Live data from Hacker News

Google-hosted malvertising leads to fake Keepass site that looks genuine

arstechnica.com

161–170 of 197 posts

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#161

Earlier quoted context omitted.

I don't do content moderation unless I'm getting paid or it's for a good cause. Neither of these things is true about Google ads.

Good cause is not being sued by attorney generals for promoting scams...

Ad viewers refusing to act as unpaid content moderators seems like a Google problem.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#162

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a resp…

> It makes me wonder if all the phishing and spam I'm reporting even does anything.

I'm usually first in line to hate on Google, but I report a lot of phishing to them and, at least when it comes to phishing sites being hosted by Google, they tend to take them down pretty quickly. I never get a response, and I assume that it's all automated, but it's a lot better than many other hosts. If you report a malicious website to namecheap it can remain online for months and, bad as they are, they aren't even the worst out there in terms of poor abuse handling. Google could do better, but they're really pretty good.

That said, this is just another example of why we should all be blocking ads. It keeps us all safer.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#163
post #139

Earlier quoted context omitted.

I did so too. Only that often, that I'm no longer able to report any ads at all.

If you can, you should escalate with google support. Thats pretty bullshit that they expect users to report ads, but penalize them for doing so. I pay, and if they cut me off for helping do their job, I'd be livid. Maybe being a paying customer is the reason they haven't blocked me yet

Where do I find this mythical “Google support”?

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#164

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a resp…

Are there real humans at Google who actually answer email? Google's strategy has always been to focus on the things that scale. Having a human answer a phone or a mail doesn't scale, so no customer service for the users. I think this is also the reason why these ads get through: to detect them they rely for a large part on crowd-sourcing: that "report a problem" link is IMHO one of their main mechanisms to deal with…

[dead]

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#165

Earlier quoted context omitted.

I think you're giving them an unnecessary pass, the incentives are completely in their favor: don't screen ads, make money off ads that are frauds, scams, age-inappropriate, etc... wait for "someone" to report those ads as such; meanwhile, keep making money off them, and the scammers/frauds/etc keep making marks. The human-friendly way would be to screen ads before airing them, which means hiring teams to do the scre…

I think I probably am giving them an unnecessary pass. There is another case in the below links about FB ads where Facebook banned an advertiser's account because of usage of words "panda" and "python". While that case is unrelated, if someone prescreens the ads without having the required context, (let's be real here, it would be reviewed by someone in Philippines or India, not USA) they are likely to block stuff th…

I don't see a problem with banning legitimate ads.

Please keep in mind that ads are messages that visitors never subscribed for. The only party that loses here is the advertiser, and I couldn't care less. In fact, the problem with advertising is that the customers are the advertisers, ads networks being biased to act in their favor, visitors being just the resources being sold.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#166

Earlier quoted context omitted.

I don't know if it still works, but plus triple double quotes used to work as a verbatim match. Iirc I picked it up here when they broke double quote search a while back (which they fixed at some point). But last I checked, +"""search phrase""" works

A tip I saw here a couple of weeks ago that restored some quality to searches was to, after searching, open the drop-down menu from “Tools”, select “all results” and then “verbatim”. I do all of my searches in incognito so sadly I don’t know if the options is remembered or not.

Huh, I didn't know that. I now use a meta engine, so I don't really keep up with Google dorking, but that is good to know for the few times I fall back to a Google search.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#167

Earlier quoted context omitted.

I don't know if it still works, but plus triple double quotes used to work as a verbatim match. Iirc I picked it up here when they broke double quote search a while back (which they fixed at some point). But last I checked, +"""search phrase""" works

A tip I saw here a couple of weeks ago that restored some quality to searches was to, after searching, open the drop-down menu from “Tools”, select “all results” and then “verbatim”. I do all of my searches in incognito so sadly I don’t know if the options is remembered or not.

Ah! That sounds like a life saver!

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#168
post #118
post #19

Earlier quoted context omitted.

Someone saving themselves 3 keypresses, approximately 1.5 seconds effort and causing a flurry of unneccesary replies.

"uBo" "uBlock Origin" How is that a difference of 3 keys?

> Someone saving themselves [a trivial amount of] effort and causing a flurry of unneccesary replies.

I don't get the impression that their point is much changed by it being 3 keys instead of... 11 by my count (10 if you don't count shift for the capital O).

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#169
Yet another day I'm glad I've protected my family with network-wide ad blocking through pihole. Slowly they've learned that clicking on the top links ("sponsored") don't work so now they're trained to look for the first organic search result whenever using Google.

Re: Google-hosted malvertising leads to fake Keepass site that looks genuine

#170
post #124

Seeing as I have to jump through hoops with know-your-customer laws, it would be nice if companies had to do that also in all these instances that make life difficult. * misleading ads * spam phone callers * counterfeit products on Amazon and the like * email Everything seems to be built to make me 100% reachable by any crook out there, yet I can't reach these companies enabling this through any means at all.

This. The information asymmetry that underlies the scam economy absolutely infuriates me.
Post reply on HN