Google AdWords Exploit Seen in the Wild • Hacker News Board

Re: Google AdWords Exploit Seen in the Wild

#41

Post by waynecochran » Wed, May 08, 2019, 3:31 PM UTC

tpetry wrote: post #11

blakesterz wrote: post #9

Every once in a while I'll do a search on Google from a browser with no blocker for something like 'ebay' or some other big brand name and I'm always surprised to see that big brand name has bought ads for themselves, it never made sense since they're always the first search result anyways. Now I can only assume two things... 1. Some number of those ads were scams 2. Some large number of people just blindly click on…

If a large brand like Uber wouldn‘t buy (really expensive) keywords like „uber“ some of their rivals like lyft could bid on it. So uber would lose a customer who was really interested in uber to lyft. Exchange company names how you like. Its especially expensive for shops etc. Google will not change any rules to forbid bidding on brand names because they are making a ton of money of it. Think of something like amazon…

Wait ... what ... you can "buy" keywords?

Re: Google AdWords Exploit Seen in the Wild

#42

Post by username223 » Wed, May 08, 2019, 3:32 PM UTC

herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

I also think mail clients should do that, or at least offer it as an option. Most mail readers have an option to disable loading remote content, and this would be another little way to make HTML email less dangerous.

I think (or at least hope) that most people are in the habit of hovering over links in email before clicking them. And I really hope that mail readers never start implementing Javascript. As for web apps, that's the Wild West, and a small fix like this isn't going to tame it.

Re: Google AdWords Exploit Seen in the Wild

#43

Post by rhizome » Wed, May 08, 2019, 3:33 PM UTC

jfk13 wrote: post #6

32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

Wow. What a impressively dumb "feature".

They only hire the best of the best.

Re: Google AdWords Exploit Seen in the Wild

#44

Post by callalex » Wed, May 08, 2019, 3:35 PM UTC

kerng wrote: post #29

Wow. This is a nice find - luckily I never click on ads links but this is extremely misleading and dangerous. Imagine a link to your bank or crypto exchange, and it takes you to a phishing site - boom - money gone.

One of those blunders is much more correctable than the other, do not compare them directly in attempt to give crypto exchanges false equivalencies to a real bank.

Re: Google AdWords Exploit Seen in the Wild

#45

Post by luckylion » Wed, May 08, 2019, 3:36 PM UTC

adam1210 wrote: post #24

My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.

They are making money off of it, that's a pretty strong incentive not to care.

Re: Google AdWords Exploit Seen in the Wild

#46

Post by CamelCaseName » Wed, May 08, 2019, 3:42 PM UTC

tpetry wrote: post #11

blakesterz wrote: post #9

Every once in a while I'll do a search on Google from a browser with no blocker for something like 'ebay' or some other big brand name and I'm always surprised to see that big brand name has bought ads for themselves, it never made sense since they're always the first search result anyways. Now I can only assume two things... 1. Some number of those ads were scams 2. Some large number of people just blindly click on…

If a large brand like Uber wouldn‘t buy (really expensive) keywords like „uber“ some of their rivals like lyft could bid on it. So uber would lose a customer who was really interested in uber to lyft. Exchange company names how you like. Its especially expensive for shops etc. Google will not change any rules to forbid bidding on brand names because they are making a ton of money of it. Think of something like amazon…

Interesting note -- Amazon does not allow you to bid for a competitor's brand name, nor does it allow you to use your competitor's brand name as a keyword.

In my experience, you can try, but you'll get 0 impressions. Not sure how this works for very generic brand names though (e.g. "band-aid")

Re: Google AdWords Exploit Seen in the Wild

#47

Post by NullPrefix » Wed, May 08, 2019, 3:47 PM UTC

luckylion wrote: post #45

adam1210 wrote: post #24

My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.

They are making money off of it, that's a pretty strong incentive not to care.

> It is difficult to get a man to understand something, when his salary depends upon his not understanding it.

Re: Google AdWords Exploit Seen in the Wild

#48

Post by arbuge » Wed, May 08, 2019, 3:48 PM UTC

32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

It appears here that the redirection to the ebay.com destination url is not happening and that the user ends up on a different domain.

That kind of situation is usually detected when ads are entered into the Google Ads* platform for review, with ads then rejected for "destination url mismatch". One thing checked is that the final destination url after all redirects matches what is specified in the ad's final url field.

I suspect the scammers here are somehow faking the destination url for Google's bot checker to pass the Google checks and then serving different destination urls to users who they believe are not Google bots.

* Google Ads is now the correct branded name. No longer called AdWords as in the title.

Re: Google AdWords Exploit Seen in the Wild

#49

Post by ocdtrekkie » Wed, May 08, 2019, 3:53 PM UTC

I've reported this back in 2017: https://news.ycombinator.com/item?id=13413399 (Though the screenshot was on G+, so RIP.)

It's even been done to youtube.com before! Clicking ads is inherently dangerous, as they are allowed to show URLs which do not reflect the URLs they will actually route you to. You should never click on an ad.

This is a scenario that violates any reasonable convention of good web behavior, but Google won't fix it because the advertisers are how their bills get paid.

Re: Google AdWords Exploit Seen in the Wild

#50

Post by jdironman » Wed, May 08, 2019, 3:54 PM UTC

username223 wrote: post #42

herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

I also think mail clients should do that, or at least offer it as an option. Most mail readers have an option to disable loading remote content, and this would be another little way to make HTML email less dangerous. I think (or at least hope) that most people are in the habit of hovering over links in email before clicking them. And I really hope that mail readers never start implementing Javascript. As for web apps…

Maybe, quite simple have the option to parse tags down to the format "Text - URL". If I remember correctly, some sites from way back had this sort of format occasionally.