Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bing has been serving up malicious Google Chrome ads for months

forbes.com

Post reply on HN
Print view View original

61–70 of 249 posts

Re: Bing has been serving up malicious Google Chrome ads for months

#61

Post by matt4077 »

jamieweb wrote: post #15
ocdtrekkie wrote: post #9

Earlier quoted context omitted.

Given the malware Google's ads also ship, which Googlers here on HN have tried to have removed only to return an hour later, suffice to say malicious ads are an industry pervasive problem, and the solution is to kill the online advertising market. Aggressively. In fact, when I tried to look for a specific class of malicious ads (looking for "mapquest") recently, DuckDuckGo was even as bad as Google, it was Bing who g…

Nowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites. I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.

I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years?

Now I'm sure you can dig up some vulnerabilities, and a select few of them may even had (remote) exploits. But I've never run into any problems, and I'm not especially careful, have been around the seedy underbelly of the web, and don't run any anti-virus. Just not clicking on any .exe that suddenly downloads seems to be enough. Being on MacOS rather than Windows may also help, although as far as I can tell, security on Windows today is also far far better than it was a decade or so ago.

Considering all that, I can't shake the suspicion that people complaining about JS vulnerabilities to defend their use of ad blockers are just searching for justification.

Re: Bing has been serving up malicious Google Chrome ads for months

#62

Post by jimmaswell »

greenyoda wrote: post #3

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

It does come with Internet Explorer too, but I'm sure that also defaults to Bing.

Re: Bing has been serving up malicious Google Chrome ads for months

#63

Post by greglindahl »

vezycash wrote: post #42
beager wrote: post #17

Earlier quoted context omitted.

> Bing makes it clear when a site is promoted by prepending "ad" to the search result. Other search engines such as DuckDuckGo and Google do the same. They very specifically do not make it clear, they (and I mean all of them) intend to make sponsored results look as identical as possible to organic results to improve the likelihood that you'll click them. They only have subtle markings showing that they're ads becaus…

>the Bing ad shows the domain as `google.com There's a reason for this - ad tracking for conversion, performance or even to make sure the advertising network is honest. The ad tracking domain is not always the same as destination domain. AFAIK, this problem seems easily solved. All Ms has to do is flag ads whose displayed URL do not match the final URL for manual review. Or simply ban it.

Bing and Google have always paid a lot of attention to the "landing page" for search ads, and they have a lot of technology to make sure that the landing page for an ad doesn't change after they've reviewed it.

Still, fraudsters have ways of changing the landing page to something different. In this case someone seems to have successfully convinced bing that the landing page domain is google.com -- it's unlikely that it's "easily solved". Or that the next one will be easily solved.

Re: Bing has been serving up malicious Google Chrome ads for months

#64

Post by matt4077 »

jamieweb wrote: post #10

Using browsers to download software should never have become the standard practice... Linux got it right with the built-in package repositories. Unfortunately Windows and Mac have never really adopted the super-easy "apt install this" style.

The Mac experience is almost identical, except that the App Store has a GUI (although Linux distributions also have those these days, I hear). Apple regularly gets lots of grief here because people have been suspicious they want to shut down distribution outside of the store.

I have my doubts that any Linux distribution is capable of auditing every line of every package they distribute, so I think the relative lack of malware on Linux (and possibly MacOS as well) may not actually be caused the specific method of distribution.

Re: Bing has been serving up malicious Google Chrome ads for months

#65

Post by josteink »

greenyoda wrote: post #3

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"?

Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome.

My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

Re: Bing has been serving up malicious Google Chrome ads for months

#66

Post by 43920 »

joshuamorton wrote: post #45
ocdtrekkie wrote: post #44

Earlier quoted context omitted.

FYI, just screenshot after reading this comment: https://imgur.com/a/zZCcXc2 Malicious ads pretending to be MapQuest remain alive and well. After pausing my Pi-hole, I can confirm that it refuses to actually provide directions when asked, and promptly tries to add an extension to my web browser. Part of the problem with ad platforms like these (including Bing's), is even if you report one and take it down, it's trivi…

That's very peculiar. I was running in incognito with no adblock, and checked across multiple devices and multiple internet connections, so you seem to be uniquely affected.

I can see them as well: https://imgur.com/a/2r3NW8i. Maybe it's location-dependent?

Re: Bing has been serving up malicious Google Chrome ads for months

#67

Post by bad_user »

matt4077 wrote: post #61
jamieweb wrote: post #15

Earlier quoted context omitted.

Nowadays it's impossible to support the creators you enjoy online by whitelisting ads without exposing your device to multiple megabytes of untrusted, vulnerability-filled JS and iFrames with links off to malware sites. I think that the sponsorship model many YouTubers use these days works really well, because there isn't any code involved that I have to run.

I don't remember "untrusted JS" being any sort of problem in the last, say, 10 years? Now I'm sure you can dig up some vulnerabilities, and a select few of them may even had (remote) exploits. But I've never run into any problems, and I'm not especially careful, have been around the seedy underbelly of the web, and don't run any anti-virus. Just not clicking on any .exe that suddenly downloads seems to be enough. Bei…

Obviously. Which is why we also have browser extensions that work around paywalls.

People are cheap and don’t want to pay for content, it’s as simple as that.

Re: Bing has been serving up malicious Google Chrome ads for months

#68

Post by blotter_paper »

greenyoda wrote: post #3

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

>If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"?

Use Edge to download Firefox, and Firefox to download Chrome ;)

Re: Bing has been serving up malicious Google Chrome ads for months

#69

Post by TaylorAlexander »

josteink wrote: post #65
greenyoda wrote: post #3

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome. My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

This is a tangent/pile-on, but this is not the only dark pattern google engages in. I absolutely do not want YouTube Red. Any software that respects the user would let you dismiss the offer with an option for “do not ask me again.” And yet, because the software is not respecting the user, YouTube asks me ad nauseum if I want to upgrade to YouTube Red. No. I do not. But I don’t get an option for no. There is something like “yes” and “maybe later.” No google. My answer is no. Please respect me enough to let me make that choice.

Re: Bing has been serving up malicious Google Chrome ads for months

#70

Post by gpm »

pavel_lishin wrote: post #56
beagle3 wrote: post #51

.. and that's why running an ad-blocker these days is not even a moral question; It's proper hygiene. I don't eat without washing my hands first, and I don't browse without an ad blocker.

But if you don't eat with filthy hands, you'll be putting antibiotic content creators out of business!

Also your immune system - which might be a bit of an issue.
Post reply on HN