Google serving sponsored link to Homebrew site clone with malware
1–10 of 31 posts
Re: Google serving sponsored link to Homebrew site clone with malware
#2[deleted]
Re: Google serving sponsored link to Homebrew site clone with malware
#3Any advice on what to do if you might be a victim to this?
Re: Google serving sponsored link to Homebrew site clone with malware
#4Any advice on what to do if you might be a victim to this?
[deleted]
Re: Google serving sponsored link to Homebrew site clone with malware
#5Any advice on what to do if you might be a victim to this?
Apparently, it was collecting passwords from victim machines. So, step one would be to remove everything the script put onto your machine. Step two would be to change your passwords.
Re: Google serving sponsored link to Homebrew site clone with malware
#6SEO is also damaging the search engines, and IMHO should be considered as a viral activity.
It is not uncommon to find a legitimate software site on the second page of a search, while all the hits on the first page are crap, often with malware added.
Re: Google serving sponsored link to Homebrew site clone with malware
#7Any advice on what to do if you might be a victim to this?
Apparently, it was collecting passwords from victim machines. So, step one would be to remove everything the script put onto your machine. Step two would be to change your passwords.
Step 3 should probably be reinstalling the OS, and restoring data from backup (ideally from before the malicious version was installed).
Re: Google serving sponsored link to Homebrew site clone with malware
#8SEO is also damaging the search engines, and IMHO should be considered as a viral activity. It is not uncommon to find a legitimate software site on the second page of a search, while all the hits on the first page are crap, often with malware added.
It's not even SEO here. It's Google ads from hijacked accounts. You can just run ads on open source software keywords and bam, top result is your malware. Since very few others will advertise on oss.
We had to deal with attacks on freecad and kicad last year via dozens of hijacked AdWords accounts and had to use a back channel at Google to get them removed.
Re: Google serving sponsored link to Homebrew site clone with malware
#9How is it possible that in this screenshot, the URL shown on the sponsored result / ad is "https://www.brew.sh"?
Can a Google search ad display a different value there than the actual origin of the page?
Re: Google serving sponsored link to Homebrew site clone with malware
#10How is it possible that in this screenshot, the URL shown on the sponsored result / ad is " https://www.brew.sh "? Can a Google search ad display a different value there than the actual origin of the page?
I think this came up before in the context of scammy Google ads. Apparently you can set any vanity URL you like to be displayed, which indeed seems like the perfect invitation for scammers if it works without any restrictions.