Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

51–60 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#51

Post by noirscape »

WhyNotHugo wrote: post #44
noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

> Punycode is of questionable use anyway Lots of people might want to register their name, or the name of their city, etc. These all sound like valid use cases. You could say that anything beyond ascii is of questionable use, but non-English natives will always digress.

I know these usecases. In practice, people will still just romanize their name or the name of their city to the Latin alphabet anyway.

The reality is that Unicode is great for communication in say, text messages but terrible for identifiers. People in non-latin countries know this; there's a reason that there's only six countries (from what I can tell) that went with punycode TLDs while there are many more countries with unique alphabets and most of those punycode TLDs see very limited use to begin with. (The most popular being the one used by the Russian Federation, which is also the only entity to forbid using non-cyrillic characters in it's domain names).

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#52

Post by sccxy »

hn_throwaway_69 wrote: post #21
sccxy wrote: post #9

Earlier quoted context omitted.

Why East European are suspicious? Little xenophobic?

It's not xenophobic, it's just realistic. If you tried to run a fake, malware-laden website in a Western country you would eventually be shut down and prosecuted. These scams mostly fester in nations with weaker institutions, not just Eastern Europe but also China and India. Their authorities are simply not interested in preventing this kind of unlawful activity.

Google is US based company, when we will see "eventually be shut down and prosecuted" for spreading malware?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#53

Post by jve »

hn_throwaway_69 wrote: post #21
sccxy wrote: post #9

Earlier quoted context omitted.

Why East European are suspicious? Little xenophobic?

It's not xenophobic, it's just realistic. If you tried to run a fake, malware-laden website in a Western country you would eventually be shut down and prosecuted. These scams mostly fester in nations with weaker institutions, not just Eastern Europe but also China and India. Their authorities are simply not interested in preventing this kind of unlawful activity.

Can you somehow quantify it or is it your gut feeling? Any articles out there?

I don't know if they catch small fish as in this example, it just isn't in the news. The bigger fish happens to be in the news, like shutting down international scam call center - 2 in LV, 1 in LT. Video from police cam if anyone wants to see smashing windows: https://www.vp.gov.lv/lv/jaunums/verieniga-starptautiska-ope...

We are also being educated in many places including schools, government institutions, posters, jobs etc about the risks, about how scammers work and stuff like that.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#54

Post by rapind »

rob74 wrote: post #47
jasode wrote: post #30

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via…

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

ķ does look a lot like screen dirt though. ö not so much.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#55

Post by tidenly »

jve wrote: post #39

Why doesn't that sponsored ad show www.ķeepass.info? I only see the screenshot from browser where it shows that speck of dust there.

Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually.

Attackers exploit this by first using a genuine domain to get the ad approved, and then altering the info after the campaign starts. I saw a similar attack like this on twitter a month or so ago.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#56

Post by GoblinSlayer »

makeitdouble wrote: post #49
noirscape wrote: post #28

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The…

One of the issue with ascii domains is the phonetic mapping for CJK languages. For instance right not asahi.com is taken by 朝日 (Asahi shibun, the newspaper), thus the Asahi town (旭) cannot use it. Mind you, the town could take asahi-town.co.jp or something like that, but there is other Asahi towns and places with different writings (including 旭日, 朝陽、浅緋 etc.) Wanting all of them to have some random ascii diversificati…

Ambiguity exists in all languages, e.g. what mail.com refers to?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#57

Post by SenAnder »

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#58

Post by Semaphor »

369548684892826 wrote: post #48
Semaphor wrote: post #12

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

Firefox about:config check your setting for the network.IDN_show_punycode flag. I've just set this to true myself to prevent this kind of spoofing.

You are correct, I have that set to the non-default true. Probably from some other time a punycode attack was in the news ;)

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#59

Post by yorwba »

noirscape wrote: post #51
WhyNotHugo wrote: post #44

Earlier quoted context omitted.

> Punycode is of questionable use anyway Lots of people might want to register their name, or the name of their city, etc. These all sound like valid use cases. You could say that anything beyond ascii is of questionable use, but non-English natives will always digress.

I know these usecases. In practice, people will still just romanize their name or the name of their city to the Latin alphabet anyway. The reality is that Unicode is great for communication in say, text messages but terrible for identifiers. People in non-latin countries know this; there's a reason that there's only six countries (from what I can tell) that went with punycode TLDs while there are many more countries…

There's quite a lot more than just six countries with punycode country-code TLDs https://en.wikipedia.org/wiki/Country_code_top-level_domain#...

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#60

Post by ykonstant »

mschuster91 wrote: post #35
abfaqb wrote: post #10

1) Use an ad blocker, always. 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? 3) IDN shouldn't be enabled by default.

> 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? Because advertisers usually want to send links to a tracker site of their own first so that they can verify if their numbers match up with what Google reports. No one trusts anyone in the advertising space, and for good reasons. Advertising has always been a space filled to the brim…

>Advertising has always been a space filled to the brim with crooks and fraudsters.

If I ever work at a cubicle, I will hang this sentence on a large frame over my desk, then stay silent and stare every time someone comes and complains about my ad blockers.

Post reply on HN