Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Scammers Use Google Ads To Inject Phony Help Lines On Apple, Microsoft
Sites

Link: https://tech.slashdot.org/story/25/06/18/2317...

An anonymous reader quotes a report from Ars Technica: Tech support scammers
have devised a method to inject their fake phone numbers into webpages when a
target's web browser visits official sites for Apple, PayPal, Netflix, and
other companies. The ruse, outlined in a post on Wednesday from security firm
Malwarebytes, threatens to trick users into calling the malicious numbers
even when they think they're taking measures to prevent falling for such
scams. One of the more common pieces of security advice is to carefully
scrutinize the address bar of a browser to ensure it's pointing to an
organization's official website. The ongoing scam is able to bypass such
checks. The unknown actors behind the scam begin by buying Google ads that
appear at the top of search results for Microsoft, Apple, HP, PayPal,
Netflix, and other sites. While Google displays only the scheme and host name
of the site the ad links to (for instance, https://www.microsoft.com/ the ad
appends parameters to the path to the right of that address. When a target
clicks on the ad, it opens a page on the official site. The appended
parameters then inject fake phone numbers into the page the target sees.
Google requires ads to display the official domain they link to, but the
company allows parameters to be added to the right of it that aren't visible.
The scammers are taking advantage of this by adding strings to the right of
the hostname. The parameters aren't displayed in the Google ad, so a target
has no obvious reason to suspect anything is amiss. When clicked on, the ad
leads to the correct hostname. The appended parameters, however, inject a
fake phone number into the webpage the target sees. The technique works on
most browsers and against most websites. Malwarebytes.com was among the sites
affected until recently, when the site began filtering out the malicious
parameters.

Read more of this story at Slashdot.

---
VRSS v2.1.180528