Google AdSense
2 days ago a particular post did catch my attention. Please take some time to read and analyse every phrase in depth. Bold emphasis is mine; they will compose keywords and reveal the reason of this write up.
An Apology and a Request for Help.
Everyone reading these pages and Sandi's blog will know the meaning of most bolded words and symptoms except maybe for Google AdSense. Why did I include it?QUOTEOver the weekend, on Saturday, April 5, 2008, one of our features, I is Stewpid, hit the Digg.com front page. Though we have been there before, this instance was unique in that a few spyware redirects (from TheMishMash.com, not Digg.com) were reported.
We hoped to draw attention to these reports for two reasons:
1. We hate spyware too and we wanted to apologize to the affected users; and
2. We are not tech-savy and we need help finding out how this happened. We DON'T want it happening again.
For you sleuths then, here is what we know:
a. First, our website is run and hosted on TypePad, a reputable and easy-to-use blogging platform.
b. The numbers of visitors affected was small. Though on Saturday and Sunday our approximate pageviews exceeded 170,000 there were only 35 to 40 comments/complaints about spyware, pop-up's, redirects, etc. In fact, none of us here could recreate the problem.
c. According to some Digg reader comments, affected users, after visiting the I is Stewpid page, were presented with a misleading popup. It further appears that a few were then directed to (DO NOT VISIT) imunizator.com. One Digg user mentioned as a possible cause "an .swf file from [again DO NOT VISIT] promoplexer.com." A third user said he/she was redirected to [DO NOT VISIT] antispywaredeluxe.com.
d. Shortly after we learned what was reported, we immediately contacted Google AdSense, a TheMishMash.com advertising provider, and requested assistance. We further blocked AdSense from displaying ads from imunizator.com, promoplexer.com and antispywaredeluxe.com. We do not, however, yet know whether any even advertise on AdSense.
e. The problem seemed to affect only visitors coming from Digg.com.
f. To our knowledge we have never approved pop-up advertising, whether through AdSense or otherwise, though we intend on Monday to verify that.
Obviously we have no idea at this point who, if anyone, or what, was to blame. It very well could have been something we did wrong; we just don't yet know.
The long and short of it? To the Digg users who were affected, we are sorry. To those readers with expertise and/or experience in these matters, help. Any suggestions, further information, clues, etc. is appreciated.
If you visit TheMishMash homepage, you will see a flash animation either on the right side and /or after the first blog post, so your thoughts will be “Hey dude that was a quick one to figure out”. Well it isn’t because if you take a peek at the source code of the page you’ll notice that they don’t serve other ads besides the Google AdSense ones.
Very important note: Below are some screenshots but the SWF file displayed is NOT malcicious, it only serves for illustration purposes.
Google advertisements are very hard to track, it's not like a banner hosted at X or Y site with a nice SWF extension. I will not explain the mechanism in depth but you get a js script from ad.afy11.net which contains the necessary details in order to display the advertisement in a "placeholder".
pagead2.googlesyndication.com/pagead/flash_ad_relay.swf being the placeholder and pagead2.googlesyndication.com/pagead/imgad?id=[removed by me] is the flash animation in this case.
No extension, no relevant name ... very difficult to spot something or to get the flash file scanned.
Since links inside malicious banners are encrypted and their click tag often redirects to the real site (emusic, colgate ...), fine tuning advertising in your Adsense panel will have no effect or very little because these type of malverts don't come directly from imunizator.com, promoplexer.com, etc ...
The impact of them eventually being seen in Google Adsense is huge; a lot of websites use Google Ads. Many of them only allow text based ads, which is good; others have only images and they represent a certain “danger”...
It isn't the first time that bad things happen through Google advertising and it certainly will not be the last time. I kinda suspected this way back by reading some reports on forums but it’s the first time I came across a website which exclusively uses Google adverts.
Unfortunately I don’t have any captures of malicious banners being showed through Google AdSense so I can’t prove anything for 100% sure right now. Maybe the people who got hit at TheMishMash used a proxy or Tor, one never knows.
One thing is important right now, no matter if you are an advertiser, an admin or a simple user, just keep your eyes wide open please. When you are a victim of a redirect, let us know, provide as much details as possible.
Thanks.
