How did "tech-supportcenter" phishers trick Google?

Question

Related: Is the Web browser status bar always trustable?

How can Google search change the location in a URL tooltip?

I've always thought you can "hover" over a link to see where it really goes, until today.

A coworker (working from home) searched for "Target" in Google Search (using edge). He clicked the top result, which happened to be an ad, and was redirected to a phishing page posing as Microsoft trying to get him to call a "tech support" number.

I got the same results on a different computer, on a different network. When I hover over the link, both links show "www.target.com" at the bottom, but clicking the ad link takes you to a malware page and the second link (first search result after the ad) takes you to the real Target.com page.

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

UPDATE Here's the same results in a virtual machine with a fresh install of Windows, on a different network:

Here's the source for the URL. It looks like it does include the "onmousedown" Javascript as the first question I linked to mentioned. Does Google allow advertisers to display any URL they want for the tooltip?

[This](http://www.zdnet.com/article/malicious-google-ad-pointed-millions-to-fake-windows-support-scam/) is the same scam pattern. — Arminius, Jun 02 '17 at 18:44
This is funny. It's still showing up. It is also playing an 'Important security message' recording to me, spoken by a polite but concerned sounding robot. — Eli Heady, Jun 02 '17 at 20:36
I've never had occasion to report malicious ads to Google, so I searched for 'reporting fake ad to google' and it took 10 minutes to find what might be the right reporting form. https://support.google.com/adwords/troubleshooter/4578507 — Eli Heady, Jun 02 '17 at 20:43
The phishing site is hosted on Cloudflare. Anyone else interested in reporting it can do so here: https://www.cloudflare.com/abuse/form — Eli Heady, Jun 02 '17 at 20:44
That's why you should use [this](https://github.com/palant/searchlinkfix) type of addons besides protecting your privacy. — Xaqron, Jun 03 '17 at 01:42
If you think that's bad, don't ever ever use Yahoo - http://tunesviewer.sourceforge.net/using-yahoo-as-your-search-engine-you-may-want-to-think-twice/ — NoBugs, Jun 03 '17 at 21:45
Another noteworthy vector is the [IDN homograph attack](https://www.xn--80ak6aa92e.com/) mentioned on [HackADay](http://hackaday.com/2017/04/19/you-think-you-cant-be-phished/). This attack includes in the domain a Unicode encoding of a Cyrillic letters which look like Latin letters. This was recently fixed in both Chrome and Firefox, and it never affected IE. — jpaugh, Jun 07 '17 at 14:45
Ehm, as for the update I think you have other security issues. Just visiting a website (not downloading or allowing anything) shouldn't compromise your credit card — EpicKip, Jun 08 '17 at 12:41
@EpicKip That's what I thought, until I learned about [drive-by exploits](https://security.stackexchange.com/questions/53929/drive-by-downloads). That's why I'm concerned about the Chrome security patches released a couple days later. I will defer to the experts, though. — browly, Jun 08 '17 at 15:56
I suddenly feel so much less paranoid for never letting my mouse anywhere near those links, or even the section of the page those links are in. (I used to accidentally click the mouse, even when I didn't mean to, and ads used to be more hover-happy) — trysis, Jun 10 '17 at 15:59

Arminius · Accepted Answer · 2017-06-06T15:34:13.640

205

If displaying the wrong URL in the tooltip requires Javascript, how did tech-supportcenter get their Javascript onto the Google search results page?

The scammers did not manage to inject JS into the search results. That would be a cross-site scripting attack with much different security implications than misleading advertisement.

Rather, the displayed target URL of a Google ad is not reliable and may conceal the actual destination as well as a chain of cross-domain redirects. The scammers possibly compromised a third-party advertiser and hijacked their redirects to lead you to the scam site.

Masking link targets is a deliberate feature of Google AdWords. It is generally possible to specify a custom display URL for an ad link which can be different from the effective final URL. The idea is to enable redirects through trackers and proxy domains while keeping short and descriptive links. Hovering over an ad will only reveal the display URL in the status bar, not the real destination.

Here is an example:

I'm searching for "shoes".
The first ad link displays www.zappos.com/Shoes:

When I click on it, I actually get redirected multiple times:

https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChXXXXXXXd-6bXXXXXXXXXXXXkZw&ohost=www.google.com&cid=CAASXXXXXp8Yf-eNaDOrQ&sig=AOD64_3yXXXXXXXXXXXXXYX_t_11UYIw&q=&ved=0aXXXXXXHd-6bUXXXXXXXXXwIJA&adurl=
-- 302 -->
http://pixel.everesttech.net/3374/c?ev_sid=3&ev_ln=shoes&ev_lx=kwd-12666661&ev_crx=79908336500&ev_mt=e&ev_n=g&ev_ltx=&ev_pl=&ev_pos=1t1&ev_dvc=c&ev_dvm=&ev_phy=1026481&ev_loc=&ev_cx=333037340&ev_ax=23140824620&url=http://www.zappos.com/shoes?utm_source=google%26utm_medium=sem_g%26utm_campaign=333037340%26utm_term=kwd-12666661%26utm_content=79908336500%26zap_placement=1t1&gclid=CI3vqXXXXXXXXXXXXXBBA
-- 302 -->
http://www.zappos.com/shoes?gclid=CI3vXXXXXXXXXXXXXMBBA&utm_source=google&utm_medium=sem_g&utm_campaign=333037340&utm_term=kwd-12666661&utm_content=79908336500&zap_placement=1t1

Obviously, Google has strict destination requirements for ad links in place and an ordinary customer won't get their ad approved if they set the link target to a completely different domain. But scammers do occasionally find ways around the vetting process. At least, Google's policy about "destination mismatches" is pretty clear:

The following is not allowed:

Ads that don't accurately reflect where the user is being directed [...]

Redirects from the final URL that take the user to a different domain [...]

Trusted third-party advertisers may be permitted to issue cross-domain redirects, though. Some of the exceptions are listed here, e.g.:

An example of an allowed redirect is a company, such as an AdWords Authorized Reseller, using proxy pages. [...]

For example:

Original website: example.com

Proxy website: example.proxydomain.com

We allow the company to use "example.proxydomain.com" as the final URL, but retain "example.com" as the display URL.

One major weak spot is that Google doesn't control the third-party redirectors (in above example, that's pixel.everesttech.net). After Google has vetted and approved their ads, they could simply start redirecting to a different domain without immediately getting noticed by Google. It's possible that, in your case, attackers managed to compromise one of these third-party services and pointed their redirects to the scam site.

In recent months, there have been several press reports about an almost identical scam pattern, e.g. this report about a fraudulent Amazon ad whose display URL spells out amazon.com but redirects to a similar tech support scam.

(By now, your discovery has also been picked up by a few news sites, including BleepingComputer.)

edited Jun 06 '17 at 15:34

answered Jun 02 '17 at 19:19

Arminius

44,242
14
143
138

160

I had no idea Google allowed advertisers to do that. It seems like they learned that users have finally been learning you preemptively check urls, and so they made a "feature" to trick them. Shame on them! :( – Xiong Chiamiov Jun 02 '17 at 21:09
147

It's absurd how advertisers beg users not to block their ads and then pull this crap. – IllusiveBrian Jun 03 '17 at 00:12
137

Where's the vote button for "This feature is an obvious abuse magnet and should never have existed"? – Jun 03 '17 at 02:45
111

@WumpusQ.Wumbley Never mind Google, the ability to have a different target address displayed in the status bar is a feature that should never have existed in browsers in the first place. – Federico Poloni Jun 03 '17 at 11:32
8

@WumpusQ.Wumbley I would recommend starting a [change.org](https://www.change.org/) petition to try to get some attention on this issue. – jrh Jun 03 '17 at 13:21
13

I can see why you want to hide the tracking URL, but I can't wrap my head around the idea that someone thought it would be a good feature to allow a whole different domain. The last point effectively voids any restriction they have on domain names. – Sebb Jun 03 '17 at 15:08
9

The very point of chrome's "preview link destination" feature was exactly to avoid that. – Ilia Sidorenko Jun 03 '17 at 15:41
1

@XiongChiamiov Why don't you use BING, it seems to not have the weird Google redirecting thing in their search results. – NoBugs Jun 03 '17 at 21:48
45

@NoBugs I've been using DuckDuckGo as my primary search engine for a few years now, but I'm less concerned about *my* security than the population as a whole. I can't force other people to stop using Google (or to block ads), but more importantly, this is a blow against security education efforts. – Xiong Chiamiov Jun 03 '17 at 23:41
2

@XiongChiamiov Good point, and educating users that they can use that engine that "doesn't track you" and stow your personal info, is a good security education effort too. – NoBugs Jun 04 '17 at 06:14
17

@FedericoPoloni In all fairness it looks like Javascript is the culprit here and Google is the company that is implementing the Javascript that hijacks the click. So the fault lies squarely on Google. The status bar preview is just a nice thing to make sure you are not going to a bad place, but there is no guarantee that the link will go to a good place. I guess browsers could hide the link if there is any javascript code attached to it. – Cave Johnson Jun 05 '17 at 06:29
3

@XiongChiamiov All advertisers allow you to specify a different url from what's displayed. For example, so does Facebook, and I think(but not 100% sure) Twitter as well. It's a feature, not a bug :) – Shantnu Jun 05 '17 at 08:35
1

This is plain wrong... The 2 URLs don't even need to be on the same domain or be on a sub-domain. It's 2 completely different domains so anyone can fake it... – Gudradain Jun 05 '17 at 14:09
5

@Arminius example.com and example.proxydomain.com are 2 different domains. The second domain should be proxydomain.example.com to be a subdomain. For example, I can register stackexchange.mydomain.com right now if I want and google would let me put adds for stackexchange.com. – Gudradain Jun 05 '17 at 14:19
3

@Gudradain (Accidentally deleted my last comment.) It wouldn't be *that* easy though. Google still has a vetting process, not everyone can get arbitrary proxy domains approved. – Arminius Jun 05 '17 at 14:22
1

Fasten your seatbealt with https://superuser.com/questions/391832/is-there-firefox-preference-for-controlling-javascript-redirect and https://noscript.net/. – nutty about natty Jun 06 '17 at 07:20
2

@IllusiveBrian It's not that legit advertisers are pulling this crap after begging users not to block their ads -- it's that scammers are *posing as* legitimate advertisers and then pulling this crap. – Doktor J Jun 06 '17 at 12:36
1

This is exactly why I don't click on the 'Ad' links... – Vnge Jun 06 '17 at 21:22
2

@Gudradain Why would Google allow a mismatch where only the subdomain matches? That doesn't make sense. It makes sense to allow a display name of `target.com` when the redirect is to `arbitrary.subdomain.of.target.com`, since the same entity (Target, Inc) controls both domains (that's how sub-domains work), and Target's own reputation is on the line. If Google allowed you to match your arbitrarily-chosen subdomain against a real domain, then they will very quickly loose their reputation as a respectable advertising agency, because this attack would be **far** too easy. – jpaugh Jun 07 '17 at 14:53
1

@jpaugh Indeed, it would be far too easy to attack and this is what they states on their website : https://support.google.com/adwordspolicy/answer/2643759?hl=en. I don't understand it either. – Gudradain Jun 07 '17 at 17:56
https://github.com/palant/searchlinkfix fixes google's monkeying with the target URL in Firefox. I like my links to do what they say on the tin. I don't know if the same is available in Chrome – spender Jun 07 '17 at 20:18

Harper - Reinstate Monica · Answer 2 · 2017-06-05T19:07:25.070

42

This is a common abuse in paid advertising (note the "Ad" icon at the tail of your left arrow).

Advertisers want to track people who click on Google ads, partly to independently confirm Google's click billing, and partly to give away free cookies. So they request search engines to send users to a ClickURL which does that, and then forwards to the proper destination. The ClickURL may be off site, for instance at the ad agency.

The advertiser wants to provide a separate DisplayURL, which is simply the URL shown in the text ad. To hide the ugly ad agency URL, and to show a neatly displayed URL, instead of the actual destination URL (which may be lengthy e.g. a specific product page). This DisplayURL is being abused by the phishers.

The search engine is never provided the destination URL (where the ClickURL should forward to). Since the ClickURL is often on a different domain than the DisplayURL, this is hard to police. Target may retain several SEOs, each using a different Gooogle ID or ad agency, so there's nothing weird about a random Google ID running ads with a target.com DisplayURL all of a sudden.

Fairly likely that the advertiser is a small business and got phished: i.e. the spammer got ahold of their Google user credentials, discovered a Google Ad account with stored credit card data, and is running ads on their dime.

edited Jun 05 '17 at 19:07

answered Jun 03 '17 at 02:00

Harper - Reinstate Monica

3,381
12
18

3

If you rather stupidly allow matching subdomain links, at least check (by repeatedly emulating real browsers) whether that uses an HTTP redir to the displayurl domain. – Cees Timmerman Jun 04 '17 at 08:24
2

@CeesTimmerman Good observation and I thought of including that in my answer proper. IME they don't because if you take the "view from 30,000 feet" of *the total universe of all paid-ad abuse*, 99% is far too subjective and requires human review. For that reason there's a vast editorial review infrastructure in place. (your Google/Facebook ads don't go online instantly). The perception is auto-detection isn't worth the developer bandwidth since it would so rarely catch what an editor missed, and add *more* editor and CS workload dealing with false positives. – Harper - Reinstate Monica Jun 05 '17 at 16:46
Negligible workload for Google's cloud. – Cees Timmerman Jun 05 '17 at 18:18
Note that there's an easy fix on Google's side that they're simply unwilling to do: ban any advertiser whose provided ad url responds with a redirect. – R.. GitHub STOP HELPING ICE Jun 05 '17 at 23:41
4

AFAIK, Google actually checks that the provided URL does indeed redirect to the display URL domain (along with many, many, many other checks on the contents of the destination page and much more). However, this is only done periodically, so it's possible to switch the redirect URL after the initial checks and fly under the radar until the next check. – jcaron Jun 06 '17 at 10:47
@jcaron And the bad guys can do differential redirects based on the client IP, so google sees a good landing URL when they check, but the rest of us see their bad landing URL. – Rob Jun 06 '17 at 22:20
2

I believe they do a lot of tests with pretty obvious data (user-agent, IP...), but like to throw in some not-so-easily-detectable requests in the mix. But to remain difficult to detect they need to be not too frequent, and that leaves quite a bit of time for an unscrupulous user to do their stuff before they're detected... – jcaron Jun 06 '17 at 23:19

score 5 · Answer 3 · answered Jun 07 '17 at 13:03

One aspect of this answer provided by Arminius, is that it had to be an agency trusted by Target at some point. Because when you bid on brand names in AdWords it always gets flagged for copyright reasons. Unless your AdWords account has been whitelisted. This can be a CSV list of accounts that a brand name / copyright permits to place ads on Google on their behalf. See the form here

So apart from the technical reasons explained in other answers here, it is almost impossible to have done this without access to that brand name inside your adwords account. And that can only have come from a whitelisted ad-agency that Target, at some point had trusted their AdWords management with. Or an outsourced agency on their behalf that was overlooked.

If there would be any so-called "exploit" for this issue, then it is this sort of social engineering, ie: getting on that whitelist as accredited "AdWords agency" on behalf of a brand.

As background info: A few years ago it was common for us to be offered the "opportunity" to buy AdWords accounts from the newly established ad agencies in China. Chinese agencies had been given access to AdWords and seemingly in a state of euphoria Google was allowing them unlimited account creation. Accounts that were abusing the AdWords TOS, and they ostensibly never got blacklisted. On the other side Big Brands were outsourcing their AdWords account management to these Chinese agencies because their management rates were simply too good. That's definitely one possible scenario of how you could get access to such a well-known brand.

How did "tech-supportcenter" phishers trick Google?

3 Answers3