Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google AdWords Exploit Seen in the Wild

wp.josh.com

Post reply on HN
Print view View original

71–80 of 163 posts

Re: Google AdWords Exploit Seen in the Wild

#71

Post by jamescostian »

appleflaxen wrote: post #67
syn0byte wrote: post #65

Earlier quoted context omitted.

Sounds reasonable only if the text is a URI handler format; http:// file:// ftp:// steam:// etc. But then what about almost-uri text. www.yourbank.com without the https:// . Or lookalikes "https:\\" or... what about proxies? does https://l33th4x.com?proxy=www.bank.com count if the text is www.bank.com? Filtering crap like this sounds reasonable but very quickly becomes an exercise in what I call "Giving a mouse a coo…

uh... ok... I'll bite... why do you call it "giving a mouse a cookie"

See https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie

"If you give a mouse a cookie, he'll ask for a glass of milk"

"If you give a mouse a glass of milk, he'll ask for a straw"

And the story keeps going like that, with more and more requests coming in. It's almost like never-ending scope creep, except the book has an infinite loop in it.

Re: Google AdWords Exploit Seen in the Wild

#72

Post by mikeash »

jlarocco wrote: post #68
herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

I'm agreeing with the "no" votes here. It's extra work and testing complexity for a one off case that's trivially avoided by spammers. And where do you draw the line? Should it flag a link with text "htp://ebay.com" that goes somewhere else? "ebay" with a href somewhere else? There's no technical workaround to educating users.

Sandboxing to prevent malware installation and password managers to prevent phishing are excellent technical workarounds for this.

Re: Google AdWords Exploit Seen in the Wild

#73

Post by vorticalbox »

shkkmo wrote: post #62
herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

> the mail client to check that, if the text of an tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them…

Yeah but that's annoying and almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok.

I mean can you honestly tell you read the Google privacy notice or do you just click the down arrow till the ok box appears?

Re: Google AdWords Exploit Seen in the Wild

#74

Post by tomc1985 »

arbuge wrote: post #60
nullwasamistake wrote: post #53

Earlier quoted context omitted.

Wow it seems trivial to trick Google's bots with these links. Have the page redirect until ad is approved, profit? I'm sure it's easy to find their bot IP's too. Just make a bunch of terrible ads that nobody will click and see who visits the url. Google needs to abolish this link policy, I don't see how it's enforceable

> Have the page redirect until ad is approved, profit? Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here. >Google needs to abolish this link policy, I don't see how it's enforceable Link analytics and link trackers are perfectly legitimate. There are many situations in which it is necessary or desirable to go via intermediate urls before the final destina…

Perhaps letting the ad people have a free-for-all with tech is a bad idea. I feel like intermediate URLs should never be OK

Re: Google AdWords Exploit Seen in the Wild

#75

Post by frenchy »

shkkmo wrote: post #62
herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

> the mail client to check that, if the text of an tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them…

> The use case that this breaks is doing click tracking on links

I, personally, would be quite happy for this use case to break.

Re: Google AdWords Exploit Seen in the Wild

#76

Post by cesarb »

herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

At least Thunderbird seems to do that: when an email has an tag with text that looks like a URL but doesn't match the href, it throws the "this email is probably a scam" bar above the message.

Re: Google AdWords Exploit Seen in the Wild

#77

Post by inodeman »

I also have seen deceptive ads. One time I searched for Ripple (XRP) and saw an add saying Google had partnered with Ripple Labs and they were giving away free XRP, basically you had to send x amount of XRP and you would get twice that amount, plus as XRP increased the money could 3x or 4x. The worst thing is that it claimed to come from google.ca or google.de I can´t remember.

Re: Google AdWords Exploit Seen in the Wild

#78

Post by shkkmo »

frenchy wrote: post #75
shkkmo wrote: post #62

Earlier quoted context omitted.

> the mail client to check that, if the text of an tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them…

> The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.

> I, personally, would be quite happy for this use case to break.

Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refine and improve these emails so they can better serve and inform you?

I would assume that happiness depends on how this use case is broken.

Would you be happy if the email just doesn't show up or gets shunted to spam? Even if it is a password reset email or a email verification email?

Would you be happy if the link just failed to open, forcing you to copy and paste the link text manually? Why not just do that on your own anyway? No need to have the email client block this for everyone just to suite your tastes.

This leaves us with just the behavior I mentioned above and my argument against it.

Re: Google AdWords Exploit Seen in the Wild

#79

Post by shkkmo »

vorticalbox wrote: post #73
shkkmo wrote: post #62

Earlier quoted context omitted.

> the mail client to check that, if the text of an tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them…

Yeah but that's annoying and almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok. I mean can you honestly tell you read the Google privacy notice or do you just click the down arrow till the ok box appears?

> Yeah but that's annoying

Yes it is annoying. My point is if you want to be annoying, you should be annoying the user when they visit ANY external links as trusting the link text isn't a practice that should taught/encouraged.

> almost every one who isn't "techy" for lack of a better term won't even bother reading it and just press ok.

That depends on how short and well worded the alert is. However, there is certainly an attention budget that can be used up with pointless / low value alerts (which is why I would assume that Apple did not go this route).

Re: Google AdWords Exploit Seen in the Wild

#80

Post by __jal »

32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

Yep. This is why you never click on ads, period.
Post reply on HN