Google sponsored links caught punting malware
Click here to get pwned
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Researchers from Websense have caught Google carrying ads punting rogue software that secretly installs malware on the PCs of its users.
Recent Google searches for Winrar turned up sponsored links that offer a "spyware free" copy of the widely used data-compression application. Google users unfortunate enough to download and install that software are soon exposed to a program that makes changes to their PC's hosts file. From then on, every time the users try to visit Google, Yahoo, and other popular sites, they are instead sent to an impostor site under the control of the attackers.
The operation is another testament to the resourcefulness of those running rogue software scams. Rather than relying on zero-day vulnerabilities or hard-to-execute website hijackings, they often find it easier to snare their victims through legitimate ads placed on Google or elsewhere.
"This raises some questions," Websense researcher Elad Sharf writes. "Is this problem Google's fault for not checking whether advertised links actually serve malware? Is it the miseducated user's fault for getting infected?"
Probably a little of both, but are we the only ones who find it ironic that Google's own anti-malware initiative imposes draconian punishments on smaller websites when they're caught doing the same thing? Websense, which first witnessed the scam last week, said the malicious Google links were still available when it posted this report on Sunday.
A Google spokesman said the company is in the process of removing the offending sites from its ad network. "Google is committed to ensuring the safety and security of our users and our advertisers," he said.
As a recent complaint filed by Federal Trade Commission shows, purveyors of rogue anti-virus and other software spend millions of dollars per year advertising their wares on legitimate sites - and go to great lengths to conceal their behavior. No doubt, Google isn't the only advertiser to be tricked into running malevolent ads, but as the do-no-evil company that's steam-rolling its competition in the ad industry, it's hard to believe these kind of links are still being sponsored. ®
COMMENTS
@Bob
You'd be amazed. Most people don't know how to configure their system and indeed run as administrator. Even in corporate environments where one of two things happen:
1) Lazy admin find it easier that way
2) Pompous management insists they have admin rights, and the culture of demanding it flows down to everyone on a higher grade than the underpaid and underavalued administrators who have to kowtow.
The real joke is all the people who thought they were so clever in turning UAC off on Vista and then running as Admin because UAC was "a pain". A number of chickens are coming home to roost now on that one. This latest IE flaw is a case in point.
Been going for years
Try googling Antivirus 360, 3 of the 4 offerings on Sunday were for the scumware itself. For those who aren't yet aware, AntiVirus 360 is -more or less- the new incarnation of those old favorites AntiVirus XP, 2008 & 2009. Staples.com even offered to sell you a copy. Google updated it now, but still, it shows a cash first, then check it philosophy from Google which, to be fair, they've always had.
Is it really that simple?
The trojan changes the hosts file? How? On any system (non-Windows) I've ever used the hosts file is not writable by a lowly user. So how does this work? Are people at risk using versions of Windows that don't have this simple protection? Are they logged in as "administrator"? Do downloads run with extra privileges? What?
I accept that all systems have security holes but if it is really that simple to punch through a Windows system it's no bloody wonder they are such a problem.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
