Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google AdWords Exploit Seen in the Wild

wp.josh.com

Post reply on HN
Print view View original

121–130 of 163 posts

Re: Google AdWords Exploit Seen in the Wild

#121

Post by mobjack »

shkkmo wrote: post #62
herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

> the mail client to check that, if the text of an tag was a url, that the text matched the href field. The use case that this breaks is doing click tracking on links using redirects from a unique url to the actual url (which would be the url displayed in the link text). To avoid breaking this use case, the best remedy would be to prompt the user with a security warning upon clicking a mismatched link prompting them…

Email marketers would just stop having text in tags that dont look like URLs to get around it. They already do that anyways for the most part.

Phishing attempts will mimic real emails, so they will do the same.

Re: Google AdWords Exploit Seen in the Wild

#122

Post by degenerate »

kbenson wrote: post #31
holmberd wrote: post #14

Earlier quoted context omitted.

They have some rules in place, try bidding on Fortnite.

I imagine that might be in response to the malware advertising that was going on for fortnite a while back, and how quite a large proportion of the players are kids. As a highly visible brand and a highly vulnerable audience, it makes sense for them to focus efforts there and put in special rules.

I think you are correct in why they put the extra effort in, but the criticism is they should be doing this anyway, for all the ads. Not just because the target audience for a specific keyword is more vulnerable to scams.

Re: Google AdWords Exploit Seen in the Wild

#123

Post by anon4242 »

gnud wrote: post #57
32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

I've had this problem on Facebook. I've reported some ads for various (relatively benign) scams for herbals and the like, that use a famous newspaper as 'their url', when they have nothing to do with it. Facebook closed my report as 'not against ad policy'. Anyway, this is actually easily fixed without losing tracking/campaign flexibility, by requiring ad orders to be signed by a certificate valid for the target doma…

> Facebook closed my report as 'not against ad policy'.

Heh, makes you wonder, what's the ad policy? Sounds like: 'They pay us money, so must be legit?'

Re: Google AdWords Exploit Seen in the Wild

#125

Post by gknoy »

tialaramex wrote: post #101
mikeash wrote: post #72

Earlier quoted context omitted.

Sandboxing to prevent malware installation and password managers to prevent phishing are excellent technical workarounds for this.

For the latter, as one of my sibling posts points out the user will go "Huh, stupid password manager didn't fill out my password - I'll have to do it manually". Often the password manager even helps them do this in the name of user convenience. Only Brick wall UX works. That's what WebAuthn does here. Don't offer the user a way to "continue anyway", don't ask them confusing questions, just a brick wall and no way for…

Can you elaborate on what "brick wall UX" is like to use as a user, or how one implements it? Are there known examples you could point me at? (It's a term I haven't heard before, and haven't noticed anything when searching.)

Re: Google AdWords Exploit Seen in the Wild

#126

Post by albertgoeswoof »

ocdtrekkie wrote: post #91
ariwilson wrote: post #85

Earlier quoted context omitted.

Isn't this true about any link?

No. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for…

You’re wrong about being able to trust standard anchor links- you can’t. You can intercept the click using an onclick handler and redirect the user to wherever you want.

Viglink and Skimlink do this for affiliate programs, which is somewhat legitimate.

Re: Google AdWords Exploit Seen in the Wild

#127

Post by ndiscussion »

ocdtrekkie wrote: post #91
ariwilson wrote: post #85

Earlier quoted context omitted.

Isn't this true about any link?

No. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for…

They detect a left-click and in the click handler they replace the href, so it's impossible to see before navigating.

Pretty evil huh?

Re: Google AdWords Exploit Seen in the Wild

#128

Post by nullwasamistake »

arbuge wrote: post #60
nullwasamistake wrote: post #53

Earlier quoted context omitted.

Wow it seems trivial to trick Google's bots with these links. Have the page redirect until ad is approved, profit? I'm sure it's easy to find their bot IP's too. Just make a bunch of terrible ads that nobody will click and see who visits the url. Google needs to abolish this link policy, I don't see how it's enforceable

> Have the page redirect until ad is approved, profit? Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here. >Google needs to abolish this link policy, I don't see how it's enforceable Link analytics and link trackers are perfectly legitimate. There are many situations in which it is necessary or desirable to go via intermediate urls before the final destina…

There's other ways to signal ad impressions that aren't a huge security risk. Maybe not quite as convenient, but I doubt banning redirects would have a measurable effect as long as Google gave a deprecation warning.

You can achieve the same thing without redirects using URL parameters or the referer field. Google should ban any destination that doesn't match the sites domain. It's an unfixable security risk that's being actively exploited

Re: Google AdWords Exploit Seen in the Wild

#129

Post by ndiscussion »

albertgoeswoof wrote: post #126
ocdtrekkie wrote: post #91

Earlier quoted context omitted.

No. If you hover over a link in your web browser, regardless of what it says on the link, the hover text (often appearing at the bottom left of your web browser) should show you the real, full destination URL. Try hovering over any link in HN, and you'll see the URL you're going to actually go to when you click on it. However, when you hover over a Google Ads link, it does not do this. It shows you a friendly URL for…

You’re wrong about being able to trust standard anchor links- you can’t. You can intercept the click using an onclick handler and redirect the user to wherever you want. Viglink and Skimlink do this for affiliate programs, which is somewhat legitimate.

We posted at the same time, you're right. Disabling js fixes this (and so many other problems)

js websites cannot be trusted

Re: Google AdWords Exploit Seen in the Wild

#130

Post by TeMPOraL »

jlarocco wrote: post #68
herodotus wrote: post #39

When I worked at Apple I filed a Radar (bug-report) asking for the mail client to check that, if the text of an tag was a url, that the text matched the href field. What followed, on the Radar, was a lengthy debate about this. If I recall correctly, the people who opposed basically argued that, if this feature was implemented by the mail client, spammers would simply find another way to inject false links. We (those…

I'm agreeing with the "no" votes here. It's extra work and testing complexity for a one off case that's trivially avoided by spammers. And where do you draw the line? Should it flag a link with text "htp://ebay.com" that goes somewhere else? "ebay" with a href somewhere else? There's no technical workaround to educating users.

I'm partial to a simpler and complete solution: just always force display of href text on hyperlinks, ignoring the markup that's between and . Nothing good comes from displaying the text/image instead of the actual URL; at best it's used (usually overused) for extra aesthetic touch that's not otherwise useful, at worst it's used by advertisers and scammers to lie to people about the link's destination (tracking links and phishing).
Post reply on HN