Malicious Google Search Ads can now fake the displayed URL to push malware downloads
Malicious Google Search Ads can now fake the displayed URL to push malware downloads
Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.
If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.
Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!
You're viewing a single thread.
Presumably you can hover over the link to see the actual URL (which I think is best practice anyway), or is it more sophisticated than that?
AFAIK even legitimate ad clicks will first direct to an analytics platform before redirecting to the destination site, so that they can track click through rates and where the referral came from. So it is unlikely that ad links will actually go to the website you expect them to even in normal scenarios. It is actually this mechanism that the malicious ads described in the article are using to fake the display URL.
I would always out of habit avoid any links that go to somewhere other than the advertised destination - so if it goes to an analytics platform I would copy and paste the text if the text of the link is a URL, or find an alternative. Always hovering links and being absolutely sure of where they go should really be taught as standard practice.
I always check the status bar but I actually noticed the other day on LinkedIn or maybe Facebook, that the status bar said one thing, but the link was different,
E.g the hover over said https://website.com but the actual link was something like https://linkedin.com/linkout/wbdjdhgaj?user=xhedb
That type of thing is concerning. What browser are you using out of interest?
Sorry for the slow reply, but it was a link on LinkedIn and I'm using chrome. It's frustrating as I use the status bar to check the link is the same as the text before clicking it.
If the link shown in the status bar is different from where it takes you then that's very malicious on the part of the browser. I simply suggest just using Firefox, it's not owned by an advertising company and I've never known it to do something like that.
Just double checked and this also happens in Firefox. I think the other user in this thread has explained it well, looks like a JavaScript intercept onClick to prevent the link action and instead call a JavaScript function to open a different link.
In this case it is built into the site so I guess it is OK on the basis that I am trusting LinkedIn to not do anything malicious but it was more the principle as I had previously looked at the status bar to confirm the link was what I was expecting but in the future I will be more wary. Interestingly, right clicking and selecting "copy link" does actually copy the page which is loaded as opposed to the one on the status bar.
If you have linkedin it seems to be links in direct messages if you would like to see yourself.
That's trivial to do where you control the link text. For example: https://www.google.com/
Sorry, I don't mean the link text itself, but the destination shown in the status bar in the bottom left of my desktop browser.
Yeah that shouldn't be possible on a platform like LInkedin or Facebook. If it's a site you control, though, it's still easy. I can't do it here (at least I hope I can't) but here's an example of it: https://jsfiddle.net/z2pLaxto/1/
Yes, that looks exactly like what is happening. For clarity though it is a LinkedIn script not one uploaded by a 3rd party.
It seems to apply to links sent in direct messages which are routed through a linkedin internal page, I assume so they can track you out etc.
It was more the principal of it though, I hadn't considered that the link shown in the status bar could not be the link you would be taken to if you click it but I guess that's part of allowing javascript to run.