Re:GIMP: Targeted Attack via a Google Ad
by cmeacham98 on Saturday October 29, 2022 @12:32PM
(#33385590)
I can't get the ad to show up for me, but maybe GIMP has an open redirect on their website and the malvertiser is taking advantage of that?
[ Parent
| on HN ]
Re:GIMP: Targeted Attack via a Google Ad
by hddqsb on Saturday October 29, 2022 @01:03PM
(#33385902)
That's what I thought too, but I managed to get the malicious ad and confirmed that it's a destination mismatch in Google Ads rather than an open redirect (no requests to gimp.org in the network monitor).
Re:GIMP: Targeted Attack via a Google Ad
by cuttysnark on Saturday October 29, 2022 @01:56PM
(#33386405)
I had to search for "gimp.org" to get the ad to be the first result; just searching "gimp" doesn't return the ad.
The scam ad says "gimp.org" but if you follow it, the landing page is hosted at gimp.monster. It's a clone of the proper gimp.org with a the download instead pointing to who-knows-what .exe on Dropbox.
WHOIS gimp.monster has WHOIS-guard, but the Icelandic "privacy" address turns up a bunch of Reddit links about scam sites. Namecheap is the common thread, but that's hardly a lead.