Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

171–180 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#171

Post by Solvency »

johnklos wrote: post #119

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a resp…

In 2007 I had posted something on a message board that personally identified me. I had the post removed from the forum but it was captured on Google's result summary. I literally emailed Google asking if they could remove it and they not only did, someone responded saying "done."

Such a different era.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#172

Post by Flott »

In Firefox about:config switching network.IDN_show_punycode to true could HELP spotting these kind of scams. But I believe that, in the end, once it's showing in Google results, it's game over.

Ads in search result are looking close enough to regular search result for people to just trust it and click.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#173

Post by godelski »

DistractionRect wrote: post #142
giancarlostoro wrote: post #136

Earlier quoted context omitted.

To be even more frank, Google's search capabilities diminished around late 2000s early 2010s for me. I used to be able to write out anything verbatim and find it. Now I can't even get the double quotes trick to work properly. Google's strengths have been slowly crippled for years. Windows has a similar problem: marketing / ads is ruining an otherwise decent product.

I don't know if it still works, but plus triple double quotes used to work as a verbatim match. Iirc I picked it up here when they broke double quote search a while back (which they fixed at some point). But last I checked, +"""search phrase""" works

Lately I've been finding that quoting doesn't have strong effects and even more frustratingly "-" appears to no longer do anything. So instead of filtering out the word it just ends up giving me that word more and I have to search some complex baby robot speech to get nuanced results. Or maybe Google just hates me

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#174

Post by jrnichols »

johnklos wrote: post #119

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a resp…

have you run into websites that stop working because of this?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#175

Post by lolc »

quietpain wrote: post #141
johnklos wrote: post #119

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a resp…

Are there real humans at Google who actually answer email? Google's strategy has always been to focus on the things that scale. Having a human answer a phone or a mail doesn't scale, so no customer service for the users. I think this is also the reason why these ads get through: to detect them they rely for a large part on crowd-sourcing: that "report a problem" link is IMHO one of their main mechanisms to deal with…

I never report anything to Google. They don't give back.

When I try to report mail spam from their network they want me to fill out a form instead of reading the abuse mail they got.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#176

Post by burnished »

rapind wrote: post #54
rob74 wrote: post #47

Earlier quoted context omitted.

The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?

ķ does look a lot like screen dirt though. ö not so much.

I tried to brush the dust off my screen before reading reading your comment. Can confirm, does look like dust

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#177

Post by WirelessGigabit »

The fact that they're using Punycode is only a secondary problem.

The first one is that Google Ads allow you to show an arbitrary URL below your ad without you showing that you own it.

The second one is allowing the URL shown to be different from where you send the users.

But I would like to see an option to render URLs as Punycode, and not their original form.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#178

Post by acdha »

sccxy wrote: post #9
miohtama wrote: post #2

One solution to mitigate malverising is as transparency. Each as should contain the legal contact details (company name, country) of the advertiser. It does not solve the issue fully, but consumers will surely avoid East European suspicious companies advertising. It will also make it easier for the security researchers to track down bad actors and will bring some liability to the ad platform (Google). Facebook alread…

Why East European are suspicious? Little xenophobic?

Some countries had notable levels of crime because they had the combination of smart techies with limited earning potential in their home country and governments which were either ineffectual or corrupt enough that they could make a substantial criminal income without going to jail. Similarly, the reason Nigeria was best know for phishing for years wasn’t that the people were unusually criminally-inclined but that many of their talented young people had the choice between being honest and poor or wildly rich, and unsurprising some fraction chased the easy money. Anywhere you don’t have great economic prospects for a lot of people will have this problem.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#179

Post by [deleted] »

rangerelf wrote: post #144
ankit219 wrote: post #130

Earlier quoted context omitted.

I guess it's a fine line. If Google starts pre screening ads and then bans somewhat legit ads - which may or may not look as legit - then we will see reports about them. Moderation is a tough problem to solve. We want convenience with the right stuff, and strong blocks with even slightly shady stuff. They are bound to miss a thing or two. Question here is that is this an edge case or a prominent one (as in do they ha…

I think you're giving them an unnecessary pass, the incentives are completely in their favor: don't screen ads, make money off ads that are frauds, scams, age-inappropriate, etc... wait for "someone" to report those ads as such; meanwhile, keep making money off them, and the scammers/frauds/etc keep making marks. The human-friendly way would be to screen ads before airing them, which means hiring teams to do the scre…

[deleted]

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#180

Post by millzlane »

ipython wrote: post #169

Yet another day I'm glad I've protected my family with network-wide ad blocking through pihole. Slowly they've learned that clicking on the top links ("sponsored") don't work so now they're trained to look for the first organic search result whenever using Google.

With uBO rules, I don't even see those top results.

https://github.com/gorhill/uBlock

Post reply on HN