The Minefield of Google Ads

this video is brought to you by incogni stick around to hear more about the discount they are providing to the entire upper echelon Community okay today once again is a security topic but the pathway to get here was a little bit abstract all of it began with a simple tweet from a man named Michael girdley this tweet on screen right now said the following quote if

I am annoyed at your company pointing to a Google advert at the top of the search page for slack pricing and then different quote if I like your company pointing to the actual slack website itself in the same search page the insinuation here is that clicking on the Google advert costs the company money whereas directly purchasing from their website avoids that unnecessary click fee in theory

it's a rather funny way of striking back at corporate entities and I chuckled a bit when I read it however that levity was extremely short-lived because after reading the text and flipping back to whatever other project it is I was working on at the time I remembered something I remembered though I am certainly not an expert at this point in time just yet that something called

malvertising has recently been gaining massive Traction in the online World leading to an unknown number of high highly damaging infections system infections with Untold consequences I'll try not to be a hyperbolic tumor or an alarmist right now or anything like that but seeing this relatively popular tweet I guess with over 2.4 million views and 12 000 likes it really made me start thinking here's a top-down

overview of the situation for a tremendous number of digital programs such as OBS Brave audacity uTorrent grammarly notepad MSI afterburner blender and more the Google sponsored Links at the top of the page which are paid for through Google AdWords have been infected with highly dangerous malware a little bit more context here even though most people will probably know at least one of those programs by name

OBS is obviously a program for streamers and creators Brave is a privacy-based browser client audacity is an audio editing Suite uTorrent is a peer-to-peer sharing Network grammarly is for spell checking notepad plus plus is a text and source code editor MSI afterburner is overclocking software wear for gaming hardware and blender is a 3D editing program all walks of life all types of programs multiple user demographics

and all of them were overrun with malware that list is actually a whole hell of a lot longer no one has the full comprehensive list right now because threat actors can spin up a new version with minimal effort proceeding to advertise it at the top of Google search results through their own advertising portal but in reality these websites are not a legitimate vendor for the software

they are fabricated pages that redirect to a separate distribution platform like Dropbox or Discord CDN the content distribution network of Discord which I've talked about previously as being a massive Distribution Hub for malware prompting the user to download an infected version of whatever program they are looking for that contains one of many possible malware Stealers which will harvest pretty much all sensitive data on your machine

which can then lead to everything from loss of identity to compromised social media accounts etc etc it's scary stuff before going further it's time for today's video sponsor incogni every day day that you exist online your data is being sold by third party Brokers and accessed without your knowledge as a result of data breaches most people may not know this or worse yet they don't even

the highest bidder and it's an impossible process to contact all of them yourself and fight objections or get your data removed so for that there is incognee simple process sign up for the website give them specific legal permission to work on your behalf in this particular capacity and let them know what kind of information they will be having removed I have personally done this and as

you can see there are 59 completed requests with 45 still pending as my data is systematically removed from Shady Brokers and corporate servers that I never even wanted to be associated with in the first place keep in mind incogni is created by the same developer as surf shark another long-standing partner of the channel which means we have a special deal as well the first 100 people

to click the link Down Below in the description and use code Echelon at checkout will get 20 off their subscription to incogni again link down below and promo code Echelon for the first 100 viewers or clickers who use it to get 20 off their subscription big thank you to incogni for sponsoring the channel let's dig deeper to be clear this problem isn't exactly new per se

it's not breaking news of any sort and the FBI has even warned about this new emerging attack Vector a couple of months ago in the end of 2022 but how many people actually keep up with this [__] I know some people do and that's great for them but most people don't most people have no idea when they search Google that the ads they see at the

top of the page in the most authoritative slot might be maliciously designed to infect their machine and the more people that understand this kind of danger the better one of the most comprehensive analysis write-ups for this particular topic actually comes from a company called guardio funnily enough they used to be a video sponsor of mine which is awesome so it's great to see them leading the

pack with awareness campaigns and it also benefits me massively because they've created a series of infographics for the subject which I now get to use this is essentially what it all looks like and while I did do a search for some contemporary examples of the malware in use on Google ads right now none of the December 2022 versions are currently operating out in the open at

least not anymore that doesn't mean that there aren't dozens more campaigns actively out there as I write this it just means that Google became aware of that particular list of known threats in their AdWords system and they purge them don't get me wrong that's a good thing but this is also I guess reactionary not proactive I do believe Google is working on this and fixing it

but until we know for certain that it's been fully curbed yeah don't go clicking on Google ads for digital programs go straight to the actual Source the basic gist is this a threat actor Will first replicate some sort of existing software product that they have been able to infect right they'll take a program that a lot of people want they'll infect it with malware healers from

one of the families and they'll have something they can infect a machine for our purpose today we'll use Turbo Tax as an example because there are TurboTax adverts actively served at the top of the results on Google please keep in mind though this is not a statement against Turbo Tax in any way it's simply an example of how the process works TurboTax ads right now on

Google as far as I could tell after examining them are not infected again just an example once the replicated page has been made and the malware has been attached to whatever program they're going to be using to get you to install it it will be advertised through Google to sit at the top of the search results for all keywords associated with it side note during the

initial rise of this problem multiple malware ads would be situated at the absolute top of all search results for dozens of popular programs simultaneously when a user finally clicks on one of the dummy Pages a hidden redirect will take them to a completely different web page the process is called cloaking which I'll talk about later on which then attempts to use a third-party file storage website

or service to prompt users into downloading whatever it is they were initially looking for let's say with TurboTax using our current example that we were looking to get the program and click on the first sponsored advert after research Google the actual site being advertised by Google would be clean right the actual domain name that we think we're clicking on is clean but when navigating to it

you would be redirected to a separate interface disguised as if it were real where the goal is to get you to download something that is likely too large a file for your antivirus to actually scan and could be distributed through a number of options like Mega Dropbox GitHub Discord or Google Drive if successful the program would obviously hijack your system that's its primary purpose but the

scary part is that sometimes the falsified sites can be nearly indistinguishable from the real ones here are some examples of real versus fake websites that were part of the first wave of this problem to clarify here the domain that's actually advertised through Google's AdWords program is not something that's malicious it's actually totally clean to fool all the different bot checks and different moderation techniques however when

you click it the redirect takes you to a different website that then impersonates a brand and tries to infect your system right so the first website that you think you're clicking sometimes is even just a totally innocent unconnected thing it's just being advertised on Google with a very similar name a very similar domain and the whole thing is to just trick you into getting into this

redirect funnel and then downloading the infected files when I say that this was and likely still is a widespread problem I absolutely mean it here's a list of impersonation websites just for one single brand in this case MSI afterburner targeting Gamers and crypto miners to steal all of their information over 50 entries of redirected web pages advertised through Google AdWords placed at the top of the

search results but designed to infect users rather than allowing them a true download and that's just one program with one demographic being targeted what makes it all even that much more dangerous is that the falsified websites will actually install a valid version of the software for the most part when clicked it if you were to click through trusting the Google AdWords platform to be safe and

fully installed the infected files they would actually work for the purpose that you wanted this attack Vector is so well crafted for many people it would never even trip their alarm Bells because they would click an official Google sponsored post download a file that then runs and opens the exact program that they wanted on multiple occasions for a lot of people but alongside that their entire

digital life has been laid bare which is really a scary concept these threat actors will systematically rotate through different malware variant types ensuring that they never use the same version for too long one day it will be raccoon stealer the next day it could be Redline or Vidar for those that don't know these are names of malware families that steal information and protect themselves sometimes circumvent

virtual machines even you name it depending on their level of sophistication according to threat analysis posted by HP researcher Patrick schlapper who focused it seems on a campaign targeting users who are looking to download the audacity program Google malvertising as it's called is not just on the rise it's explode loading even more examples of infected ad campaigns include 7-Zip Microsoft OneNote [__] or Microsoft teams and

for a much more individual example we can look at a user named nft God who fell prey to OBS but again A lot of people are going to recognize these programs at least a couple of them as things that they either have have used in the past or might get in the future and if you're going to do that be aware of this now keep in

mind I don't actually have any familiarity with who this particular person is or what they do but they are nft God presumably a rather prominent figure in crypto no one really knows because that space is so bonded to hell it's almost unbelievable but nft God recounts a tragic scenario where his OBS download compromised all of his accounts profiles and communities simultaneously devastating his life and ruining

his finances crypto is particularly vulnerable to all this so anyone with portfolios of digital assets and coins needs to be hyper aware here's what to look out for and these tricks May sound very simple and they are but we all need to use them all of the time number one check the domain check for any spelling mistakes in the domain name of a website where you

are about to download files always better yet don't click on Google ads if you're intending to download a program do so after finding the direct link to the provider on Google not a sponsored post even if Google has largely cleared up the known campaigns utilizing this method right now there are more there will be more and they will be just as dangerous if not worse in

the future number two if you somehow do find yourself trusting a website and choosing to download a file from them remember that the larger the file the less likely it is your antivirus program will properly scan it malware is inflated with thousands and thousands of useless zeros in the code you can strip it out but that's a more advanced process to increase file size as a

method of circumventing default checks so if you're downloading a 700 Meg File versus a 45 Meg file oftentimes antivirus default scans won't even be conducted on the larger files meaning that threat actors can use that to their advantage sneaking code into your system if you trust it don't let them do that number three never download anything from a third-party file sharing host after clicking on a

Google ad if I go to obsproject.com right now I can download the installer I want uninfected and it comes direct from the web page if that page for some reason tried to make me download the file from Dropbox for example yeah never ever do that it might contain a valid copy of the program you want in there in addition to the malware but it also probably

contains life-altering Steelers number four use ad blockers that may seem unrelated but these attack vectors prey on trust in this case the trust we have in Google maybe it's not real trust and maybe most people actually don't trust Google but plenty of people will let their guard down when looking at an official sponsored listing becoming more likely to trust it simply because it's at the top

of their search engine and if Google put it there it must be real various ad blockers will actually remove most most of these sponsored posts I don't know which ones and it's kind of a battle between websites like Google and ad blocking software where Google wants you to see the ads the ad blockers want to block the ads so it's kind of a back and forth

they're jockeying for position sometimes one will win the other will win I mean it's a long track record of this so yeah have an ad blocker and if it happens to be one that blocks the sponsored posts that's great it leaves you with the actual websites beneath them which are far less risky right now and yeah maybe me as a Creator gets less revenue from people

adopting more aggressive ad blockers but that is peanuts compared to the destruction of their digital lives because they clicked a disguised product advertised through Google AdWords the reality is cloaking the process by which a website can be advertised on Google's platform but then redirect to malicious payloads or cloned websites or pages is extremely extremely common the technique is even used for domains like Facebook or used

on or against domains like Facebook YouTube Amazon and more and yes it's a violation of YouTube's advertising policy or Google's advertising policies but they don't catch everything they don't necessarily catch it quickly and understanding that the sponsored ads that you see are far more likely to be dangerous than anything else on the search page beneath it is important for all of us to keep in mind

right now no one knows how many people have actually been hit by this so far no one knows how many it will be before the issue gets fully solved if it ever gets fully solved though the number of people hit so far is probably very very high and a lot of the specific known campaigns have been disabled which is great but there will always be more

and when a system like that is under siege with devastating consequences for users sometimes it's best to stop engaging completely for a while and see how things go me personally I will never be clicking a sponsored Google search ad ever again not now not even when they say the problem is fixed because the amount of risk you and I are accepting by doing so is completely

unjustifiable in the end being aware of what we do online what we click on and where it takes us is obviously critical right I mean this is not new information I'm not saying anything revolutionary in the slightest but with a platform like Google awareness becomes even more important because there are people out there that trust what they see when it comes from certain companies making them

even more vulnerable when threat actors prey on the trust that they have with that particular brand which can hopefully be avoided through proper awareness that's it if you want support please check out the links down below primarily locals and patreon that's the best way to support the channel if you feel like it financially merchandise social media the video sponsor of course etc etc also some platform

Alternatives where you can watch my videos like Odyssey and Rumble but yeah I'll cut it there and stop rambling as always thank you all for watching and have a nice night [Music] thank you [Music]