The Exploit Prevention Lab blog reports on how hackers are using Google sponsored links to infect machines with a variant of the MDAC exploit. Here's how it works -
Popular Google searches like "Better Business Bureau" will turn up a rogue link leading to a malicious site. In the case of "Better Business Bureau" search, the query actually turned up the rogue link as the #1 sponsored site. However, before taking you to the BBB site, it actually sends you to smarttrack.org which sounds innocuous enough...except that it's not.
Smarttrack.org uses a variant of the MDAC exploit to install a backdoor and a post-logger on your system. The postlogger targets the websites of top banks around the world with a phishing attack to entice online banking customers to unintentionally reveal vital information. What makes this both a clever and insidious use of Google links is that most browsers do not provide a preview address with Google sponsored links (the way they do with most other links).
And one other thing - Google suspended the accounts of the malicious sponsored links. Thought I should mention that. If you want to read the latest on this, here is a report with Google's response to this.
Leave a comment