6 ms·

Genuine question: has google ads been responsible for virus/malware in the past? I thought they were, while still annoying, safe from serving such content. So

by chrisan 10y ago

Genuine question: has google ads been responsible for virus/malware in the past? I thought they were, while still annoying, safe from serving such content. So much that if they detect your site has malware they prevent it from serving their ads https://support.google.com/adwordspolicy/answer/1308246?hl=en https://support.google.com/adwordspolicy/answer/1308246?hl=e... As such I went along with allowing google ads since it seemed like a good middle ground between not wanting to have everything pay-walled off and still allowing sites to generate ad money

pricechild 10y ago
Here's one such claim: https://securelist.com/blog/incidents/75731/good-morning-android/ https://securelist.com/blog/incidents/75731/good-morning-and...
arthurfm 10y ago
> has google ads been responsible for virus/malware in the past? Yes. http://blog.trendmicro.com/trendlabs-security-intelligence/youtube-ads-lead-to-exploit-kits-hit-us-victims/ http://blog.trendmicro.com/trendlabs-security-intelligence/y...
- victorhooi 10y ago
  I read the article - it's an interesting read. The claim is that a YouTube ad was serving malware. However, upon reading the article, it seems that: 1. Somebody purchased legitimate YouTube ad space. 2. They then redirected that traffic twice through two other legitimate ad networks. 3. They then broke into a Polish government website, and funnelled the traffic there, to serve up malware. That certainly doesn't seem to be a case of Google/YouTube serving up malware - if anything, these attacks went to a lot of trouble to obscure from YouTube what they were doing, precisely so they wouldn't get shut-down (presumably by either YouTube, or the two other ad networks they were piggy-backing on). You could argue, they should have caught them earlier - but isn't that a bit like blaming your email provider that you got a spam/malware email - when the actual party to blame is the person sending you aforesaid spam/malware?
  - teej 10y ago
    I'm not sure what you expect "Google ads serving malware" to mean other than exactly this. Of course it's not as simple as going into Google ad manager and clicking "upload virus". The fact that it included partner networks and a compromised website is unsurprising. When malware makes it through ad networks, it is common for it to take that kind of approach. At the end of the day you're effectively exploiting networks of trust.
  - dTal 10y ago
    In other words: a YouTube ad was serving malware. All that backend obscurantism is completely irrelevant to the hapless viewer.
    - victorhooi 10y ago
      So if somebody sends you spam to your GMail account - you'd say "Gmail is sending you spam?" Or if somebody posts a bomb in your postbox - you'd say "US Postal Service is building and sending bombs"? There's a fairly clear distinction there...
jasonkostempski 10y ago
Trackers are malware. Google ads are the widest spread virus on the planet.
- andrepd 10y ago
  I don't know why you're being downvoted, teachers fit in the definition of malware.
  - etherealG 10y ago
    uh, teachers?
    - nebabyte 10y ago
      Have you seen how effective they are at virally spreading information?
  - irishcoffee 10y ago
    Where teachers = trackers
  - redm 10y ago
    "Malware, short for malicious software, is any software used to disrupt computer or mobile operations, gather sensitive information, gain access to private computer systems, or display unwanted advertising. Before the term malware was coined by Yisrael Radai in 1990, malicious software was referred to as computer viruses." [1] [2] I don't think most people would consider Google's purposeful display ads, which site owners choose to put there and customers expect to see, 'Malware.' I think Adware/Advertising Malware refers to software that shows unexpected ads, such as after you leave the site, or installing software on your computer that randomly shows ads. [1] https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware [2] https://books.google.com/books?id=jOsFlLPg1KkC&pg=PA10 https://books.google.com/books?id=jOsFlLPg1KkC&pg=PA10
    - bananarepdev 10y ago
ocdtrekkie 10y ago
I have gone so far as to suggest a significant portion of Google's revenue is likely serving malicious content, which leaves them very little incentive to do anything about it. Almost every senior citizen I've ever had clean up malware for got it from a malicious search ad. And the tech support scams they continue to list take advantage of tons of people as well. I've pointed out before that Google happily lists phone numbers of tech support scams on search terms for Windows tech support, but doesn't show ads at all if you look for Chromebook support, pointing you straight to their official contact. As a note, if anyone would like to see examples of this in action, I can go get screenshots and example links and everything, it just takes a little while to put together, as I would prefer to offer evidence of what I see "today" rather than any past examples I might have.
- halflings 10y ago
  > I have gone so far as to suggest a significant portion of Google's revenue is likely serving malicious content, which leaves them very little incentive to do anything about it. That's quite a serious accusation :). One that is not substantiated by the facts: https://blog.google/topics/ads/how-we-fought-bad-ads-sites-and-scammers-2016/ https://blog.google/topics/ads/how-we-fought-bad-ads-sites-a...
  - ocdtrekkie 10y ago
    A Google blog post is not "the facts". A Google blog post is, in fact, an ad for Google. Your sources should be independent, and independently verifiable. What Google says they do is useless, because it cannot be verified.
    - victorhooi 10y ago
      Do you have anything specific that would refute anything in the report? Simply mounting an ad-hominem attack doesn't add anything to the discussion. It's like somebody saying "Tesla cars suck - they explode". And Elon Musk comes out and says, "No they don't, here's the testing/validation we did". And you say "Oh but...but....you work for Tesla. It must be lies!" If there's factual inaccuracies - of course, that's a different story. But you seem to be simply saying, "They must be lying, because that suits my narrative, so I'm not going to bother trying to refute it".
user5994461 10y ago
>>> has google ads been responsible for virus/malware in the past? Yes. Very much so. Look for "VLC download" for instance, the first ads should be adware sites that distribute a fake version of the software and they paid to get that top search position.
- fastball 10y ago
  The top 3 links when I search VLC download are all Videolan. There is even a giant banner (looks like it's not paid for) that says "VLC" and has the VLC logo and links to Videolan. Google removes ads that contain/link to malware/viruses as soon as they are made aware of them. What more do you want?
  - user5994461 10y ago
    I know they remove the worst links and I am not denying that. They are however replaced with new ones as soon as they are deleted. It is a constant war and the only salvation is adblockers.
  - tripzilch 10y ago
    > What more do you want? Not doing it in the first place, of course! Because this has happened with VLC (a fact you seem to ignore), maybe they fixed it by now, or maybe it's temporary, or maybe you're just not in the "stupid people that would fall for this" filter bubble, but for quite a while Google Ads have been responsible for serving malware and damaging people's computers. Also just because they try and fix it after the fact for VLC, doesn't mean it's not still happening for all sorts of other software. Google's approach for curation of ads is just not suitable to be able to provide a platform this large in a responsible manner (and I doubt it can ever be, but that doesn't give them a free ticket to behave irresponsibly). Maybe you've forgotten what this thread was about in the first place, but if their policy is "we will remove ads that contain/link to malware as soon as they are (made) aware of them", then: 1) it's still a perfectly smart choice to use an adblocker because you can still get malware from ads (in addition to many of the other reasons such as opting out of clickbait timewasters, whose "innocence" evaporates as soon as you consider their scale), and a particularly important and smart choice to install it on people's computers that would actually fall for such a fake download link, which is not the HN crowd. 2) as a publisher, I would DEFINITELY want a much tighter guarantee on not serving/linking malware than "we'll remove it when we see it" because now it's not just my safety on the line (or my father trying to download VLC cause I told him over the phone, etc) but my entire audience! I know I am careful personally, what to click and install, but I honestly wonder how long I myself could keep a fresh Windows install malware-free without running an adblocker. Some of those things are nasty clever and misleading (not thinking about Google Ads in particular, here). Ever consider the amount of good those people are doing? The ones writing the adblockers and keeping the blocklists up-to-date? They are not even getting paid to do it. It gives me such a bitter taste, every time I see a website whining about my adblocker usage. If you care so much, why are you using a third party ad network. If hosting and linking and curating your own advertisements is too much to ask, well then so is me whitelisting your site, sheesh.

by chrisan 10y ago

pricechild 10y ago

Here's one such claim: https://securelist.com/blog/incidents/75731/good-morning-android/ https://securelist.com/blog/incidents/75731/good-morning-and...

arthurfm 10y ago

> has google ads been responsible for virus/malware in the past? Yes. http://blog.trendmicro.com/trendlabs-security-intelligence/youtube-ads-lead-to-exploit-kits-hit-us-victims/ http://blog.trendmicro.com/trendlabs-security-intelligence/y...

victorhooi 10y ago
I read the article - it's an interesting read. The claim is that a YouTube ad was serving malware. However, upon reading the article, it seems that: 1. Somebody purchased legitimate YouTube ad space. 2. They then redirected that traffic twice through two other legitimate ad networks. 3. They then broke into a Polish government website, and funnelled the traffic there, to serve up malware. That certainly doesn't seem to be a case of Google/YouTube serving up malware - if anything, these attacks went to a lot of trouble to obscure from YouTube what they were doing, precisely so they wouldn't get shut-down (presumably by either YouTube, or the two other ad networks they were piggy-backing on). You could argue, they should have caught them earlier - but isn't that a bit like blaming your email provider that you got a spam/malware email - when the actual party to blame is the person sending you aforesaid spam/malware?
- teej 10y ago
  I'm not sure what you expect "Google ads serving malware" to mean other than exactly this. Of course it's not as simple as going into Google ad manager and clicking "upload virus". The fact that it included partner networks and a compromised website is unsurprising. When malware makes it through ad networks, it is common for it to take that kind of approach. At the end of the day you're effectively exploiting networks of trust.
- dTal 10y ago
  In other words: a YouTube ad was serving malware. All that backend obscurantism is completely irrelevant to the hapless viewer.
  - victorhooi 10y ago
    So if somebody sends you spam to your GMail account - you'd say "Gmail is sending you spam?" Or if somebody posts a bomb in your postbox - you'd say "US Postal Service is building and sending bombs"? There's a fairly clear distinction there...

jasonkostempski 10y ago

Trackers are malware. Google ads are the widest spread virus on the planet.

andrepd 10y ago
I don't know why you're being downvoted, teachers fit in the definition of malware.
- etherealG 10y ago
  uh, teachers?
  - nebabyte 10y ago
    Have you seen how effective they are at virally spreading information?
- irishcoffee 10y ago
  Where teachers = trackers
- redm 10y ago
  "Malware, short for malicious software, is any software used to disrupt computer or mobile operations, gather sensitive information, gain access to private computer systems, or display unwanted advertising. Before the term malware was coined by Yisrael Radai in 1990, malicious software was referred to as computer viruses." [1] [2] I don't think most people would consider Google's purposeful display ads, which site owners choose to put there and customers expect to see, 'Malware.' I think Adware/Advertising Malware refers to software that shows unexpected ads, such as after you leave the site, or installing software on your computer that randomly shows ads. [1] https://en.wikipedia.org/wiki/Malware https://en.wikipedia.org/wiki/Malware [2] https://books.google.com/books?id=jOsFlLPg1KkC&pg=PA10 https://books.google.com/books?id=jOsFlLPg1KkC&pg=PA10
  - bananarepdev 10y ago

ocdtrekkie 10y ago

I have gone so far as to suggest a significant portion of Google's revenue is likely serving malicious content, which leaves them very little incentive to do anything about it. Almost every senior citizen I've ever had clean up malware for got it from a malicious search ad. And the tech support scams they continue to list take advantage of tons of people as well. I've pointed out before that Google happily lists phone numbers of tech support scams on search terms for Windows tech support, but doesn't show ads at all if you look for Chromebook support, pointing you straight to their official contact. As a note, if anyone would like to see examples of this in action, I can go get screenshots and example links and everything, it just takes a little while to put together, as I would prefer to offer evidence of what I see "today" rather than any past examples I might have.

halflings 10y ago
> I have gone so far as to suggest a significant portion of Google's revenue is likely serving malicious content, which leaves them very little incentive to do anything about it. That's quite a serious accusation :). One that is not substantiated by the facts: https://blog.google/topics/ads/how-we-fought-bad-ads-sites-and-scammers-2016/ https://blog.google/topics/ads/how-we-fought-bad-ads-sites-a...
- ocdtrekkie 10y ago
  A Google blog post is not "the facts". A Google blog post is, in fact, an ad for Google. Your sources should be independent, and independently verifiable. What Google says they do is useless, because it cannot be verified.
  - victorhooi 10y ago
    Do you have anything specific that would refute anything in the report? Simply mounting an ad-hominem attack doesn't add anything to the discussion. It's like somebody saying "Tesla cars suck - they explode". And Elon Musk comes out and says, "No they don't, here's the testing/validation we did". And you say "Oh but...but....you work for Tesla. It must be lies!" If there's factual inaccuracies - of course, that's a different story. But you seem to be simply saying, "They must be lying, because that suits my narrative, so I'm not going to bother trying to refute it".

user5994461 10y ago

>>> has google ads been responsible for virus/malware in the past? Yes. Very much so. Look for "VLC download" for instance, the first ads should be adware sites that distribute a fake version of the software and they paid to get that top search position.

fastball 10y ago
The top 3 links when I search VLC download are all Videolan. There is even a giant banner (looks like it's not paid for) that says "VLC" and has the VLC logo and links to Videolan. Google removes ads that contain/link to malware/viruses as soon as they are made aware of them. What more do you want?
- user5994461 10y ago
  I know they remove the worst links and I am not denying that. They are however replaced with new ones as soon as they are deleted. It is a constant war and the only salvation is adblockers.
- tripzilch 10y ago
  > What more do you want? Not doing it in the first place, of course! Because this has happened with VLC (a fact you seem to ignore), maybe they fixed it by now, or maybe it's temporary, or maybe you're just not in the "stupid people that would fall for this" filter bubble, but for quite a while Google Ads have been responsible for serving malware and damaging people's computers. Also just because they try and fix it after the fact for VLC, doesn't mean it's not still happening for all sorts of other software. Google's approach for curation of ads is just not suitable to be able to provide a platform this large in a responsible manner (and I doubt it can ever be, but that doesn't give them a free ticket to behave irresponsibly). Maybe you've forgotten what this thread was about in the first place, but if their policy is "we will remove ads that contain/link to malware as soon as they are (made) aware of them", then: 1) it's still a perfectly smart choice to use an adblocker because you can still get malware from ads (in addition to many of the other reasons such as opting out of clickbait timewasters, whose "innocence" evaporates as soon as you consider their scale), and a particularly important and smart choice to install it on people's computers that would actually fall for such a fake download link, which is not the HN crowd. 2) as a publisher, I would DEFINITELY want a much tighter guarantee on not serving/linking malware than "we'll remove it when we see it" because now it's not just my safety on the line (or my father trying to download VLC cause I told him over the phone, etc) but my entire audience! I know I am careful personally, what to click and install, but I honestly wonder how long I myself could keep a fresh Windows install malware-free without running an adblocker. Some of those things are nasty clever and misleading (not thinking about Google Ads in particular, here). Ever consider the amount of good those people are doing? The ones writing the adblockers and keeping the blocklists up-to-date? They are not even getting paid to do it. It gives me such a bitter taste, every time I see a website whining about my adblocker usage. If you care so much, why are you using a third party ad network. If hosting and linking and curating your own advertisements is too much to ask, well then so is me whitelisting your site, sheesh.