Google Adwords Malvertising Campaign Targets Apple Macs

Apple Mac owners using the Google search engine may have been infected via malicious ads at the tip-top of their search results last week after attackers launched a malvertising campaign against Google Adwords. In an act of gumption or plain cheek, the attackers' malicious lure of choice was a phony ad for one of Google's own products, Google Chrome.

"I didn't think anyone had the guts to squat on Google's own page," says Cylance security researcher Jeffrey Tang, who discovered the attack while seeking a Chrome downloader for his girlfriend.

Similar to a campaign discovered by Malwarebytes last year, the malvertisers in this attack legitimately paid to bid on popular keywords to so that their ads would appear at the top of the search engine results page when those keywords were used. The campaign found last year used "youtube." This one used the words "google chrome."

Tang did the search, saw the ad for Chrome, and clicked on it - which he confesses was "mindless," but he "had no indication there was something strange." 

The ad itself showed a display URL of www.google.com/chrome. The URL displayed in the lower right-hand corner when scrolling over the link showed the same "legitimate-looking display URL."

Yet, as Tang describes in a blog today: "clicking on the ad takes a user to www(dot)entrack(dot)space and then redirects the user to googlechromelive(dot)com – a page offering a free download of Google Chrome." 

Tang spotted this as "totally not a legitimate page." He found a safe place to download Chrome for his girlfriend, then did more digging.

Black Hat Europe 2016 is coming to London's Business Design Centre November 1 through 4. Click for information on the briefing schedule and to register.

The "Chrome" download link will redirect Windows users to a page that delivers an error message that claims there is a DNS failure. Mac users, however, are redirected through a variety of other domains and ultimately infected with a malicious installer for OSX: OSX/InstallMiez, a.k.a. OSX/InstallCore. As Tang explains on his blog today:

"...the malicious download link redirects macOS users through ttb(dot)mysofteir(dot)com, servextrx(dot)com, and www(dot)bundlesconceptssend(dot)com then ultimately downloads a malicious file named FLVPlayer.dmg. The malware hash changes on each download, making it difficult to detect and track.

... Once the installation [of FLV Player] is completed, the browser is redirected to a scareware page at ic-dc(dot)guardtowerstag(dot)com. Clicking on the link takes the user to macpurifier(dot)com – a potentially unwanted program (PUP) claiming to cleanup OS X computers."

Tang describes the attackers as middlemen, installing someone else's malware and paid per install. The fact that the malvertisers have targeted Mac is a sign that attackers have recognized Apple's market share is growing, Tang notes.

But it's also possible that the campaign could have been planned for PCs as well. The fact that Windows users are redirected to a page that returns an error message could mean "either there's a misconfiguration or it's not set up yet," he says. "I'd like to think they're equal opportunity malvertisers," he added, wryly. 

The campaign might have been stopped from the beginning, however, if there had been a more rigorous verification process when creating the ad. If Google AdWords and other ad networks verified that an ad re-directed to the same URL it displayed, it could prevent malvertising threats like this. 

He acknowledges that there is a massive scalability challenge if ad networks need to do this verification with a manual process, but says that he thinks it's "ridiculous" that at least the primary domain isn't matched. 

"It blows my mind," says Tang, "that here we are, it's 2016, and we're still allowing this mischievous behavior."

Related Content: