Attacks/Breaches

11/1/2016
12:01 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Google Adwords Malvertising Campaign Targets Apple Macs

Cheeky attackers make their lure an ad for Google Chrome.

Apple Mac owners using the Google search engine may have been infected via malicious ads at the tip-top of their search results last week after attackers launched a malvertising campaign against Google Adwords. In an act of gumption or plain cheek, the attackers' malicious lure of choice was a phony ad for one of Google's own products, Google Chrome.

"I didn't think anyone had the guts to squat on Google's own page," says Cylance security researcher Jeffrey Tang, who discovered the attack while seeking a Chrome downloader for his girlfriend.

Similar to a campaign discovered by Malwarebytes last year, the malvertisers in this attack legitimately paid to bid on popular keywords to so that their ads would appear at the top of the search engine results page when those keywords were used. The campaign found last year used "youtube." This one used the words "google chrome."

Tang did the search, saw the ad for Chrome, and clicked on it - which he confesses was "mindless," but he "had no indication there was something strange." 

The ad itself showed a display URL of www.google.com/chrome. The URL displayed in the lower right-hand corner when scrolling over the link showed the same "legitimate-looking display URL."

Yet, as Tang describes in a blog today: "clicking on the ad takes a user to www(dot)entrack(dot)space and then redirects the user to googlechromelive(dot)com – a page offering a free download of Google Chrome." 

Tang spotted this as "totally not a legitimate page." He found a safe place to download Chrome for his girlfriend, then did more digging.

Black Hat Europe 2016 is coming to London's Business Design Centre November 1 through 4. Click for information on the briefing schedule and to register.

 

The "Chrome" download link will redirect Windows users to a page that delivers an error message that claims there is a DNS failure. Mac users, however, are redirected through a variety of other domains and ultimately infected with a malicious installer for OSX: OSX/InstallMiez, a.k.a. OSX/InstallCore. As Tang explains on his blog today:

"...the malicious download link redirects macOS users through ttb(dot)mysofteir(dot)com, servextrx(dot)com, and www(dot)bundlesconceptssend(dot)com then ultimately downloads a malicious file named FLVPlayer.dmg. The malware hash changes on each download, making it difficult to detect and track.

... Once the installation [of FLV Player] is completed, the browser is redirected to a scareware page at ic-dc(dot)guardtowerstag(dot)com. Clicking on the link takes the user to macpurifier(dot)com – a potentially unwanted program (PUP) claiming to cleanup OS X computers."

Tang describes the attackers as middlemen, installing someone else's malware and paid per install. The fact that the malvertisers have targeted Mac is a sign that attackers have recognized Apple's market share is growing, Tang notes.

But it's also possible that the campaign could have been planned for PCs as well. The fact that Windows users are redirected to a page that returns an error message could mean "either there's a misconfiguration or it's not set up yet," he says. "I'd like to think they're equal opportunity malvertisers," he added, wryly. 

The campaign might have been stopped from the beginning, however, if there had been a more rigorous verification process when creating the ad. If Google AdWords and other ad networks verified that an ad re-directed to the same URL it displayed, it could prevent malvertising threats like this. 

He acknowledges that there is a massive scalability challenge if ad networks need to do this verification with a manual process, but says that he thinks it's "ridiculous" that at least the primary domain isn't matched. 

"It blows my mind," says Tang, "that here we are, it's 2016, and we're still allowing this mischievous behavior."

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Mozilla, Internet Society and Others Pressure Retailers to Demand Secure IoT Products
Curtis Franklin Jr., Senior Editor at Dark Reading,  2/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5780
PUBLISHED: 2019-02-19
Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.
CVE-2019-5781
PUBLISHED: 2019-02-19
Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
CVE-2019-5782
PUBLISHED: 2019-02-19
Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVE-2019-5783
PUBLISHED: 2019-02-19
Missing URI encoding of untrusted input in DevTools in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform a Dangling Markup Injection attack via a crafted HTML page.
CVE-2019-5766
PUBLISHED: 2019-02-19
Incorrect handling of origin taint checking in Canvas in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to leak cross-origin data via a crafted HTML page.