Industry News

Google’s DoubleClick Advertising Platform Vulnerable to Open Redirect Attacks

Google’s DoubleClick advertising platform has been found vulnerable to Open Redirect attacks, according to the report by security researcher Wang Jing on the Tetraph blog.

Open Redirect vulnerabilities are not included in Google’s Bug Bounty program today due to its thorough measures against attacks leveraging this kind of flaw.

the-verge-is-not-safe-google-says-chrome-users-warned-of-tech-news-site-malware-content

“Since the wide usage of Google DoubleClick.net advertising system, it is very easy for attackers to use those vulnerabilities for spam and phishing,” researcher Wang Jing said via email. “During my test, almost all URLs belong to Google DoubleClick.net” have been found vulnerable.

URL Redirect vulnerabilities could be used to lure users to crafted pages for spam and phishing. URLs from Googleads.g.DoubleClick have also been found vulnerable to Open Redirect, which would allow attackers to craft more powerful attacks related to Google Accounts.

The main issue is that these “vulnerabilities can be used to attack other companies such as Google, eBay, The New York Times, e.g. by bypassing their Open Redirect filters(Covert Redirect).”

Wang Jing also proved that third-parties using the DoubleClick platform are affected by the Open Redirect vulnerability. Google, eBay and the New York Times are affected by a Covert Redirect vulnerability based on Googleads.g.doubleclick.net.

Even if redirect vulnerabilities are not as severe as SQL Injection or Cross-Site Scripting (XSS), “it is still a vulnerability that’s worth attention.”

“We all know the number of Google’s users is so large […] at the same time, large number of companies trust Google’s URLs. So I think it is not good for Google to ignore redirect vulnerabilities,” Wang Jing concluded.

The researcher also published a proof-of-concept video on YouTube in which he demonstrates flaw’s existence.

About the author

Lucian Ciolacu

Still the youngest Bitdefender News writer, Lucian is constantly after flash news in the security industry, especially when something is vulnerable or exploited. Besides digging for 'hacker' scoops and data leaks, he enjoys sports, such as football and tennis.
He has also combined an interest for social and political sciences, as a graduate of the Political Science Faculty, with a passion for guitar and computer games.

4 Comments

Click here to post a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.