Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/1/2016
12:01 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Google Adwords Malvertising Campaign Targets Apple Macs

Cheeky attackers make their lure an ad for Google Chrome.

Apple Mac owners using the Google search engine may have been infected via malicious ads at the tip-top of their search results last week after attackers launched a malvertising campaign against Google Adwords. In an act of gumption or plain cheek, the attackers' malicious lure of choice was a phony ad for one of Google's own products, Google Chrome.

"I didn't think anyone had the guts to squat on Google's own page," says Cylance security researcher Jeffrey Tang, who discovered the attack while seeking a Chrome downloader for his girlfriend.

Similar to a campaign discovered by Malwarebytes last year, the malvertisers in this attack legitimately paid to bid on popular keywords to so that their ads would appear at the top of the search engine results page when those keywords were used. The campaign found last year used "youtube." This one used the words "google chrome."

Tang did the search, saw the ad for Chrome, and clicked on it - which he confesses was "mindless," but he "had no indication there was something strange." 

The ad itself showed a display URL of www.google.com/chrome. The URL displayed in the lower right-hand corner when scrolling over the link showed the same "legitimate-looking display URL."

Yet, as Tang describes in a blog today: "clicking on the ad takes a user to www(dot)entrack(dot)space and then redirects the user to googlechromelive(dot)com – a page offering a free download of Google Chrome." 

Tang spotted this as "totally not a legitimate page." He found a safe place to download Chrome for his girlfriend, then did more digging.

Black Hat Europe 2016 is coming to London's Business Design Centre November 1 through 4. Click for information on the briefing schedule and to register.

 

The "Chrome" download link will redirect Windows users to a page that delivers an error message that claims there is a DNS failure. Mac users, however, are redirected through a variety of other domains and ultimately infected with a malicious installer for OSX: OSX/InstallMiez, a.k.a. OSX/InstallCore. As Tang explains on his blog today:

"...the malicious download link redirects macOS users through ttb(dot)mysofteir(dot)com, servextrx(dot)com, and www(dot)bundlesconceptssend(dot)com then ultimately downloads a malicious file named FLVPlayer.dmg. The malware hash changes on each download, making it difficult to detect and track.

... Once the installation [of FLV Player] is completed, the browser is redirected to a scareware page at ic-dc(dot)guardtowerstag(dot)com. Clicking on the link takes the user to macpurifier(dot)com – a potentially unwanted program (PUP) claiming to cleanup OS X computers."

Tang describes the attackers as middlemen, installing someone else's malware and paid per install. The fact that the malvertisers have targeted Mac is a sign that attackers have recognized Apple's market share is growing, Tang notes.

But it's also possible that the campaign could have been planned for PCs as well. The fact that Windows users are redirected to a page that returns an error message could mean "either there's a misconfiguration or it's not set up yet," he says. "I'd like to think they're equal opportunity malvertisers," he added, wryly. 

The campaign might have been stopped from the beginning, however, if there had been a more rigorous verification process when creating the ad. If Google AdWords and other ad networks verified that an ad re-directed to the same URL it displayed, it could prevent malvertising threats like this. 

He acknowledges that there is a massive scalability challenge if ad networks need to do this verification with a manual process, but says that he thinks it's "ridiculous" that at least the primary domain isn't matched. 

"It blows my mind," says Tang, "that here we are, it's 2016, and we're still allowing this mischievous behavior."

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
IoT Vulnerability Disclosure Platform Launched
Dark Reading Staff 10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15270
PUBLISHED: 2020-10-22
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not pa...
CVE-2018-21266
PUBLISHED: 2020-10-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2018-21267
PUBLISHED: 2020-10-22
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.
CVE-2020-27673
PUBLISHED: 2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.
CVE-2020-27674
PUBLISHED: 2020-10-22
An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is mishandled during use of an INVLPG-like attack technique.