Search: Home Bugtraq Vulnerabilities Mailing Lists Jobs Tools Beta Programs
Digg this story   Add to del.icio.us  
Google Home Biz Kit is NOT endorsed by Google
John Park, Symantec Security Response 2009-06-29

During one of my recent journeys around the Internet there was a particular ad being displayed on a website that caught my attention. The type of ad I am referring to wasn’t a totally new concept—ads like it have been running on websites for years, and actually found their start in print in the decades previous. You must have seen them. These are the ads that promise incredible monetary returns for working from home, but without doing a lot of work. Recently, this site and many others have been serving "Google pays me $5k a month" ads:

 

 

 

 

These particular ads usually redirect users to one of the following sites:


jamesmakesmoney.com
jasongetsrich.com
jennifersmoneyblog.com
joshmadecash.com
kevinmakesmoola.com
marylifeblog.com
matthewsmoney.com
scottsmoneyblog.com


All of the above sites bear the same theme in their domain name of blog.com. It is always some sort of blog site that is telling a life story and offering the greatest secret of online advertising called the "Google Home Biz Kit." All I need to do to get one of these kits is to pay for the shipping:

 

 

 

 

Because the website design is not “Google-esque,” it is not that difficult to spot that the Google Home Biz Kit is not endorsed by Google. But, for a couple of bucks, what have I got to lose?


The catch is, what you are getting is not just the Google Home Biz Kit. You are also agreeing with them to charge you $40 to $80 each month for the membership, which has not been mentioned in the checkout page (only in the fine print in the terms and conditions page):

 

 

 

 

By the time you notice the extra charges on your credit card bill, you will have already spent more than you bargained for. You could cancel it at that time, but you are not entitled to any refund according to their terms and conditions.


Now, I am not bashing the membership revenue model, which is a valid payment plan if disclosed properly. These ads aren’t unique to one particular site, since other ads in popular ad networks have similar revenue generation techniques. For example, the following advertisement was displayed recently while I was viewing my webmail:

 

 

 

 

When I clicked on it, it brought me to a personal blog site. "My name is ___ and I lost 50lb, too good to be true? You can try this pill for free. Just pay shipping."


Sound familiar? These hidden membership charge schemes don’t exist without the knowledge of major ad networks. The ad network support forums are plastered with complaints about these sites:

 

 

 

 

The latest scheme goes beyond using fake blogs and instead uses bogus newspaper websites such as:


losangeles-tribune.com/finance
nyguardian.com
theatlantatribune.com
thenewyorktimesonline.net
thesanfranciscotribune.com
usajobjournal.com

 

 

 

 

 

This might sound like a broken record, but here are some guidelines when purchasing online:


1) If it sounds too good to be true, then it is likely not to be true.


2) If you still think it is a good deal and decide to buy, then be cautious. Read the fine print. Use a one-time-use credit card number if you can.


3) If you have already fallen for a scheme, then contact your credit card company to try to get a refund. If that doesn’t work, in the United States you can contact your state’s attorney general’s office, Better Business Bureau, or the FTC or similar office in other jurisdictions.

 

 

 

 

 

 

 

 

 

Message Edited by Trevor Mack on 06-29-2009 11:21 AM



The information, views, and opinions contained on this page are those of the author and do not necessarily reflect the views and opinions of SecurityFocus.






 

Privacy Statement
Copyright 2008, SecurityFocus