Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

21–30 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#21

Post by hn_throwaway_69 »

sccxy wrote: post #9
miohtama wrote: post #2

One solution to mitigate malverising is as transparency. Each as should contain the legal contact details (company name, country) of the advertiser. It does not solve the issue fully, but consumers will surely avoid East European suspicious companies advertising. It will also make it easier for the security researchers to track down bad actors and will bring some liability to the ad platform (Google). Facebook alread…

Why East European are suspicious? Little xenophobic?

It's not xenophobic, it's just realistic.

If you tried to run a fake, malware-laden website in a Western country you would eventually be shut down and prosecuted.

These scams mostly fester in nations with weaker institutions, not just Eastern Europe but also China and India. Their authorities are simply not interested in preventing this kind of unlawful activity.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#22

Post by disillusioned »

I fell victim to a ridiculously stupid and expensive punycode ad scam on Facebook a number of years ago, advertising new antminers. Absolutely idiotic, and infuriating, but the biggest mistake was assuming the likes of Facebook or Google actually reviewed and approved ads and protected its users from this sort of garbage, in addition to simply not noticing the tiniest dot in the address bar.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#23

Post by TeMPOraL »

That's a neat trick. I can imagine getting caught by this if I saw the link in non-ad context. The attackers made a smart choice here. Usual Unicode substitutions are something I've learned to spot, because the substituted letters look off, even if a tiny bit. But here? I didn't notice the dot under "k" even with an arrow pointing at it, because to me, it looked like a tiny speck of dust or dirt on the monitor. $deity knows I have many of those on my screen, and they're the kind of noise visual system is good at ignoring.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#24

Post by entuno »

abfaqb wrote: post #10

1) Use an ad blocker, always. 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? 3) IDN shouldn't be enabled by default.

Yeah, it's really bad that Google don't actually show the proper characters in the URL. It's hard to spot - but at least if they displayed the actual URL then you'd have a chance.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#25

Post by Semaphor »

tialaramex wrote: post #20
Semaphor wrote: post #12

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

The TLD registries are supposed to each have defined rules for IDN which can prohibit abuses and to police the use of your service. If you operate the registry for say, Switzerland, it makes sense to allow what Swiss and maybe German people would want, then forbid everything else. But if you operate .COM or .INFO or .FREE-MONEY or whatever, your goal isn't to help anybody it's to obtain the most money possible withou…

Ah, that is interesting, thank you.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#27

Post by ryanjshaw »

Semaphor wrote: post #12

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

FF Android changes it to the ķeepass[.]info form.

EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#28

Post by noirscape »

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.)

The only place punycode really gets used are spam domains in practice. Even most Cyrillic and Asian domains don't use punycode.

I get the concept of punycode and it is impressive technically but for domains it's just been a massive phishing headache.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#29

Post by Semaphor »

ryanjshaw wrote: post #27
Semaphor wrote: post #12

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

FF Android changes it to the ķeepass[.]info form. EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.

I just tried it and… it redirects me to the actual page https://keepass.info/

That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#30

Post by jasode »

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception.

“Users are first deceived via the Google ad that looks entirely legitimate and then again via a lookalike domain,” Jérôme Segura, head of threat intelligence at security provider Malwarebytes,

Back in 2017, Google Chrome 59 supposedly fixed the Punycode phishing attack. E.g. story: https://www.engadget.com/2017-04-17-google-chrome-phishing-u...

Maybe a dedicated criminal studied the Chromium source code that checks Punycode and noticed a flaw where it would allow 'ķ' in place of 'k' ???

https://www.xn--80ak6aa92e.com/ --> fake "аррӏе.com" triggers phishing warning

https://xn--eepass-vbb.info/ --> fake "ķeepass.info" does not trigger warning

Post reply on HN