Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

61–70 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#61

Post by WrockBro »

Nextgrid wrote: post #18
izacus wrote: post #11

Earlier quoted context omitted.

That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding…

> Why would you want that? If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair. Why shouldn't Google be held to the same standard?

The problem is you have to prove intent to build a legal case. If the person holding a banner doesn't know whatever they're advertising is illegal then they wouldn't be liable. A case could be made if they're informed it's illegal and they continue anyways, but that isn't likely to happen.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#62

Post by cengizIO »

Semaphor wrote: post #29
ryanjshaw wrote: post #27

Earlier quoted context omitted.

FF Android changes it to the ķeepass[.]info form. EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.

I just tried it and… it redirects me to the actual page https://keepass.info/ That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.

Right now, using curl, [ķ]eepass.info redirects to xn--eepass-vbb.info and consequently that redirects to official domain keepass.info.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#63

Post by izacus »

MediumOwl wrote: post #31
izacus wrote: post #11

Earlier quoted context omitted.

That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding…

The malicious website is published on google dot com. It's not unreasonable to require that a website doesn't publish obvious scams. Of course, "obvious" is hard to define precisely.

And why is the website that's pushing malicious scams not punished by the appropriate government mechanism?

That seems to be much more appropriate approach to prevent this kind of crime. Why is US so incompetent at punishing scammers as a country?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#64

Post by izacus »

mschuster91 wrote: post #36
izacus wrote: post #11

Earlier quoted context omitted.

That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding…

> That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Google is a company that nets 60 billion $ a year in profits. They can afford hiring a few thousand people to ma…

They can, but can you afford to be policed and punished by them?

It's kinda bizarre how many here whine about not trusting Google and then just want to give them police powers.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#65

Post by high_5 »

rapind wrote: post #54
rob74 wrote: post #47

Earlier quoted context omitted.

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

ķ does look a lot like screen dirt though. ö not so much.

Yeah it's really frustrating for me to look at it because of such appearance.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#66

Post by JumpCrisscross »

WrockBro wrote: post #61
Nextgrid wrote: post #18

Earlier quoted context omitted.

> Why would you want that? If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair. Why shouldn't Google be held to the same standard?

The problem is you have to prove intent to build a legal case. If the person holding a banner doesn't know whatever they're advertising is illegal then they wouldn't be liable. A case could be made if they're informed it's illegal and they continue anyways, but that isn't likely to happen.

If a billboard starts advertising meth, you obviously go after the meth dealer. But the billboard owner—who painted the ad onto it—should also have liability (albeit civil).

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#67

Post by mlok »

TeMPOraL wrote: post #23

That's a neat trick. I can imagine getting caught by this if I saw the link in non-ad context. The attackers made a smart choice here. Usual Unicode substitutions are something I've learned to spot, because the substituted letters look off , even if a tiny bit. But here? I didn't notice the dot under "k" even with an arrow pointing at it, because to me, it looked like a tiny speck of dust or dirt on the monitor . $de…

I would have fallen like you. But because I use dark mode / a dark theme, this is displayed as a white dot on a black background and does not look like dust on my screen. I clearly see it. It is a white light-emitting pixel, not mistaken with a light-blocking speck of dust similar to a black pixel.

I had never imagined dark mode as a security enhancement :)

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#68

Post by hexmiles »

SenAnder wrote: post #57

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode.

Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#69

Post by avery17 »

eviks wrote: post #41
Stem0037 wrote: post #34

While there's no foolproof way to detect scams like these, there are some proactive steps we can take: 1. Always type in URLs manually when downloading critical software to bypass the potential risks from ads. 2. Make use of browser plugins that identify malicious websites or unverified SSL/TLS certificates. 3. Before making any downloads, inspect the TLS certificate of the website by clicking on the padlock icon nex…

Isn't ignoring ads easier (so 0. Use an adblocker)? How often would a scam rank higher than the legitimate domain? Maybe also 4. use a package manager?

Ads always appear at the top so scams always rank higher than legitimate domains.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#70

Post by Quikinterp »

rob74 wrote: post #47
jasode wrote: post #30

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via…

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

weird because the keepass example, on chrome + android, looks exactly like a regular k in the address bar.
Post reply on HN