Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google AdWords Exploit Seen in the Wild

wp.josh.com

Post reply on HN
Print view View original

151–160 of 163 posts

Re: Google AdWords Exploit Seen in the Wild

#151

Post by larkeith »

suzakus wrote: post #133
IshKebab wrote: post #117

Earlier quoted context omitted.

Second link is broken, and the first is about a different thing (triggering an ad based on a competitor's trademark). Pretending to be a competitor clearly violates trademark law. But I somewhat suspect these fraudsters aren't that concerned with trademark law.

Fixed link for the second page: https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_... .

It looks like HN drops trailing periods at the end of links, which breaks this. Here's a working link (yay URL encodings).

https://en.wikipedia.org/wiki/Rosetta_Stone_Ltd._v._Google,_...

Re: Google AdWords Exploit Seen in the Wild

#152

Post by slantaclaus »

ocdtrekkie wrote: post #49

I've reported this back in 2017: https://news.ycombinator.com/item?id=13413399 (Though the screenshot was on G+, so RIP.) It's even been done to youtube.com before! Clicking ads is inherently dangerous, as they are allowed to show URLs which do not reflect the URLs they will actually route you to. You should never click on an ad. This is a scenario that violates any reasonable convention of good web behavior, but Goo…

Hacker life! NEVER click an ad

Re: Google AdWords Exploit Seen in the Wild

#153

Post by azinman2 »

Godel_unicode wrote: post #147
TeMPOraL wrote: post #130

Earlier quoted context omitted.

I'm partial to a simpler and complete solution: just always force display of href text on hyperlinks, ignoring the markup that's between and . Nothing good comes from displaying the text/image instead of the actual URL; at best it's used (usually overused) for extra aesthetic touch that's not otherwise useful, at worst it's used by advertisers and scammers to lie to people about the link's destination (tracking links…

I guarantee you that I can craft URLs users will click even if the whole URL is exposed. This "solution" makes developers feel better but provides essentially zero additional security.

Can you give an example? And will it never help?

I think it’s silly to argue against this. It’s like saying “computer security is hard so why bother at all.”

It’s a continued arms race, where you continue to make things harder and harder. This strategy is working the rate at which people are hacked on platforms like iOS is a fraction of what it used to be like for general computing. There will always be security holes, but you plug them as you find them just as you create mitigation’s against classes of problems to the best of your ability. Why make it easy for the attacker?

Re: Google AdWords Exploit Seen in the Wild

#154

Post by boomlinde »

nullwasamistake wrote: post #137

We should fix this with a new HTTP header. Browsers can verify that "expect redirect on next request" ends with the correct destination domain. It would be relatively simple for browsers to implement. Google can set this on the headers for outgoing redirect link they already use for AdWords and search results. It would simply make sure that after all the 30X redirects, you actually land on the expected domain. I can'…

Google could just display the actual link target on their ads. I'm vehemently against standardizing an HTTP header just to facilitate their continued lying about where their ad links lead. Of course, a user may think twice about loading a link to redirect service when they see the actual URL, and Google wouldn't want that, but that really is their problem.

It's sad that we don't hold one of the largest tech companies in the world directly accountable for linking users to phishing scams from spots they've sold to third parties. Instead we discuss how an HTTP header could make it easier for them to lie. Meanwhile, they get paid for facilitating scams.

> It would be widely useful even outside of ad-tech, when you need redirects for country specific subdomains for instance.

I don't see how that is the case. If I own the hosts and names involved, I know where my links and redirects between the two lead and don't need the client to ensure that it's correct.

Re: Google AdWords Exploit Seen in the Wild

#155

Post by tialaramex »

gknoy wrote: post #125
tialaramex wrote: post #101

Earlier quoted context omitted.

For the latter, as one of my sibling posts points out the user will go "Huh, stupid password manager didn't fill out my password - I'll have to do it manually". Often the password manager even helps them do this in the name of user convenience. Only Brick wall UX works. That's what WebAuthn does here. Don't offer the user a way to "continue anyway", don't ask them confusing questions, just a brick wall and no way for…

Can you elaborate on what "brick wall UX" is like to use as a user, or how one implements it? Are there known examples you could point me at? (It's a term I haven't heard before, and haven't noticed anything when searching.)

I gave the best example around today already: WebAuthn. Its ancestor U2F has the same behaviour.

The credentials in these protocols depend explicitly on the verified FQDN of the server (and thus you can only use this with HTTPS). When scammer.example asks for your credentials there literally isn't a way to give it credentials for realbank.example. No matter how sure you are that you're a very smart person and definitely need to give scammer.example access to empty your bank accounts, no way to do this is available. Maybe next week you'll still be angry you couldn't do this, maybe you'll realise it was a scam, don't care.

This is why Google reports zero successful phishing for their own systems. U2F is mandatory there. Their employees aren't magical, some will fall for scammer.example and they will be really frustrated that they can't use their Google login like it says, and some will scream at their help desk team about how stupid this is, how it's totally broken, and even after they demand that the help desk person be fired and they change their password six times and write a ten page rant on their blog they still can't give their employee credentials to the scammer and Google remains safe.

Re: Google AdWords Exploit Seen in the Wild

#156

Post by boomlinde »

jordansmithnz wrote: post #120
32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

I wonder why Google doesn’t follow the redirect, and ensure the followed link matches the displayed link? I get that there’s workarounds like changing the redirect after Google checks it, but there’s solutions to this too (like running checks every so often to ensure the link redirects to the same domain).

Possibly the checks are identifiable by User-agent, Referer, client address, timing etc.

For this purpose there's a lot of room for false positives. It doesn't matter if some actual users actually get redirected to ebay.

Re: Google AdWords Exploit Seen in the Wild

#157

Post by boomlinde »

Godel_unicode wrote: post #150
kevin_thibedeau wrote: post #102

Earlier quoted context omitted.

They should just collect stats on their own servers.

This might come as a surprise to you, but every company doesn't have infinite developer time to reinvent things which already exist.

Then they should be held accountable for their choice not to vet ads they send to their users. If this was enforced legally, a bunch of companies would suddenly be able to invest the "infinite time" required to register a damn click.

Re: Google AdWords Exploit Seen in the Wild

#158

Post by Annatar »

English in that scam is so bad. It matches South Asia profile. I hear it every day. Exact same bad grammar and 100% identical broken sentence structure pattern. It is pathological.

If I were to scam people I'd do my homework. But the infamous "just do the minimum of a minimum" quality issues that region is so notorious for are present even in scams.

Re: Google AdWords Exploit Seen in the Wild

#159

Post by TeMPOraL »

Godel_unicode wrote: post #149
TeMPOraL wrote: post #132

Earlier quoted context omitted.

I don't think it's a known term; it seems something GP created. As for how it works, the concept is simple: if the user wants to do the wrong or potentially insecure thing, just don't let them , period. That's the brick wall. I'm of two minds about this personally. On the one hand, I appreciate the argument that the only thing that can prevent businesses from doing something bad, stupid or abusive is if it's legally,…

> as a pro user, I do appreciate the ability to override software when it mistakenly tries to prevent me from doing something. This is really the core problem in security; the world is designed for people like this by people like this, without any serious thought for the implications for the overwhelming majority of users. Do not include "I know what I'm doing" escape hatches, and security will magically get better f…

Sure. That's why I'm not too big a fan of security. The flip side of your observation is this: the most secure form of computing is a rock. You can ensure users can't be pwnd and can't selfpwn themselves by making the device as useless as possible.

Let's give every user a tablet that has two buttons. You press one, you get a new cat picture. Press the other to "like it". That's all the user needs. All data exchange is end-to-end encrypted from the cat picture provider to tablet's input&video drivers - can't risk the spooks^Wcompetition knowing what they're looking at. They don't need to do banking - like everywhere else, they just sign a three-party contract with the tablet provider and the bank. This way, the Bad Guys can't steal users' money! Oh, the users also want to watch pictures of squirrels? There's a separate tablet for that pulling from separate provider; it's insecure to let these mix on one device!

Seriously, this is how the world would look like if security got its wish. There is a point past which security is essentially enslavement, and that's true both in physical security and computer security.

Re: Google AdWords Exploit Seen in the Wild

#160

Post by boomlinde »

llamataboot wrote: post #104

I feel like all the technical arguments here are besides the point. The ad is designed to take you to a page, which tells you a lie, to convince you to give them your money. We already have a legal term for people that make money by misrepresenting something, it's called fraud. Sure, you can tell me it will still be a cat or mouse game and that laws aren't gonna reach into whatever sort of clickfarm network exists fa…

Google are in complete control of the links on their web pages, so why shouldn't they be held accountable for it? Is there a reasonable argument against this that doesn't again boil down to technicalities? If they're paid money by fraudsters to facilitate the fraud and actively misrepresent the addresses of their links, they're in on it, as far as I'm concerned.
Post reply on HN