Experts: Google Doesn't Police Advertisers

Follow the Trail

The security company traced the malware distribution scheme back to Smarttracker.org, a domain name registered in early April that began advertising on Google soon thereafter. The fraudulent advertisements all funneled users through infected Smarttracker URLs, Thompson said.

Google officials said that the search company canceled the affected ads after it was informed of the situation. Media representatives with Google said the firm is aggressively working to eliminate such problems.

"We actively work to detect and remove sites that serve malware to our users both in our ad network and in our search results," the company said in a statement. "We have manual and automatic processes in place to detect and enforce these policies; we also encourage our advertisers to contact Google directly if they have concerns or detect suspicious malware."

Thompson and other security experts claim, however, that the problem exists because Google does not sufficiently police its advertisers.

"Google says they are doing the best that they can, but their business model is to take as much money as they can for advertisements. No matter how much due diligence they do, it's a difficult position to be in, but clearly they are not doing enough," Thompson said. "If they don't do a better job of vetting their customers, we will see this sort of thing happening again and again."

Thompson pointed out that his company only caught on to the problem because the attackers were using malware exploits that were discovered and fed into its LinkScanner software. If the malware brokers had used new code and varied their attacks, it is likely that the hacks would have carried on unnoticed for a longer period of time, he said.

The hacks involved were of danger to users of Microsoft Windows software who had not updated their machines with current security patches.

"We started seeing links back to Smarttracker but didn't figure out how they were hooking people until someone happened to stumble upon the ads in their normal Web surfing. Nobody knows where to look for this stuff without that kind of luck," Thompson said. "The domains these people can use are infinite, but the exploits are recognizable, so that's why we caught them at all."

One person unsurprised by the unfolding infected Google ad scenario is Ben Edelman, a well-known expert on legal issues affecting the Internet and online advertising, who is employed as an assistant professor at Harvard Business School.

Edelman has been following unsavory tactics carried out by malware and adware distributors for years, and said that he had observed similar activity on Google as far back as one year ago.

In addition to allowing hackers to pervert AdWords by using the system to trick end-users into consuming malware, the Harvard-trained lawyer pointed out that Google also allows people to post dishonest advertisements that offer paid downloads of free software applications, such as the Skype Internet-calling tool.

"The big problem is that Google sells ads to anyone, without completing any due diligence to determine who they are or that the content they are advertising is legitimate," Edelman said. "We've been writing about this problem for years and nothing has been done about it. Apparently anyone who pays the bills is good enough for Google."

The expert noted that people trust Google because it is a large, successful online company. The infected ads may even show up on the company's Gmail Web mail client, Edelman said, which requires users to register with the site and use passwords to access their accounts, creating another false level of protection from threats.

"People treat sponsored results as safe because they believe that Google has filtered out the bad stuff, which they should, because legitimate publishers such as print or broadcast companies do that," Edelman said. "It's highly likely that these malicious ads appear throughout the Google network, including in Gmail, and they may also show up on sites like AOL and Ask.com that are advertising syndicates."

Edelman said that the only answer to the problem, which he said affects most search engines, not just Google, is for the involved companies to better police their advertisers, or for lawmakers to force them to do so.

"I think a lot of people might favor legislation to make it clear that search engines have the same responsibility to verify ads that print publications have today," Edelman said. "It's the search engine companies' responsibility to do a better job of protecting their users."