Trojan Targets Google Text Based Adverts

Use Netsparker


It looks like the malware guys are indeed getting more tricky, and this time it has an effect on multiple parties. It deprives Google of the impressions from the adverts and potentially can infect surfers with some nasty malware.

Again it’s using the hosts file, redirecting Google’s own ads to those from a nefarious source.

A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.

Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP addresses, said Romanian security company BitDefender.

It’s a pretty interesting vector and I guess in the coming year we are going to see a lot more tricks like this as the bad guys get more tricky and start thinking of new ways to get to people.

BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google’s ad server.

BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a “medium” risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.

Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.

As stated in the article there’s not much anyone can do, apart from the end-user making sure they don’t browse any malicious sites or run any software from unknown sources that might change their hosts file.

Source: Network World

Posted in: Malware, Web Hacking

, , , ,


Latest Posts:


DeepSound - Audio Steganography Tool DeepSound – Audio Steganography Tool
DeepSound is an audio steganography tool and audio converter that hides secret data into audio files, the application also enables you to extract from files.
2019 High Severity Vulnerabilities What are the MOST Critical Web Vulnerabilities in 2019?
So what is wild on the web this year? Need to know about the most critical web vulnerabilities in 2019 to protect your organization?
GoBuster - Directory/File & DNS Busting Tool in Go GoBuster – Directory/File & DNS Busting Tool in Go
GoBuster is a tool used to brute-force URIs (directories and files) in web sites and DNS subdomains (inc. wildcards) - a directory/file & DNS busting tool.
BDFProxy - Patch Binaries via MITM - BackdoorFactory + mitmProxy BDFProxy – Patch Binaries via MiTM – BackdoorFactory + mitmproxy
BDFProxy allows you to patch binaries via MiTM with The Backdoor Factory combined with mitmproxy enabling on the fly patching of binary downloads
Domained - Multi Tool Subdomain Enumeration Domained – Multi Tool Subdomain Enumeration
Domained is a multi tool subdomain enumeration tool that uses several subdomain enumeration tools and wordlists to create a unique list of subdomains.
Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.


5 Responses to Trojan Targets Google Text Based Adverts

  1. Sir Henry December 26, 2007 at 4:26 pm #

    One thing that I do to help maintain a safe existence on the web is to simply not click on any google text ads. I have only ever clicked a handful and really do not feel the need, no matter how appealing they may be (sorry Darknet, for not helping with your ad revenue). But, I am only one person and know that the general population is certain to click on these ads since people still seem to make a fair amount of coin from them.

  2. Ian Kemmish December 26, 2007 at 7:54 pm #

    It sounds like anyone using an ad-blocker which intercepts URLs before they ever get to the host look-up stage (such as PithHelmet for Safari) should avoid being misdirected to the malicious sites.

    In fact, such an ad-blocker presumably protects against these malicious ads even better than it does against others with URLs which simply point to servers owned by the hackers, since Google’s ad server will already be in the ad-blocker’s list of rules.

  3. goodpeople December 28, 2007 at 8:16 am #

    I’m with Sir Henry. Just don’t click on the ads.

    Clicking on ads will only get you on more spamlists.

  4. Nobody_Holme December 28, 2007 at 5:25 pm #

    Sorry also for cutting your ad revenue darknet, but the google adservers are permanently on my blocklist. If i do accidentally follow any duff links, i get AVG going in the background, and poke my other self-defence stuff.
    But not following links unless you trust the site it points at is the safest method available for avoiding trojans/virii

  5. eM3rC January 6, 2008 at 9:52 pm #

    Its amazing that a hacker/group of hackers was able to bypass one of the biggest websites on the internet and replace the ads with their own trojans. I would be willing to bet that sometime soon a company like microsoft, yahoo, google, etc will get hacked by a group and there will be some sort of malware breakout.