Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

Post reply on HN
Print view View original

121–130 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#121

Post by Sanzig »

petee wrote: post #103
beeboobaa wrote: post #75

While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.

Im constantly reporting ads that are inappropriate, scams, or flat out illegal, usually they are back within a week or two, if they even get removed at all. My favorites are the dumb-brick phone charger that "magic defrags your phone", and the micro-ghost pistol.

I see so many binary options scam ads on YouTube, often with a very poorly deepfaked Elon Musk as a spokesman. Google never takes them down.

Maybe I should start reporting them to the securities regulator in my province instead - binary options were banned in Canada a few years ago as they are a haven for scammers and con artists. That might get better results.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#122

Post by jan_Sate »

Semaphor wrote: post #29
ryanjshaw wrote: post #27

Earlier quoted context omitted.

FF Android changes it to the ķeepass[.]info form. EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.

I just tried it and… it redirects me to the actual page https://keepass.info/ That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.

Those questionable websites often do redirection to a legit site like Google unless certain condition is met. For example, it could detect and only lead the user to the fake site if the user is coming from the ad. It's a common technique for them to avoid getting caught.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#123

Post by DannyBee »

mschuster91 wrote: post #112
DannyBee wrote: post #101

Earlier quoted context omitted.

Your math is off, without more data. What do you think the number of different ads being displayed is, given how much each ad costs? Estimates suggest it's about 30 billion ad impressions per day to earn that. If each distinct ad gets 1000 impressions, that's 10 billion ads to review per year. Let's be super generous, and assume it's 10k impressions, leaving us with 1 billion ads to review. Let's further assume it's…

So what? If Google is only profitable because the vast externalized costs to it are borne by society at large (e.g. malvertising, scams, unsafe "medical" products and supplements, competitors placing ads in an unfair way [1]), then maybe prices for advertising have to rise to match the prevention cost, or Google has to figure out other ways of staying profitable. I don't care all that much. And if it leads to less, b…

The so what is that the comment is completely and totally wrong in it's estimation of how simple or not it would be.

That is all.

We should decide what to do about it based on correct data and sane assumptions, not random assertions that are off by orders of magnitude and backed by no data.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#124

Post by LanceH »

Seeing as I have to jump through hoops with know-your-customer laws, it would be nice if companies had to do that also in all these instances that make life difficult.

* misleading ads

* spam phone callers

* counterfeit products on Amazon and the like

* email

Everything seems to be built to make me 100% reachable by any crook out there, yet I can't reach these companies enabling this through any means at all.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#125

Post by jowea »

SenAnder wrote: post #83
jowea wrote: post #73

Earlier quoted context omitted.

It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet. Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv

> that would be unfair They can install a browser plugin to convert punycode to their alphabet if they care so much for using it in URLs. There is no need to inflict this on peoples with safe alphabets. Alternately, highlight non-safe-ASCII-subset characters in a different color, as VS Code does.

Firefox (and maybe others) seem to use punycode instead of the rendered ASCII at least in this case.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#126

Post by Obscurity4340 »

hkt wrote: post #89
beeboobaa wrote: post #75

While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.

My seven year old kept being advertised shaving equipment, including razors. Obviously they know dad has a massive beard. Jokes aside though, I'd rather nobody be piqueing his interest in blades so I've adblocked the entire house.

It's be funny if there was baby shaving cream—like baby shampoo but shaving cream and for babies (as advertised on bottle)

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#127

Post by dogleash »

beeboobaa wrote: post #75

While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.

> they absolutely cannot be trusted with the responsibility of showing safe ads

That would mean having someone screen the ads. Google would need Foxconn nets for any building where they task people with watching youtube ads.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#128

Post by sccxy »

DannyBee wrote: post #120
sccxy wrote: post #114

Earlier quoted context omitted.

Strange explanation. If Google cannot handle legit business then it should manage their resources better. Advertising malware is not legit business. "We are so profitable and big" is not excuse for it. It is reason why they earn so much money, they do not care if criminals advertise malware. Now banks must spend awful lot of money to fight money laundering. Maybe it is time to force Google to take some responsibility…

"Advertising malware is not legit business." Sure. I"m pointing out this simple sort of "they can easily afford to do x" is usually nonsense. I haven't commented at all on what the result should be (not allowed to do it or whatever), simply that the math that it would be simple to fix is wrong. If we are going to argue about things in a useful way, we should avoid random assertions without data that don't really adva…

Sorry, but that is most fanboyish thing ever.

If Google cannot handle their ad business, when there are too many customers, then stop taking new customers.

Very simple.

But taking money from criminals is very profitable and that is the reason.

Edit: Checked DannyBee profile: "I manage developer workflow tools and services at Google"

That explains why he is defending Google's scammy behaviours.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#129

Post by WorldMaker »

dspillett wrote: post #86
rapind wrote: post #54

Earlier quoted context omitted.

ķ does look a lot like screen dirt though. ö not so much.

Also the , may be somewhat obscured by link underlining, which additions atop a letter would not be.

Modern typography in Firefox and Edge (I can't speak to Chrome as I don't have it installed) has actually done a great job of skipping underlines across descenders of all sorts (as proper underlining is supposed to do).

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#130

Post by ankit219 »

BLKNSLVR wrote: post #107

"the company has said it promptly removes fraudulent ads as soon as possible after they’re reported" If they wanted to be part of the solution they'd vet the ads before they're made public. But that doesn't scale, and so people get scammed and society suffers and Google makes more money than it knows what to do with. Pretty fair trade...? As others have said in one way or another, blocking internet advertising is par…

I guess it's a fine line. If Google starts pre screening ads and then bans somewhat legit ads - which may or may not look as legit - then we will see reports about them. Moderation is a tough problem to solve. We want convenience with the right stuff, and strong blocks with even slightly shady stuff. They are bound to miss a thing or two. Question here is that is this an edge case or a prominent one (as in do they have a lot of ads approved like these) with Google ads, which the article fails to answer.
Post reply on HN