Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google AdWords Exploit Seen in the Wild

wp.josh.com

Post reply on HN
Print view View original

81–90 of 163 posts

Re: Google AdWords Exploit Seen in the Wild

#81

Post by luckylion »

shkkmo wrote: post #78
frenchy wrote: post #75

Earlier quoted context omitted.

> The use case that this breaks is doing click tracking on links I, personally, would be quite happy for this use case to break.

> I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refin…

> Why? If you don't want to be tracked it is pretty easy to avoid.

If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? And why would the link text look like a URL? I don't see why

  www.ebay.com/viewOrder
makes more sense than

  view your order
.

> Even if it is a password reset email or a email verification email?

Why would you want to share password reset info with a third party? I get the "easy tracking" argument for newsletters (but I'm pretty sure most are not GDPR compliant), but for password reset emails? why?

> Would you be happy if the link just failed to open

Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to.

Re: Google AdWords Exploit Seen in the Wild

#82

Post by luckylion »

sangnoir wrote: post #55
jfk13 wrote: post #6

Earlier quoted context omitted.

Wow. What a impressively dumb "feature".

Online ad campaigns depend on redirects to reconcile clicks and analytics. It is dumb, but if you want to get customers/make money in the ad space, you have to support this.

Sure, but you could make them add a meta tag or upload a validation file to prove they are actually working on behalf of the final URL, just like they do to validate that you're in control of the URL for the webmaster console. If the malicious ad buyer has access to ebay.com's server all bets are off, but I feel like that happens a lot less often than this.

Re: Google AdWords Exploit Seen in the Wild

#83

Post by tolidano »

everything on this page boils down to 2 simple things: 1) google ads should verify domain ownership of destination domains (via webmaster tools, etc) 2) google should expand the "feature" of supporting tracker redirects to allow "final" domain owners to disallow the use of interim clicks (so ebay can simply say: "no, I will always go straight to ebay.com, which I own, and any ad that points to me at any step must also point only to and straight at me")

Re: Google AdWords Exploit Seen in the Wild

#84

Post by seandougall »

arbuge wrote: post #60
nullwasamistake wrote: post #53

Earlier quoted context omitted.

Wow it seems trivial to trick Google's bots with these links. Have the page redirect until ad is approved, profit? I'm sure it's easy to find their bot IP's too. Just make a bunch of terrible ads that nobody will click and see who visits the url. Google needs to abolish this link policy, I don't see how it's enforceable

> Have the page redirect until ad is approved, profit? Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here. >Google needs to abolish this link policy, I don't see how it's enforceable Link analytics and link trackers are perfectly legitimate. There are many situations in which it is necessary or desirable to go via intermediate urls before the final destina…

> Wouldn't work - they do periodic checks after approval. Something more sophisticated appears to be going on here.

What if you randomly redirect, say, 95% of clicks to eBay and take the remaining 5% to your phishing site? Each of Google's periodic checks would only have a 5% chance of catching you, but if you can get enough impressions over eBay's legitimate ads (which is an entirely separate facet to all of this), you'd still get a ton of bites, because so many people get to eBay the way Aunt Sue does.

Better yet, your redirect service could look at the client IP address and only redirect to the phishing site if it matches a known range for, say, Comcast or Charter. Or use it to drill down even farther and set up multiple spear phishing campaigns.

It seems like there's no shortage of ways to abuse this, and for Google to allow redirects without some sort of robust verification that the advertiser owns the destination domain (such as @gnud's certificate-based suggestion in a sibling comment) seems downright negligent, if that is indeed how they operate.

Re: Google AdWords Exploit Seen in the Wild

#85

Post by ariwilson »

ocdtrekkie wrote: post #49

I've reported this back in 2017: https://news.ycombinator.com/item?id=13413399 (Though the screenshot was on G+, so RIP.) It's even been done to youtube.com before! Clicking ads is inherently dangerous, as they are allowed to show URLs which do not reflect the URLs they will actually route you to. You should never click on an ad. This is a scenario that violates any reasonable convention of good web behavior, but Goo…

Isn't this true about any link?

Re: Google AdWords Exploit Seen in the Wild

#86

Post by duxup »

jamescostian wrote: post #71
appleflaxen wrote: post #67

Earlier quoted context omitted.

uh... ok... I'll bite... why do you call it "giving a mouse a cookie"

See https://en.wikipedia.org/wiki/If_You_Give_a_Mouse_a_Cookie "If you give a mouse a cookie, he'll ask for a glass of milk" "If you give a mouse a glass of milk, he'll ask for a straw" And the story keeps going like that, with more and more requests coming in. It's almost like never-ending scope creep, except the book has an infinite loop in it.

There's also an animated series on Amazon now... my youngest loves it.

Re: Google AdWords Exploit Seen in the Wild

#87

Post by shkkmo »

luckylion wrote: post #81
shkkmo wrote: post #78

Earlier quoted context omitted.

> I, personally, would be quite happy for this use case to break. Why? If you don't want to be tracked it is pretty easy to avoid. You should already only be getting/opening emails you care about. Emails you don't care about should be unsubscribed from and reported as spam. Granted that links should only be tracked in email you do care about, why do you not want those people to have the information they need to refin…

> Why? If you don't want to be tracked it is pretty easy to avoid. If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com? And why would the link text look like a URL? I don't see why www.ebay.com/viewOrder makes more sense than view your order . > Even if it is a password reset email or a email verification email? Why would you want to share password reset info with a third party…

> If you want to track clicks, why not use a subdomain instead of something.weird3rdparty.com?

I don't see what relevance a subdomain has here. As the original issue was described, it was blocking any links where the url doesn't match the link text (if the link text is a url). This means that even tracking that is done on the same domain (e.g. example.com/emailTracking/{{unique_string}} redirects to example.com/viewOrder/412) would be blocked.

If you start only blocking those links if the domains don't match, things become more complicated to implement and test, especially once you consider subdomains, etc. The question remains, what is the point of this and is it worth it? Are we really promoting good security practices or just adding security theater cruft?

> Why would you want to share password reset info with a third party?

Who said anything about a third party? As you mention above, this blocks people who are doing their own tracking on the same domain. I don't have any numbers, but I assume that ESPs like MailGun and SendGrid are probably the most common third parties used to track email link clicks (since they will automatically substitute link urls with trackable rediracts if you enable it.) In this case, that third party already has access to the entire content and metadata of the email and giving them link click data is a relatively small addition.

> Why would it? You can put a working link in the email directly - you've proven that by putting a different link in the email than the one you pretend you're linking to.

Email links already work one way, perhaps if Apple implemented this feature eventually every email sender out there would switch to links that would work in Apple mail again. In the mean time, Apple has to deal with confused and dissatisfied users wondering why links in their emails don't work.

How would you implement link url / text mismatch blocking? Have you thought through the consequences for your users and their understanding of security or satisfaction with your product?

Re: Google AdWords Exploit Seen in the Wild

#88

Post by rwmj »

adam1210 wrote: post #24

My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.

If you're in the US[1] you can trademark your project name, and then Google will pay attention. Of course getting a trademark isn't that easy either so the solution may be worse than the problem.

[1] Back when I worked in the business this was only possible in the US, for legal reasons I didn't fully understand.

Re: Google AdWords Exploit Seen in the Wild

#89

Post by amluto »

arbuge wrote: post #48
32032141 wrote: post #4

This is an explicit tool in adwords, believe it or not. The feature is intended so that you can have a link "to" http://trackersRus.com/ which forwards to http://ebay.com/ , without the user seeing that bit of ugly. It's been used in campaigns for years, I've reported probably hundreds of these distributing malware.

It appears here that the redirection to the ebay.com destination url is not happening and that the user ends up on a different domain. That kind of situation is usually detected when ads are entered into the Google Ads* platform for review, with ads then rejected for "destination url mismatch". One thing checked is that the final destination url after all redirects matches what is specified in the ad's final url fiel…

Google's approach here seems totally wrong. The destination URL should be, exactly, the link as shown. If someone wants to track clicks using a third-party tracker, Google should offer an API for that which does not give the third-party tracker any ability to control the destination -- they have plenty of market power to impose this and, heck, they could even charge a small premium.

Most browsers support a lovely feature where the a tag has a ping attribute, which is intended for more or less this use case.

Re: Google AdWords Exploit Seen in the Wild

#90

Post by jonas21 »

blakesterz wrote: post #9

Every once in a while I'll do a search on Google from a browser with no blocker for something like 'ebay' or some other big brand name and I'm always surprised to see that big brand name has bought ads for themselves, it never made sense since they're always the first search result anyways. Now I can only assume two things... 1. Some number of those ads were scams 2. Some large number of people just blindly click on…

> Somewhat related... always surprised to see what search results come up in the IOS app store first for whatever app I'm searching for at the time. It's usually something else, like, search for Uber, first thing that comes up is Lyft.

When this happens it's usually an ad, isn't it? Unfortunately, ad blockers don't work in the app store.

Post reply on HN