IT 计算机信息网络安全技术

IT 技术

© IT 计算机信息网络安全技术 | Powered by LOFTER

Google (Advertising) System URL Redirection Vulnerabilities Could Be Used by Spammers

Although Google does not include Open Redirect vulnerabilities in its bug bounty program, its preventive measures against Open Redirect attacks have been quite thorough and effective to date.

However, Google might have overlooked the security of its advertising system. After some test, it is found that most of the redirection URLs within are vulnerable to Open Redirect vulnerabilities. Many redirection are likely to be affected. This could allow a user to create a specially crafted URL, that if clicked, would redirect a victim from the intended legitimate web site to an arbitrary web site of the attacker's choosing. Such attacks are useful as the crafted URL initially appear to be a web page of a trusted site. This could be leveraged to direct an unsuspecting user to a web page containing attacks that target client side software such as a web browser or document rendering programs.

These redirections can be easily used by spammers, too.

Some URLs belong to are vulnerable to Open Redirect attacks, too. While Google prevents similar URL redirections other than Attackers can use URLs related to Google Account to make the attacks more powerful.

Moreover, these vulnerabilities can be used to attack other companies such as Google, eBay, The New York Times, Amazon, Godaddy, Yahoo, Netease, e.g. by bypassing their Open Redirect filters (Covert Redirect). These cyber security bug problems have not been patched. Other similar web and computer attacks will be published in the near future.

Discover and Reporter:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)

(1) Background Related to Google

(1.1) What is

"DoubleClick is a subsidiary of Google which develops and provides Internet ad serving services. Its clients include agencies, marketers (Universal McCann, AKQA etc.) and publishers who serve customers like Microsoft, General Motors, Coca-Cola, Motorola, L'Oréal, Palm, Inc., Apple Inc., Visa USA, Nike, Carlsberg among others. DoubleClick's headquarters is in New York City, United States.

DoubleClick was founded in 1996 by Kevin O'Connor and Dwight Merriman. It was formerly listed as "DCLK" on the NASDAQ, and was purchased by private equity firms Hellman & Friedman and JMI Equity in July 2005. In March 2008, Google acquired DoubleClick for US$3.1 billion. Unlike many other dot-com companies, it survived the dot-com bubble and focuses on uploading ads and reporting their performance." (Wikipedia)

(1.2) Reports Related to Google Used by Spammers

(1.2.1) Google has been used by spammers for long time. The following is a report in 2008.

"The open redirect had become popular with spammers trying to lure users into clicking their links, as they could be made to look like safe URLs within Google's domain."

(1.2.2) Mitechmate published a blog related to spams in 2014.

" is recognized as a perilous adware application that causes unwanted redirections when surfing on the certain webpages. Actually it is another browser hijacker that aims to distribute frauds to make money.Commonly people pick up Ad.doubleclick virus when download softwares, browse porn site or read spam email attachments. It enters into computer sneakily after using computer is not just annoying, this malware traces users’ personal information, which would be utilized for cyber criminal."

(1.2.3) Malwarebytes posted a news related to malvertising in 2014.

"Large malvertising campaign under way involving DoubleClick and Zedo"

(2) System URL Redirection Vulnerabilities Details.

The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0. (64-bit) of Ubuntu (14.04),Apple Safari 6.1.6 of Mac OS X Lion 10.7.

Used webpages for the following tests. The webpage address is "". We can suppose that this webpage is malicious.



Related Posts:||

热度 ( 20 )
  1. 计算机网络技术夜落星起 转载了此图片  到 行者路上有風有雨有彩虹
  2. 计算机网络技术夜落星起 转载了此图片  到 绿意蛙鸣
  3. 计算机网络技术夜落星起 转载了此图片  到 IT 计算机&信息网络 技术
  4. 计算机网络技术夜落星起 转载了此图片
  5. 白帽子點滴的記錄 转载了此图片  到 竹意
  6. 白帽子點滴的記錄 转载了此图片  到 夜落星起
  7. 白帽子點滴的記錄 转载了此图片  到 湛天雲海碧波影
  8. 白帽子點滴的記錄 转载了此图片  到 文豆 & 文库
  9. 白帽子點滴的記錄 转载了此图片