Bing has been serving up malicious Google Chrome ads for months

Post by nradov » Sun, Oct 28, 2018, 3:40 AM UTC

sneak wrote: post #138

EpicEng wrote: post #122

Earlier quoted context omitted.

There was a short time about seven years ago when Google was returning a malicious link for Blizard's BattleNet. Had my WoW creds stolen and I wasn't what you would call naive on a computer.

It is important to remember that phishing works against even experienced and savvy users who know about phishing, and that effective countermeasures for these types of attacks do not include “replace users with smarter users”.

Post by chrisweekly » Sun, Oct 28, 2018, 3:48 AM UTC

josteink wrote: post #65

greenyoda wrote: post #3

The title of this article is deceptive clickbait.[1] The problem has nothing to do with the Edge browser, it has to do with search results returned by Bing, which happens to be Edge's default search engine. If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? So "stop using Edge to download Chrome" is not useful advice. Better advice…

> If you have a new Windows 10 PC and want to download Chrome, how else could you do it besides "using Microsoft Edge to download Chrome"? Simply visit Google.com, Gmail, Youtube or any other Google-site and await the Chrome-spam 100% guaranteed to appear in any browser not Chrome. My favorite one: “Upgrade your browser”. Not misleading at all, eh? How about “no”?

Post by Dylan16807 » Sun, Oct 28, 2018, 3:52 AM UTC

partiallypro wrote: post #142

Dylan16807 wrote: post #130

Earlier quoted context omitted.

Browsers are banned from the Windows Store. For 'security' reasons. It's tricky to get win32 apps in general into it, too.

No they aren't, the UC Browser is listed in the Windows store (third most popular mobile browser in the world,) along with some others. Microsoft has been very willing to help companies list Win32 apps in the Windows store, especially large ones.

Post by arminiusreturns » Sun, Oct 28, 2018, 4:06 AM UTC

solarkraft wrote: post #83

arminiusreturns wrote: post #60

Earlier quoted context omitted.

I spent some time trying to understand googles ads and seo structure for a project, as a sysadmin. My conclusion was the reason greyhat and blackhat techniques werent dealt with was because they make too much money from it... I wrote a big report on it, but that was the gist. Im sure the same is true of MS et al.

If the report is public, would you link it?

Post by stordoff » Sun, Oct 28, 2018, 4:14 AM UTC

jamieweb wrote: post #78

Xylakant wrote: post #48

Earlier quoted context omitted.

So how does that prevent a malicious PPA or repo that the attacker could push up in the search rankings? Just like the attacker here pushed up a malicious download page in the search rankings?

It doesn't in this case, however you can determine that the chromium-team ppa is the official one in Ubuntu by following links from the Chromium website. The security of the package repository system falls down when people add apt signing keys that are untrusted/unverified, which is what happens when you add a ppa in Ubuntu.