find a super high quality photo of the neighborhood that does not focus on the house where it originated, but it is clear enough overall to seem to show that the foundation is gone and there is only dirt. But there is so much rubble that it is really hard to tell what is there without a better photo. I am working on this now, and will update it later.
I have received requests to explain the following photo better. When I mention the decompression damage, this is what I am trying to say. If you have a detonation from a military grade explosive, rather than a natural gas explosion, the shock wave that goes out from the blast is supersonic and forms a wall of bunched up compressed air as it moves outward. This creates a vacuum cavity in the heart of the detonation, which can go outward for several hundred feet. Air needs to rush backwards to fill that void after the blast wave has passed, and this creates an enormous suction after the intital blast that can cause significant damage in addition to the initial blast damage. So the arrows are pointing at windows, garage doors, and exterior walls of houses that got sucked off by this negative pressure wave. The fact that the houses I refer to had the external sheathing ripped outward, instead of being blown inward, proves that this was no gas explosion, which is subsonic, it was a detonation of military grade ordinance. Explosions are subsonic, detonations are supersonic, and detonations will cause the reverse pressure wave following the blast. Subsonic explosions will not. This is what I am referring to in the high res photo.
Click the image to enlarge it.
from TFS: "posted his observations to a StackExchange thread..."
What is the best place to report such scams? I don't want to have to create an account or fill out a stupid web form. I want an email address (that allows attaching screen shots, etc) for someone, some organization, some agency who can expedite a solution for the general public. Thanks.
...omphaloskepsis often...
That's why google let them rank so high for years.
If the folks at Mozilla are listening, this is a golden opportunity to score some brownie points.
It should be possible for a browser to detect when a click on an anchor tag gets intercepted by a javascript onclick that goes to a completely different URL, and for the browser to throw a big fat warning instead.
Of course, nobody would expect for Chrome to do anything like this, since Google depends on this hostile and abusive practice for generating ad click revenue. But I would think that this would be a value tool for blocking potential exploits, and a thumb in the eye of Google.
A search engine is worse than worthless if it allows this to happen.
KeEp unnecessary everY day...Like
The faster the google/android fans recognize this, the better.
Surprise...?
It's clearly marked as "Ad", so it's not a search result. Use an adblocker ffs.
Lol.
Anyway, killing google's ads is easy. Killing the gratuitous anti-Trump propaganda mixed in with basically every google search (including a search for "Target"), not so much. I'd even settle for being able to turn off the "Top Stories" section that appears over most searches, which they seem to have coded in a filter-proof way (or I'm just a noob with custom filters). Someday I'll whip up a greasemonkey script to get rid of it, if nothing else.
Just switch to Bing, DuckDuckGo, or one of the others.
Google will straighten up or get replaced.
Sitting around wishing they will get better on their own is a fool's errand.
This is really interesting - I actually saw somebody search for American Express on Bing and end up on a different bogus website. I had no idea how they managed to pull it off, but now I think I have some idea of what happened...
Weeks ago I googled "walmart", and the top result was a support scam. I reported this to google, using the term "dumbass".
why does anyone have to use a search at all?
If you can type the word "target", finish by adding ".com" and avoid the search engine BS altogether.
If people can't figure out the internet even slightly, I certainly don't want them doing anything else that requires thought -like driving or trying to figure out complex things like kitchen appliances, light switches and doorknobs.
Ever since they were funded by Google to cripple itself.
Few years ago Firefox used to have "ask to activate" option on plugins such as Flash, then they took it away so you're left with either "Never activate" or "Always Activate".
I knew they sold out right then, and they've been crippling Firefox ever since.
I don't know why Google isn't called on this by more people as it seems like it's common knowledge by techies that Google's first hits on a Google search are scam sites attempting to trick you into calling them rather than HP, D-Link, Microsoft, etc.. While the savvy folks on this site would subconsciously skip past these links, seniors are regularly calling these numbers to invite malicious scammers into their computers who then proceed to charge them recurring fees to maintain their computer.
A friend of mine works for a local in-home computer service company and relayed a story of a woman that was paying around $3,000 a year for 'maintenance' from a scammer that started with her calling "D-Link" (I use quotes because it's a Google result not the real D-Link) because her internet provider, Cogeco, advised her to do this due to some UPNP vulnerability. She called them a few years back and was fleeced for years.
Using Google right now, which geolocates me to Google Canada, if I Google search for "HP Phone number" the first hit is Google customer "HP Phone Number - Call (Toll Free) Phone Number - printerhelpdesk.usâZ". That's not Hewlett Packard. âZ
What possible reason does this "feature" have for even existing? The whole purpose of displaying a URL when you hover over a link is to tell the user where the link will take them. There's no legitimate reason to ever override that behavior.
I came here for a 'in Soviet Google, target is YOU!'...left dissapointed.
OMG facts!
For a short period of time on May 15th, searches for Walmart wound up with a malvertisement at the top of the page a few weeks ago.
It looked identical to the legitimate Walmart ad and had walmart.com showing in the text of the ad. If you clicked on it, you were taken for a ride.
It was fixed within hours.
I do not know if the ad itself was bad or if the problem was on Wal-Mart's side. Either way, it got fixed fairly quickly.
For anyone who wants to check their security logs for the morning and early afternoon of May 15th, 2017 CST (UTC-0600), here is the first part of the URL that the ad initially sent you to:
https://www.google.com/aclk?sa=L&ai=DChcSEwiFtMT4q_LTAhWMNoEKHWh6D5sYABAAGg[remainder redacted]
That same URL worked fine and sent me to the legitimate walmart.com web site after the problem was fixed.