4 ms·

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, th

by mcv 4y ago

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

RamRodification 4y ago
Yes! This is crazy to me. How can this not be a thing that has already been discovered and instantly fixed?
- londons_explore 4y ago
  Many ad buyers are not-so-sophisticated... They might work for BigCo, but rather than have the ad point to bigco.com/product they instead have the ad point to tinyurl/bitly so they can track how many people click the ad and repoint it to another URL easily. There is a whole industry of these redirection services that gather stats, direct users different directions based on mobile/desktop or country. It isn't rare to bounce a user via a whole chain of them. To support all those users, ad networks have to allow the apparent URL and actual link target to differ.
  - MichaelCollins 4y ago
    If google gave a shit (obviously they don't) they could whitelist a few tinyurl/bitly/etc sites then follow those redirects themselves to verify they eventually landed on the displayed domain.
  - mcv 4y ago
    No, ad networks don't have to allow any of that. And they shouldn't. Ad buyers should either not track, or do it properly. Demanding massive security holes because you can't be bothered to learn the right way to do it is unreasonable.
- detaro 4y ago
  It's a "feature". So you can link to blafoo.advertisinganalytics.com/weird-looking?tracking=link but what the user sees looks like normal and "safe" brand.com
  - stingraycharles 4y ago
    You should still somehow be able to prove ownership of the domain you want to display, that’s the problem.
nequo 4y ago
Redditor RawPacket writes[1] that it's probably an IDN homograph attack[2]: the g, i, m, or p are replaced with characters from a different character set. Looks right, but the domain is registered with a different character. Example: * gіmp.com is fake. * gimp.com is real. They look the same, don't they? But if you click on the fake gіmp.com, your browser will take you to the domain xn--gmp-jhd.com as it is using the і from the Cyrillic character set. [1] https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_google_ad_disguising_itself_as/iuc7bar/ https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_goog... [2] https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack
- wlonkly 4y ago
  For a moment I was thinking "But then the second screenshot would read "xn--gmp-jhd.com", not "gilimp.org" -- but that would be easily hidden by making the former immediately redirect to the latter. (Mostly I mention this because someone else might be thinking at as well.)
- mcv 4y ago
  Are different character sets allowed in urls? Because that too sounds like a massive mistake inviting these sort of scams. Sorry, but stick to ascii.
  - Raicuparta 4y ago
    Modern browsers won't show those characters in the address bar, exactly to avoid this issue. Which is maybe why the ad points to gilimp.org instead of the gimp.org lookalike.
- hddqsb 4y ago
  That's a good theory, but I don't think it's what happened here. The ads are gone for me now so I can't verify, but when I did get the ad I checked the network monitor and I'm pretty sure there were no redirects via lookalike domains. Also, I'm pretty sure I copy and pasted the display URL and it was plain ASCII.

by mcv 4y ago

Having the actual url be completely different from the displayed url simply shouldn't be possible. Allowing that invites scams like these. At the very least, they need to be the same domain.

RamRodification 4y ago

Yes! This is crazy to me. How can this not be a thing that has already been discovered and instantly fixed?

londons_explore 4y ago
Many ad buyers are not-so-sophisticated... They might work for BigCo, but rather than have the ad point to bigco.com/product they instead have the ad point to tinyurl/bitly so they can track how many people click the ad and repoint it to another URL easily. There is a whole industry of these redirection services that gather stats, direct users different directions based on mobile/desktop or country. It isn't rare to bounce a user via a whole chain of them. To support all those users, ad networks have to allow the apparent URL and actual link target to differ.
- MichaelCollins 4y ago
  If google gave a shit (obviously they don't) they could whitelist a few tinyurl/bitly/etc sites then follow those redirects themselves to verify they eventually landed on the displayed domain.
- mcv 4y ago
  No, ad networks don't have to allow any of that. And they shouldn't. Ad buyers should either not track, or do it properly. Demanding massive security holes because you can't be bothered to learn the right way to do it is unreasonable.
detaro 4y ago
It's a "feature". So you can link to blafoo.advertisinganalytics.com/weird-looking?tracking=link but what the user sees looks like normal and "safe" brand.com
- stingraycharles 4y ago
  You should still somehow be able to prove ownership of the domain you want to display, that’s the problem.

nequo 4y ago

Redditor RawPacket writes[1] that it's probably an IDN homograph attack[2]: the g, i, m, or p are replaced with characters from a different character set. Looks right, but the domain is registered with a different character. Example: * gіmp.com is fake. * gimp.com is real. They look the same, don't they? But if you click on the fake gіmp.com, your browser will take you to the domain xn--gmp-jhd.com as it is using the і from the Cyrillic character set. [1] https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_google_ad_disguising_itself_as/iuc7bar/ https://old.reddit.com/r/GIMP/comments/ygbr4o/dangerous_goog... [2] https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack

wlonkly 4y ago
For a moment I was thinking "But then the second screenshot would read "xn--gmp-jhd.com", not "gilimp.org" -- but that would be easily hidden by making the former immediately redirect to the latter. (Mostly I mention this because someone else might be thinking at as well.)
mcv 4y ago
Are different character sets allowed in urls? Because that too sounds like a massive mistake inviting these sort of scams. Sorry, but stick to ascii.
- Raicuparta 4y ago
  Modern browsers won't show those characters in the address bar, exactly to avoid this issue. Which is maybe why the ad points to gilimp.org instead of the gimp.org lookalike.
hddqsb 4y ago
That's a good theory, but I don't think it's what happened here. The ads are gone for me now so I can't verify, but when I did get the ad I checked the network monitor and I'm pretty sure there were no redirects via lookalike domains. Also, I'm pretty sure I copy and pasted the display URL and it was plain ASCII.