this post was submitted on 14 Sep 2023
193 points (98.5% liked)

Technology

34912 readers
113 users here now

This is the official technology community of Lemmy.ml for all news related to creation and use of technology, and to facilitate civil, meaningful discussion around it.


Ask in DM before posting product reviews or ads. All such posts otherwise are subject to removal.


Rules:

1: All Lemmy rules apply

2: Do not post low effort posts

3: NEVER post naziped*gore stuff

4: Always post article URLs or their archived version URLs as sources, NOT screenshots. Help the blind users.

5: personal rants of Big Tech CEOs like Elon Musk are unwelcome (does not include posts about their companies affecting wide range of people)

6: no advertisement posts unless verified as legitimate and non-exploitative/non-consumerist

7: crypto related posts, unless essential, are disallowed

founded 5 years ago
MODERATORS
 

Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.

If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.

Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!

all 27 comments
sorted by: hot top controversial new old
[–] dan1101@lemm.ee 61 points 1 year ago (1 children)

Businesses should not be allowed to serve ads from random people without curating/checking them first. Yeah it would be a lot of trouble and cost a lot of money, too fucking bad you are making billions of dollars off this.

[–] ipkpjersi@lemmy.ml 18 points 1 year ago (1 children)

Yeah seriously, they can and should have a team dedicated to approving ads.

[–] dan1101@lemm.ee 18 points 1 year ago (2 children)

And if False Advertising is a crime in print media, why is malware advertising not also a crime?

[–] ipkpjersi@lemmy.ml 13 points 1 year ago (1 children)

It probably is a crime, but large corporations don't have to care about crimes because they can just pay the fines and be on their way like nothing happened. It's no more of an inconvenience to them than just a small mosquito landing on them.

[–] dan1101@lemm.ee 5 points 1 year ago* (last edited 1 year ago) (1 children)

If False Advertising in web/app ads started being prosecuted, the whole Internet economy would be devastated. Would probably be thousands of dollars per violation. Just think of all the scummy ads that appear on news sites or in apps. I even consider those "Download Now" button type ads to be false advertising, they are trying to look like part of the page they are served on, they don't even tell you what you're downloading.

[–] ipkpjersi@lemmy.ml 1 points 1 year ago (1 children)

I think there's a difference between scummy ads like false advertising which is obviously bad, and downright malicious software which it sounds like the ad OP is talking about serves actual malware.

[–] Ferris@infosec.pub 1 points 1 year ago

You may find such things in similar contexts, though I would believe that an ad service willing to serve either would hammer you faster for malicious payloads than confusing download advertisement misdirects.

I should probably read the article. If the title isn't misleading, it is possible to use google referral urls as a masking service and pay for visibility on the link :/

[–] Landrin201@lemmy.ml 7 points 1 year ago

Because Google has gotten the law steuctured such that THEY aren't liable for false advertisements they host and serve.

If I posted an ad that was blatantly false on Google, legally I'm the one liable, not Google.

It's ass backwards, Google should be on the hook for this and should have to curate advertisements. Especially when so any of them are not just fake but are openly malicious

[–] reddig33@lemmy.world 27 points 1 year ago

Google search has become such garbage.

[–] 30p87@feddit.de 15 points 1 year ago

Google/big tech: Why are people using adblockers? We will block you!
Also them:

[–] kevincox@lemmy.ml 14 points 1 year ago

This has been a feature of Google Ads forever. It isn't even "found a way" it is just a box to fill in the ad manager.

Presumably this is so that they can use tracking links to analyze the performance of the ad without making the URL "ugly". But it is easy to abuse. (Although I think Google attempts to do some checks, but of course those are always going to be unreliable.)

[–] Mane25@feddit.uk 4 points 1 year ago (2 children)

Presumably you can hover over the link to see the actual URL (which I think is best practice anyway), or is it more sophisticated than that?

[–] drspod@lemmy.ml 9 points 1 year ago (1 children)

AFAIK even legitimate ad clicks will first direct to an analytics platform before redirecting to the destination site, so that they can track click through rates and where the referral came from. So it is unlikely that ad links will actually go to the website you expect them to even in normal scenarios. It is actually this mechanism that the malicious ads described in the article are using to fake the display URL.

[–] Mane25@feddit.uk 4 points 1 year ago

I would always out of habit avoid any links that go to somewhere other than the advertised destination - so if it goes to an analytics platform I would copy and paste the text if the text of the link is a URL, or find an alternative. Always hovering links and being absolutely sure of where they go should really be taught as standard practice.

[–] WUED@lemmy.world 0 points 1 year ago (2 children)

I always check the status bar but I actually noticed the other day on LinkedIn or maybe Facebook, that the status bar said one thing, but the link was different,

E.g the hover over said https://website.com but the actual link was something like https://linkedin.com/linkout/wbdjdhgaj?user=xhedb

[–] Mane25@feddit.uk 3 points 1 year ago (1 children)

That type of thing is concerning. What browser are you using out of interest?

[–] WUED@lemmy.world 1 points 1 year ago (1 children)

Sorry for the slow reply, but it was a link on LinkedIn and I'm using chrome. It's frustrating as I use the status bar to check the link is the same as the text before clicking it.

[–] SheeEttin@lemmy.world 1 points 1 year ago (2 children)

That's trivial to do where you control the link text. For example: https://www.google.com/

[–] PipedLinkBot@feddit.rocks 1 points 1 year ago

Here is an alternative Piped link(s):

https://www.google.com/

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source, check me out at GitHub.

[–] WUED@lemmy.world 1 points 1 year ago (1 children)

Sorry, I don't mean the link text itself, but the destination shown in the status bar in the bottom left of my desktop browser.

[–] SheeEttin@lemmy.world 1 points 1 year ago (1 children)

Yeah that shouldn't be possible on a platform like LInkedin or Facebook. If it's a site you control, though, it's still easy. I can't do it here (at least I hope I can't) but here's an example of it: https://jsfiddle.net/z2pLaxto/1/

[–] WUED@lemmy.world 1 points 1 year ago

Yes, that looks exactly like what is happening. For clarity though it is a LinkedIn script not one uploaded by a 3rd party.

It seems to apply to links sent in direct messages which are routed through a linkedin internal page, I assume so they can track you out etc.

It was more the principal of it though, I hadn't considered that the link shown in the status bar could not be the link you would be taken to if you click it but I guess that's part of allowing javascript to run.

[–] Flaky@iusearchlinux.fyi 3 points 1 year ago

Had this happen searching for Argos (a large British retailer). The sponsored result sent me to a survey scam that cloned the Argos site, quickly reported it.