Google could avoid future malware attacks carried out using advertisements posted on its Web sites if the company more thoroughly investigated customers of its AdWords system, according to security and legal experts.
On April 25, researchers with security software maker Exploit Prevention Labs announced that they had uncovered hard evidence that malware distributors were using advertisements placed via Google's automated AdWords system to infect unsuspecting end-users with virus code.
According to Roger Thompson, chief technology officer at Exploit, based in New Kingstown, Pa., the malware brokers used fraudulent advertisements for legitimate organizations such as the Better Business Bureau to trick users into clicking on the links.
When someone clicked such a link, the ad would redirect their browser through URLs that attempted to automatically download virus programs onto their computers before passing them along to the actual sites that were advertised. The system works so quickly that end-users do not notice that their browsers have traveled through the intermediary sites, making it almost impossible to detect the attacks, Thompson said.
Using AdWords, any company or individual can bid on specific terms to have their ads show up next to Web search results for the specific words they have purchased. People who bid the most money for any particular term or set of words receive the highest ad placement, or so-called sponsored links, next to Google's Web search results.
Thompson said that his team discovered a number of the ad-borne threats built to show up alongside results for a range of search terms, including queries for information on business conferences and auto shows. Many others involved terms related to business organizations.
The company said it only found the threats after one of its customers noticed the suspicious activity using the software maker's secure Web surfing application.
When the individual entered the phrase "how to start a business" into Google, the top-ranked sponsored search listing advertised AllBusiness.com, a legitimate organization, but the hyperlink it offered led to a site that attempted to install a password-stealing keystroke logging attack on the user's PC, according to Exploit.