Evidence That Cybercriminals are Using Google AdWords Uncovered by Exploit Prevention Labs

    Exploit Prevention Labs (http://www.explabs.com) found hard evidence that  cybercriminals are using Google AdWords to infect unsuspecting users with malware. Researchers at security software developer found that under the disguise of ads for legitimate, trusted organizations like The Better Business Bureau (see screen shot at http://www.explabs.com/CaseStudies/bbb/gs2.jpg), unsuspecting users are instead redirected to malicious sites that attempt to install exploits and other malware.

    The findings were reported recently by Roger Thompson, Exploit Prevention Labs' CTO, on his blog at http://explabs.blogspot.com/2007/04/google-sponsored-links-not-safe.html. The company first learned of this new attack vector April 10 when a user of the company's LinkScanner Pro safe surfing software ran a Google search on the words "how to start a business." The top-ranked sponsored search listing showed to be from AllBusiness.com, a legitimate business, yet the hyperlink actually led to a page that tried to install a password-stealing keylogger on the user's PC. LinkScanner Pro blocked the threat and automatically reported the discovery back to Exploit Prevention Labs researchers, who launched an immediate investigation.

    The team discovered that, on April 2 or 3, a known-bad organization acquired the domain name Smarttracker.org. By April 10, the organization had opened a Google AdWords account and purchased campaigns for various search terms. Although each of the ads displayed a trusted hyperlink, clicking on the adress redirected the user to smarttracker.org before sending them on to their intended target.

    The discovery shows issues facing all sponsored search vendors -- how to test the legitimacy of any individual advertiser, and how to determine whether a redirected link is being used legitimately, although Google has terminated this particular offending account. Exploit Prevention Labs' LinkScanner family of safe surfing software provides complete, real-time protection against malicious web sites, exploits, phishing, and other social engineering attacks. For more information , visit http://www.explabs.com/products/lspro_trial.asp.

    The company was founded by information security veterans Bob Bales and Roger Thompson in 2005, Exploit Prevention Labs develops the LinkScanner family of safe navigation software and services. LinkScanner Pro, LinkScanner Lite and LinkScanner Online offer patent-pending protection against malicious web sites and web- based exploits during the critical risk window between the announcement of a security vulnerability and the provision of a patch by the vendor. A Software Development Kit (SDK) is also available to enable third party vendors to incorporate Exploit Prevention Labs' technology in their own programs and services. More information about Exploit Prevention Labs and LinkScanner may be found on the company's website at http://www.explabs.com.