Patch/Configuration Management, Vulnerability Management

Google sponsored advertising links lead to exploits


A seemingly innocuous Google search could yield malware on advertising result links, security researchers warned this week.

Roger Thompson, CTO of Exploit Prevention Labs, said in a blog post Tuesday that his firm has identified exploits posing as legitimate URLs for the Better Business Bureau and in the "sponsored links" section that appears alongside search results.

Advertisers pay Google for the sponsored links to appear following specific search queries.

Clicking on one of the malicious links, though, takes the user to the real website – but along the way they are unknowingly redirected to, which hosts a Microsoft Data Access Components (MDAC) exploit that attempts to install a backdoor keylogger, said Thompson.

Cybecrooks then use the customized trojans to pilfer banking information from online customers of about 100 targeted banks from around the world, Thompson said. Because the keylogger is delivered as part of a browser-helper object, it "is part of the endpoint of any SSL transaction and can see everything in plain text, instead of encrypted," he said.

There is little unsuspecting users can do to avoid being duped, Thompson said.

"Lots of links in any search engine point to infective sites, so that’s not really a surprise, but this does highlight a significant issue," he said. "When you move the mouse over a normal, organic search result, Google shows you the URL you are about to navigate to if you click. If, however, you mouse over a sponsored result, no URL preview is shown. This means that a user has no clue where they are about to navigate to."

A Google spokesperson could not be reached for comment. But the search giant may have remediated the problem, Thompson said.

Click here to email reporter Dan Kaplan.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.