Live data from Hacker News

Bing has been serving up malicious Google Chrome ads for months

forbes.com

11–20 of 249 posts

Re: Bing has been serving up malicious Google Chrome ads for months

#12

Using browsers to download software should never have become the standard practice... Linux got it right with the built-in package repositories. Unfortunately Windows and Mac have never really adopted the super-easy "apt install this" style.

How would you know what "this" should be without using a browser?

Re: Bing has been serving up malicious Google Chrome ads for months

#13
post #4

This has been happening for so long that it's hard to believe Microsoft is not aware of it.

Given the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who g…

One solution that would go part way there is signed for browsers to only run signed javascript when it originates off site. Common libraries that are distributed via CDNs can be signed, and any javascript that ships with ads would have to be signed too. And any CA that signs too many malware (too many meaning more than one) gets their cert revoked.

Re: Bing has been serving up malicious Google Chrome ads for months

#14
post #2

Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. It is near impossible for Bing to manually review every advert so perhaps it would be beneficial for search engines to provide a way for users to report rouge promoted links, similar to how YouTube allows you to report its sidebar ads.

> It is near impossible for Bing to manually review every advert Why? Are there hundreds of ad campaigns being created per second?

[deleted]

Re: Bing has been serving up malicious Google Chrome ads for months

#15
post #4

This has been happening for so long that it's hard to believe Microsoft is not aware of it.

Given the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who g…

Nowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites.

I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.

Re: Bing has been serving up malicious Google Chrome ads for months

#17
post #2

Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. It is near impossible for Bing to manually review every advert so perhaps it would be beneficial for search engines to provide a way for users to report rouge promoted links, similar to how YouTube allows you to report its sidebar ads.

> Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same.

They very specifically do not make it clear, they (and I mean all of them) intend to make sponsored results look as identical as possible to organic results to improve the likelihood that you'll click them. They only have subtle markings showing that they're ads because if they didn't, such an abuse of trust would be ruinous to any search engine.

What's even worse here is that in the linked video, the Bing ad shows the domain as `google.com`, which is something you expect to be accurately represented in any listing, organic or paid. That's the sort of thing that should be ruinous to Bing.

Re: Bing has been serving up malicious Google Chrome ads for months

#18

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

> And the problem seems to have been fixed. When I search for chrome download on Bing, the top result is https://www.google.com/chrome.

Which could be faked, as seen in the referenced tweet: https://twitter.com/GabrielLandau/status/1055300918101598208 Yes, they show the word "Ad", alongside the domain name "google.com" - except the user doesn't end up on "google.com".

Re: Bing has been serving up malicious Google Chrome ads for months

#19
post #12

Using browsers to download software should never have become the standard practice... Linux got it right with the built-in package repositories. Unfortunately Windows and Mac have never really adopted the super-easy "apt install this" style.

How would you know what "this" should be without using a browser?

1. You search info about "this" in your browser

2. You install "this" with your package manager

3. Even if the "this" installed wasn't the "this" you read about in your browser, it still came from your package manager repos, which you could consider safe, and you'll be able to uninstall it cleanly.

Then I look at the Windows Store and weep.

Re: Bing has been serving up malicious Google Chrome ads for months

#20
post #12

Using browsers to download software should never have become the standard practice... Linux got it right with the built-in package repositories. Unfortunately Windows and Mac have never really adopted the super-easy "apt install this" style.

How would you know what "this" should be without using a browser?

“apt search this”
Post reply on HN