If you’re running Google Ads, you’re likely familiar with its importance in driving quality leads for your business. In fact, for many businesses, Google Ads is not just a tool but a lifeline for generating new customers. When everything works smoothly, confidence in your campaigns grows, and so do your expectations.

But Google Ads can sometimes throw a wrench into your plans—accounts may get suspended, ads disapproved, or results don’t meet expectations. One particularly frustrating issue is when Google notifies you that your website is compromised, leading to ad disapprovals.

In the last few days, I've posted about the compromise of the Facebook pages of Walmart Careers and Pfizer. These have been noted as two separate incidents, the latter being attributed to a group called Script Kiddies. Today, an arm of the collective known as Anonymous compromised the Twitter account of former Colombian President, Alvaro Uribe and the Facebook page of current Colombian President, Juan Manuel Santos.

Twitter page of Former President Alvaro Uribe's Twitter: 

Facebook page of President Juan Manuel Santos:  

(image courtesy of 24-7 Reviews)

Yesterday, I blogged about the Walmart Careers page being compromised and subsequently taken down. Today, pharmaceutical giant Pfizer saw its Facebook page compromised and taken down as well.

While no individual or group has taken credit for the Walmart Careers page incident, a group called Script Kiddies let it be known that they were the ones behind the takedown of the Pfizer Facebook page.

Earlier this evening, Walmart's Careers page on Facebook was compromised.

Two suspicious posts appeared on the Walmart Careers page.

The first:

Walmart will no longer be accepting applications from anyone of African-American decent, read more here: http://walmartstores.com/careers

The second:

In regards to our last update, our studies in the past have shown that "African-Americans" tend to steal more often and have a significantly worse work ethic than those of Mexican, and Caucasian ethnicity's. 

In addition to these posts, Walmart's main profile image for their careers page was defaced with an "X" mark over the face of an African-American employee featured in the photograph.

Walmart employees and loyal devotees to the brand became suspicious and reported the activity.

Within a short amount of time, the images disappeared, but the offending posts remained. Not long after the images were taken down, the Walmart careers page was taken down entirely. It is uncertain whether Walmart employees were involved in the takedown or if those behind the compromise removed the page themselves. Facebook Pages and Admins

Over the last few years, big brands and small businesses have adopted social media into their marketing strategy. One of the key features that Facebook pages offer these brands is ability to have multiple administrators for a page. These administrators are granted access through their personal Facebook accounts. Therefore, it is likely that whomever obtained access to the Walmart Careers page did so by compromising an administrator's Facebook account.

Whether to Phish or to FireSheep?

Uncertain as it may be to determine the exact method used to compromise an admin account, there are a few likely suspects (note: this is my own speculation):

Phishing - This method requires a little more work but, if a Walmart employee that was an administrator for this page was phished on their personal account, the scammers would gain access to the Facebook page with relative ease.

FireSheep - This is a free Firefox extension that gives users the ability to hijack unencrypted sessions on public WiFi networks. It is possible that an administrator of this page was browsing Facebook without HTTPS enabled on a public WiFi network, such as a Starbucks. A scammer may have been sitting on the network and discovered this account was tied to the Walmart careers page.

Don't forget to Enable HTTPS

This incident should serve as a reminder to many marketing employees as well as Facebook users in general. If you haven't done so already, enable HTTPS for all of your social networking accounts.

Interesting research by Wayne at Armorize on an on-going campaign that is being dubbed as a 'Mass Meshing Injection' attack. When a legitimate website is compromised/infected, typically through an SQL Injection, it contains a "redirector" script (javascript) that points to a not-so-legitimate site that leads the user to the exploit site. It looks like this: Mass SQL Injection: Compromised Legitimate Site -> Redirector Site -> Exploit Site 

In the case of Mass Meshing Injection, the redirector site is replaced with another legitimate site that has been compromised. Mass Meshing Injection: Compromised Legitimate Site -> Compromised Legitimate Site -> Exploit Site

In the case of Mass SQL Injections, blacklisting the redirector sites was sufficient. This new method makes that more difficult:

And so the end result is, [in]side the infected webpages, there is no more statically injected "malicious redirectors" that security vendors can detect. Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts. 

Researchers at Armorize have discovered that the Amnesty International UK site was recently compromised, serving up the latest Adobe 0-day vulnerability to visitors of the site (which was recently patched).  However, this isn't some ordinary drive-by download.  Instead, it is being delivered in to users in a different way:

The method of attack is a variation of the drive-by download mechanism; we dub it "drive-by cache." This mechanism makes the infection harder to detect than drive-by download.

The researchers go on to describe more details of the attack, including why this differs from a drive-by-download.

After being executed, it doesn't make an attempt to download a file and write it to disk. Instead, it locates the malware which is already sitting in the browser's cache directory, and executes it.  And that's why we take out the word download and dub it drive-by cache.

They note that 0 out of 40 antivirus vendors detect the malicious flash file (.swf).  The malicious binary that is used in the drive-by-caching was only detected by a single antivirus solution out of 40 other offerings used on VirusTotal.