14 ms·
Google AdWords Exploit Seen in the Wild
- ycombonator 8y agoI saw this Adwords exploit a year ago for “Apple Support” and wrote a feedback. Nothing happened.
- londons_explore 8y agoGoogle blocks the advertiser, but they just open a new account with a new address and credit card number
- deleted 8y ago[deleted]
- 32032141 8y agoThis is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ http://trackersRus.com/ which forwards to http://ebay.com/ http://ebay.com/, without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.
- jfk13 8y agoWow. What a impressively dumb "feature".
- rhizome 8y agoThey only hire the best of the best.
- sangnoir 8y agoOnline ad campaigns depend on redirects to reconcile clicks and analytics. It is dumb, but if you want to get customers/make money in the ad space, you have to support this.
- luckylion 8y agoSure, but you could make them add a meta tag or upload a validation file to prove they are actually working on behalf of the final URL, just like they do to validate that you're in control of the URL for the webmaster console. If the malicious ad buyer has access to ebay.com's server all bets are off, but I feel like that happens a lot less often than this.
- soared 8y agoI posted this above but thousands of companies send their ad traffic to their amazon.com product page, and there are a ton of other one-off examples.
- sambe 8y agoIf Google enforced that hosts/domains matched, could you not redirect from your own host to the tracking provider (and them back to you)?
- jstanley 8y agoYes, but most of the people buying ads are not technically competent enough to make this happen. Google's solution ensures that the marketing people get what they want without the technical people standing in the way.
- arbuge 8y agoIt appears here that the redirection to the ebay.com destination url is not happening and that the user ends up on a different domain. That kind of situation is usually detected when ads are entered into the Google Ads* platform for review, with ads then rejected for "destination url mismatch". One thing checked is that the final destination url after all redirects matches what is specified in the ad's final url field. I suspect the scammers here are somehow faking the destination url for Google's bot checker to pass the Google checks and then serving different destination urls to users who they believe are not Google bots. * Google Ads is now the correct branded name. No longer called AdWords as in the title.
- nullwasamistake 8y agoWow it seems trivial to trick Google's bots with these links. Have the page redirect until ad is approved, profit? I'm sure it's easy to find their bot IP's too. Just make a bunch of terrible ads that nobody will click and see who visits the url. Google needs to abolish this link policy, I don't see how it's enforceable
- arbuge 8y ago> Have the page redirect until ad is approved, profit? Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here. >Google needs to abolish this link policy, I don't see how it's enforceable Link analytics and link trackers are perfectly legitimate. There are many situations in which it is necessary or desirable to go via intermediate urls before the final destination. Throwing out the baby with the bathwater definitely isn't the answer here.
- tomc1985 8y agoPerhaps letting the ad people have a free-for-all with tech is a bad idea. I feel like intermediate URLs should never be OK
- seandougall 8y ago> Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here. What if you randomly redirect, say, 95% of clicks to eBay and take the remaining 5% to your phishing site? Each of Google's periodic checks would only have a 5% chance of catching you, but if you can get enough impressions over eBay's legitimate ads (which is an entirely separate facet to all of this), you'd still get a ton of bites, because so many people get to eBay the way Aunt Sue does. Better yet, your redirect service could look at the client IP address and only redirect to the phishing site if it matches a known range for, say, Comcast or Charter. Or use it to drill down even farther and set up multiple spear phishing campaigns. It seems like there's no shortage of ways to abuse this, and for Google to allow redirects without some sort of robust verification that the advertiser owns the destination domain (such as @gnud's certificate-based suggestion in a sibling comment) seems downright negligent, if that is indeed how they operate.
- gnud 8y agoI've had this problem on Facebook. I've reported some ads for various (relatively benign) scams for herbals and the like, that use a famous newspaper as 'their url', when they have nothing to do with it. Facebook closed my report as 'not against ad policy'. Anyway, this is actually easily fixed without losing tracking/campaign flexibility, by requiring ad orders to be signed by a certificate valid for the target domain, if the URL is different from the displayed one.
- anon4242 8y ago> Facebook closed my report as 'not against ad policy'. Heh, makes you wonder, what's the ad policy? Sounds like: 'They pay us money, so must be legit?'
- stingraycharles 8y agoWouldn’t a simple solution to this problem be to prove ownership of the domain you want displayed? Why is this not done yet, this is almost standard practice nowadays for many types of services.
- soared 8y agoA lot of companies send ads to amazon.com rather then their own web site.
- __jal 8y agoYep. This is why you never click on ads, period.
- jordansmithnz 8y agoI wonder why Google doesn’t follow the redirect, and ensure the followed link matches the displayed link? I get that there’s workarounds like changing the redirect after Google checks it, but there’s solutions to this too (like running checks every so often to ensure the link redirects to the same domain).
- boomlinde 8y agoPossibly the checks are identifiable by User-agent, Referer, client address, timing etc. For this purpose there's a lot of room for false positives. It doesn't matter if some actual users actually get redirected to ebay.
- thaumasiotes 8y agoHeh, interesting example. I would have been weirded out by this specific ad, because when I worked at eBay one thing that got highlighted in a companywide announcement was that some executive had decided to stop running ads for eBay against google searches for "ebay", because that is obviously pointless. (And that this saved a ton of money on advertising without impacting traffic at all.) With a result like that, I wouldn't have expected them to go back to advertising ebay.com on searches for "ebay".
- lern_too_spel 8y agoIt's a famous story: https://slate.com/business/2013/03/paid-search-ads-did-ebay-just-prove-they-dont-work.html https://slate.com/business/2013/03/paid-search-ads-did-ebay-... That's probably why the malware author targeted the eBay keyword. Without any real competition, it would be cheaper for them to win top of page placement.
- burger_moon 8y agoWhat happens when you call the number?
- lawl 8y agoFrom seeing scam pranks on youtube. You get a scam call center telling you to install teamviewer or something. They run netstat and open the event viewer, tell you your pc has hundreds of errors and people spying on you. If you're lucky they run syskey [0] as form of ransomware. In the end they ask $200 to fix your pc. [0] https://en.wikipedia.org/wiki/Syskey https://en.wikipedia.org/wiki/Syskey
- ocdtrekkie 8y agoThankfully, Microsoft actually removed Syskey from Windows 10, both because it was no longer a useful security feature, and almost solely used today by these scammers.
- blakesterz 8y agoEvery once in a while I'll do a search on Google from a browser with no blocker for something like 'ebay' or some other big brand name and I'm always surprised to see that big brand name has bought ads for themselves, it never made sense since they're always the first search result anyways. Now I can only assume two things... 1. Some number of those ads were scams 2. Some large number of people just blindly click on the first thing they see below the search box as long as it's close to whatever they search for. Somewhat related... always surprised to see what search results come up in the IOS app store first for whatever app I'm searching for at the time. It's usually something else, like, search for Uber, first thing that comes up is Lyft.
- tpetry 8y agoIf a large brand like Uber wouldn‘t buy (really expensive) keywords like „uber“ some of their rivals like lyft could bid on it. So uber would lose a customer who was really interested in uber to lyft. Exchange company names how you like. Its especially expensive for shops etc. Google will not change any rules to forbid bidding on brand names because they are making a ton of money of it. Think of something like amazon paying more than $1 for every click just to not loose any potential customer. Adwords is a money burning system.
- holmberd 8y agoThey have some rules in place, try bidding on Fortnite.
- kbenson 8y agoI imagine that might be in response to the malware advertising that was going on for fortnite a while back, and how quite a large proportion of the players are kids. As a highly visible brand and a highly vulnerable audience, it makes sense for them to focus efforts there and put in special rules.
- degenerate 8y ago
- testplzignore 8y agoAre there trademark infringement issues here, particular on Google's part? They are getting paid (probably a lot) to display this ad, and are explicitly allowing buyers to lie about their identity. If I were eBay, I'd be getting my lawyers on this immediately. Every dollar getting paid to Google for this ad is a dollar out of my revenue, and a lost customer, and is illegal.
- luckylion 8y agoAnd eBay will be made responsible for damages. "I click on that ebay ad and then my computer was locked down and a hacker said I need to pay him to get my files back".
- username444 8y agohttps://www.forbes.com/sites/ericgoldman/2012/10/22/google-defeats-trademark-challenge-to-its-adwords-service/ https://www.forbes.com/sites/ericgoldman/2012/10/22/google-d... https://en.m.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_Inc https://en.m.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google....
- IshKebab 8y agoSecond link is broken, and the first is about a different thing (triggering an ad based on a competitor's trademark). Pretending to be a competitor clearly violates trademark law. But I somewhat suspect these fraudsters aren't that concerned with trademark law.
- suzakus 8y agoFixed link for the second page: https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_Inc https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_....
- larkeith 8y agoIt looks like HN drops trailing periods at the end of links, which breaks this. Here's a working link (yay URL encodings). https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_Inc%2E https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_...
- luckylion 8y agoAnd easy to solve: just make google pay large fines for unauthorized brand bidding. The problem will vanish instantly.
- Nextgrid 8y agoYet another problem caused by the cancer that is advertising.
- wzy 8y agoAm I the only one who had to set their browser zoom to 500% to read the contents of the screenshots?
- ilikehurdles 8y agoNo, you're not. The image contents were completely illegible at standard zoom.
- c8g 8y agohttp://web.archive.org/web/20190508131520/https://wp.josh.com/2019/05/06/breaking-news-google-adwords-exploit-seen-in-the-wild-yikes/ http://web.archive.org/web/20190508131520/https://wp.josh.co...
- adam1210 8y agoMy project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.
- luckylion 8y agoThey are making money off of it, that's a pretty strong incentive not to care.
- NullPrefix 8y ago> It is difficult to get a man to understand something, when his salary depends upon his not understanding it.
- rwmj 8y agoIf you're in the US[1] you can trademark your project name, and then Google will pay attention. Of course getting a trademark isn't that easy either so the solution may be worse than the problem. [1] Back when I worked in the business this was only possible in the US, for legal reasons I didn't fully understand.
- paultopia 8y agoWoah, that's extra evil... but presumably also easy to track down, since someone will have to have a google ad account in order to do this? Is there a federal prosecutor listening? Hello, anyone?
- kerng 8y agoWow. This is a nice find - luckily I never click on ads links but this is extremely misleading and dangerous. Imagine a link to your bank or crypto exchange, and it takes you to a phishing site - boom - money gone.
- callalex 8y agoOne of those blunders is much more correctable than the other, do not compare them directly in attempt to give crypto exchanges false equivalencies to a real bank.
- zaroth 8y agoInteresting that they go through so much trouble to spoof eBay.com and then not try to collect logins/passwords.
- throwawaymath 8y agoMy understanding is that's not the purpose of the obfuscation. The parties doing this don't generally want to hack users or compromise accounts, they want people to go to their site instead of the more recognizable one. If they start actively phishing users this way they're solidly in illegal hacking territory on a pretty massive scale. What they're currently doing is "only" a "growth hack" to get more people on their site instead of the competitor's site.
- robbyking 8y agoI agree with you in premise, but if you read the post, the website users were redirected to was a phishing site: https://wpdotjoshdotcom.files.wordpress.com/2019/05/snag-0031.jpg https://wpdotjoshdotcom.files.wordpress.com/2019/05/snag-003...
- Sephr 8y agoThis has been a known issue with Bing and Google for a while now.[1][2] 1. https://twitter.com/sephr/status/1056626456770428929 https://twitter.com/sephr/status/1056626456770428929 2. https://twitter.com/sephr/status/1055751684146655232 https://twitter.com/sephr/status/1055751684146655232
- deleted 8y ago[deleted]
- draw_down 8y agoI wish I could agree, but it's quite believable unfortunately.
- herodotus 8y agoWhen I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an <a> tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those who wanted the feature) lost. But I still think that, any web app that shows "http://whatever" http://whatever" in a link field should ensure that the href field is "http://whatever" http://whatever".
- username223 8y agoI also think mail clients should do that, or at least offer it as an option. Most mail readers have an option to disable loading remote content, and this would be another little way to make HTML email less dangerous. I think (or at least hope) that most people are in the habit of hovering over links in email before clicking them. And I really hope that mail readers never start implementing Javascript. As for web apps, that's the Wild West, and a small fix like this isn't going to tame it.
- jdironman 8y agoMaybe, quite simple have the option to parse <a> tags down to the format "Text - URL". If I remember correctly, some sites from way back had this sort of format occasionally.
- tmefq 8y agoWordPress does it in the admin interface. A very clever hack. Something like: a:after { content: attr(href); display: inline-block; padding: 0 1ex; }
- scarface74 8y agoYou give way too much credit to users if you think they hover over links and users can’t hover over links on mobile devices.
- ocdtrekkie 8y agoI've reported this back in 2017: https://news.ycombinator.com/item?id=13413399 https://news.ycombinator.com/item?id=13413399 (Though the screenshot was on G+, so RIP.) It's even been done to youtube.com before! Clicking ads is inherently dangerous, as they are allowed to show URLs which do not reflect the URLs they will actually route you to. You should never click on an ad. This is a scenario that violates any reasonable convention of good web behavior, but Google won't fix it because the advertisers are how their bills get paid.
- ariwilson 8y agoIsn't this true about any link?
- ocdtrekkie 8y agoNo. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for the destination (such as https://www.ebay.com https://www.ebay.com) but when you click on it, you get redirected with a bunch of tracking stuff added or even through a URL not on the ebay.com domain, as shown in this "exploit". In fact, even if an advertiser were to use a "clean" link as the destination, you first get redirected on that click through a google.com URL, even though the hover text is still lying about the destination. I'm not even sure what it's doing here, there's some neat JavaScript in play. The hover text shows the "clean" URL, but if I inspect it, and then hover over it again, it shows the real redirect URL through google.com.
- albertgoeswoof 8y agoYou’re wrong about being able to trust standard anchor links- you can’t. You can intercept the click using an onclick handler and redirect the user to wherever you want. Viglink and Skimlink do this for affiliate programs, which is somewhat legitimate.
- nrjames 8y agoMy in-laws were duped by this exact site, but through a different ad on Google. They were ensnared in it for weeks before we found out and told them to cease. :(
- lordgrenville 8y agoAs mentioned here https://news.ycombinator.com/item?id=17126218 https://news.ycombinator.com/item?id=17126218 , this blog's author is an interesting character, a very early pioneer in electronic stock trading infrastructure.
- soared 8y agoit Is something of note that someone who helped pioneer electronic stock trading is now working in digital advertising (which in many ways is similar to to trading stocks)
- lordgrenville 8y agoThere are similarities - but I don't think he works in adtech. (Based on this article, and as far as I can tell.)
- inodeman 8y agoI also have seen deceptive ads. One time I searched for Ripple (XRP) and saw an add saying Google had partnered with Ripple Labs and they were giving away free XRP, basically you had to send x amount of XRP and you would get twice that amount, plus as XRP increased the money could 3x or 4x. The worst thing is that it claimed to come from google.ca or google.de I can´t remember.
- tolidano 8y agoeverything on this page boils down to 2 simple things: 1) google ads should verify domain ownership of destination domains (via webmaster tools, etc) 2) google should expand the "feature" of supporting tracker redirects to allow "final" domain owners to disallow the use of interim clicks (so ebay can simply say: "no, I will always go straight to ebay.com, which I own, and any ad that points to me at any step must also point only to and straight at me")
- spiderfarmer 8y agoI assumed this would be the way forward when they introduced Webmaster Tools like a decade ago.
- paulpauper 8y agoAgain another link that does not match the title. An actual exploit would be something like an image ad that executes an on-load execution or popup. This is just sloppy ad approval on google's part
- downandout 8y agoThis isn’t an exploit per se. it is a misuse of a feature. Google has long allowed the display URL to differ from the actual destination URL, and if this weren’t the case this would cause significant problems for advertisers because many link their ads to offsite tracking domains. It’s a feature, not a bug.
- llamataboot 8y agoI feel like all the technical arguments here are besides the point. The ad is designed to take you to a page, which tells you a lie, to convince you to give them your money. We already have a legal term for people that make money by misrepresenting something, it's called fraud. Sure, you can tell me it will still be a cat or mouse game and that laws aren't gonna reach into whatever sort of clickfarm network exists far outside of US jurisdictions, but make it so people are held accountable for this kinda stuff. I'm no fan of the carcereal state, I'm not suggesting that we throw people in jail or drone bomb their server farm, perhaps large fines and getting banned making ads across any platform would work. I dunno, just seems there are not many incentives against this sort of behavior in an ad-dominated internet.
- lucb1e 8y agoIn this case, the technical side is also at fault for allowing this (on every other website (well, aside from Google search results), the status bar shows on hover where you will be taken if you click), but I do agree that we very often talk about the technical aspect and not the legal one. I don't know any country where anyone goes to the police when they had a malware infection. It's a little like countries where there is no point going to the police for theft: nobody was killed so the police has better things to do. Here too, if you're not a huge corporation with millions in damage, they won't even look at it, even if you supply logs that point to an IP within their jurisdiction. (Example of a few years ago in the Netherlands: employer was hacked, hundreds of customer websites taken offline, IP address came from a home connection in the same city as we were in, police took the report straight to /dev/null...) The only way to get anything done legally is by starting lawsuits yourself, which doesn't work for criminal cases, but oh-so-conveniently works for online copyright infringement.
- TeMPOraL 8y ago> We already have a legal term for people that make money by misrepresenting something, it's called fraud. A nitpick, but if that was the definition of fraud, most of existing advertising would land people in jail. Unfortunately, laws around advertising are way too lax. It's definitely not a technical problem, but the technical issues discussed are a symptom of it. They're enabling scummy behaviour in order to profit from it.
- joefkelley 8y agoI'm usually much more pro-google than most on HN, but this is quite bad. I understand it enables other features and a technical work-around that also keeps those features is difficult. But this is a disastrous user experience. It reminds me of caller-id spoofing. Yes, there's a legitimate use case for it. But don't just throw security out the window to enable it, especially when there is a clear and obvious way to abuse it.
- lisper 8y ago> The link is to here (posted as image so you can’t accidentally click it)… A very tiny image so you can't actually read it either.
- pedro_hab 8y agoThat's the kinda stuff that keeps me installing adblockers on computers and phones of relatives that don't know about it. My aunt's android was slow as hell and had lock screen ads, how is this possible? Be kind to your relatives, install an adblocker.
- thinkmassive 8y agoOff-topic but related to the source... I just finished reading Dark Pools, by Scott Patterson, and immediately recognized josh.com as being Josh Levine’s website. He’s portrayed in a very positive light by the book, and he seems like the kind of person who would rather avoid attention from it, but I do want to recommend the book as one of my absolute favorites. It seems his old site about The Island ECN is archived at http://josh.com/oldindex.htm http://josh.com/oldindex.htm Check it out if you have the slightest interest in electronic and high frequency trading!
- yonatron 8y agoNice catch Josh! JD
- Derek_MK 8y agoCan someone tell me what I'm missing here? The author is saying that, on hover, it indicates a different URL than what the href actually goes to, which is a much more serious issue than just "HTML element text doesn't match the href", which is also what most people here in the comments are talking about. But then the author calls for a solution of just enforcing that the element text match the href, which wouldn't fix this issue! I'm inclined to think that something's not right in this article.
- nullwasamistake 8y agoWe should fix this with a new HTTP header. Browsers can verify that "expect redirect on next request" ends with the correct destination domain. It would be relatively simple for browsers to implement. Google can set this on the headers for outgoing redirect link they already use for AdWords and search results. It would simply make sure that after all the 30X redirects, you actually land on the expected domain. I can't believe this doesn't already exist. It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance. And by the other replies on this thread it would fix an ancient security hole at the same time. Anybody want to make an RFC?
- boomlinde 8y agoGoogle could just display the actual link target on their ads. I'm vehemently against standardizing an HTTP header just to facilitate their continued lying about where their ad links lead. Of course, a user may think twice about loading a link to redirect service when they see the actual URL, and Google wouldn't want that, but that really is their problem. It's sad that we don't hold one of the largest tech companies in the world directly accountable for linking users to phishing scams from spots they've sold to third parties. Instead we discuss how an HTTP header could make it easier for them to lie. Meanwhile, they get paid for facilitating scams. > It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance. I don't see how that is the case. If I own the hosts and names involved, I know where my links and redirects between the two lead and don't need the client to ensure that it's correct.
- Annatar 8y agoEnglish in that scam is so bad. It matches South Asia profile. I hear it every day. Exact same bad grammar and 100% identical broken sentence structure pattern. It is pathological. If I were to scam people I'd do my homework. But the infamous "just do the minimum of a minimum" quality issues that region is so notorious for are present even in scams.