3 ms·

Thanks. It would be great if you could provide some concrete examples. I have read the article but still don’t really understand how this works. Examples help

by baxtr 3y ago

Thanks. It would be great if you could provide some concrete examples. I have read the article but still don’t really understand how this works. Examples help to explain it to other people who need to know.

TimPC 3y ago
Basically any URL shortener would be an example.
MOARDONGZPLZ 3y ago
This hacker news comment citing a peer reviewed study from the other time this article was posted gives a concrete example of how someone might fraudulently lead someone to a different than expected link: https://t.ly/77r6z https://t.ly/77r6z
- lainga 3y ago
  also: October 2009 : https://t.ly/pol9a https://t.ly/pol9a
  - baxtr 3y ago
    Aaaaaah… so it’s basically Rickrolling someone. Got it!
strictnein 3y ago
Search: [retailer] gift card balance Ad shows up: Text: Check Your [Retailer] Gift Card Display URL: https://www.[retailer].com/ Click the ad, get redirected to the malicious site: https://www.[retailer]-gift-card.com/ https://www.[retailer]-gift-card.com/ Ads always have redirection involved, typically through a third party, to track ROI, conversions, etc. How the attackers take advantage of this is their redirection redirects to the real site if it's the Googlebot or from an IP range known to be owned/used by Google (or other filtering based on location, language, etc). If it's not, it redirects to the malicious site. One solution is that the first hop in the chain has to match the domain of the display URL. That at least somewhat shows you can have a redirection that you control on the display domain. Of course, there could be an open redirect on that display domain, but those are becoming increasingly rare. Work for a large retailer and we dealt with this a lot a year or two ago. Built custom monitoring to detect it and we sent gobs of data back to Google showing it happening. Still pops up every once in a while, but they've made some improvements in their detection/prevention.
- Nextgrid 3y ago
  > One solution is that the first hop in the chain has to match the domain of the display URL Does anyone know why this isn't the default? I can't think of any legitimate reason why a brand wouldn't want to have their true domain displayed? If they want to redirect to a third-party they can implement it on their own website.
  - bombcar 3y ago
    Too many people would complain if they just turned it on, watch the trackers fly by. Since their customers are the people running the trackers and giving them money, they listen to the advertisers and not the cattle who are clicking on ads.
    - Nextgrid 3y ago
      But you can still have trackers? You can still link to a unique URL on your own domain, and you can still pass query params to your spyware of choice?
      - bombcar 3y ago
        Sure, but right now any mid-level mangler can hire "bobs discount SEO, advertising, and snow clearing" to run some Google ads for them, and move on. If Bob has to get the manager to get approval from IT to subdesignate or add a CNAME or whatever they need, it's a huge additional friction. I think many people think that advertising is "Kohl's goes to Google and buys an ad" - it's much more often Kohls hires an agency that hires an agency that manages a independent company that fills out the actual ads, and they all want to track their piece of the pie.
  - cj 3y ago
    I’m pretty sure it is the default. But some people use services like ClickCease which helps mitigate click fraud (e.g. if your competitor clicks your ad over and over, ClickCease and similar services can automatically exclude their IP so they can’t click your ads.. or at least that’s the pitch) Some of these services work by being the first hop in the redirect chain. I was under the impression that Google whitelists services allowed to be used for redirects.

by baxtr 3y ago

TimPC 3y ago

Basically any URL shortener would be an example.

MOARDONGZPLZ 3y ago

This hacker news comment citing a peer reviewed study from the other time this article was posted gives a concrete example of how someone might fraudulently lead someone to a different than expected link: https://t.ly/77r6z https://t.ly/77r6z

lainga 3y ago
also: October 2009 : https://t.ly/pol9a https://t.ly/pol9a
- baxtr 3y ago
  Aaaaaah… so it’s basically Rickrolling someone. Got it!

strictnein 3y ago

Search: [retailer] gift card balance Ad shows up: Text: Check Your [Retailer] Gift Card Display URL: https://www.[retailer].com/ Click the ad, get redirected to the malicious site: https://www.[retailer]-gift-card.com/ https://www.[retailer]-gift-card.com/ Ads always have redirection involved, typically through a third party, to track ROI, conversions, etc. How the attackers take advantage of this is their redirection redirects to the real site if it's the Googlebot or from an IP range known to be owned/used by Google (or other filtering based on location, language, etc). If it's not, it redirects to the malicious site. One solution is that the first hop in the chain has to match the domain of the display URL. That at least somewhat shows you can have a redirection that you control on the display domain. Of course, there could be an open redirect on that display domain, but those are becoming increasingly rare. Work for a large retailer and we dealt with this a lot a year or two ago. Built custom monitoring to detect it and we sent gobs of data back to Google showing it happening. Still pops up every once in a while, but they've made some improvements in their detection/prevention.

Nextgrid 3y ago
> One solution is that the first hop in the chain has to match the domain of the display URL Does anyone know why this isn't the default? I can't think of any legitimate reason why a brand wouldn't want to have their true domain displayed? If they want to redirect to a third-party they can implement it on their own website.
- bombcar 3y ago
  Too many people would complain if they just turned it on, watch the trackers fly by. Since their customers are the people running the trackers and giving them money, they listen to the advertisers and not the cattle who are clicking on ads.
  - Nextgrid 3y ago
    But you can still have trackers? You can still link to a unique URL on your own domain, and you can still pass query params to your spyware of choice?
    - bombcar 3y ago
      Sure, but right now any mid-level mangler can hire "bobs discount SEO, advertising, and snow clearing" to run some Google ads for them, and move on. If Bob has to get the manager to get approval from IT to subdesignate or add a CNAME or whatever they need, it's a huge additional friction. I think many people think that advertising is "Kohl's goes to Google and buys an ad" - it's much more often Kohls hires an agency that hires an agency that manages a independent company that fills out the actual ads, and they all want to track their piece of the pie.
- cj 3y ago
  I’m pretty sure it is the default. But some people use services like ClickCease which helps mitigate click fraud (e.g. if your competitor clicks your ad over and over, ClickCease and similar services can automatically exclude their IP so they can’t click your ads.. or at least that’s the pitch) Some of these services work by being the first hop in the redirect chain. I was under the impression that Google whitelists services allowed to be used for redirects.