5 ms·
Is this inclusive of Google's (and other large legitimate tech companies) various ad programs? Can you send a virus through Google's ads?
by MattGaiser 5y ago
Is this inclusive of Google's (and other large legitimate tech companies) various ad programs? Can you send a virus through Google's ads?
- HPsquared 5y agoWhy risk it, I suppose.
- neallindsay 5y agoI think there have been cases in the past, but that hardly matters. When you visit a site you run the risk that it has been exploited to spread malware. Would you want to also run the risk that one (or more likely a dozen) other sites running code on that page have been exploited as well?
- okl 5y agoWikipedia has something on past cases: https://en.wikipedia.org/wiki/Malvertising#History https://en.wikipedia.org/wiki/Malvertising#History
- prox 5y agoImgur had a couple of periods were trojans were being delivered through ads. The ineptitude of that place was staggering as it happened multiple times from 2010-2015 at least. Not sure how todays safety is in that regard.
- nkrisc 5y agoI don’t know if Google ad networks specifically have been compromised in the past, but it’s certainly happened to networks used by major sites. nytimes.com is one such example. At a minimum, any ad served by a third party network on a site you’re visiting should be considered a security threat. You gotta draw the line somewhere, but I think it’s reasonable to at least consider only first-party content from the site you’re visiting as reasonably safe. Perhaps blocking even JS unless it is absolutely necessary. Any site you visit could be compromised, but since the only 100% safe course of action is to completely disconnect from the web, blocking the most obvious vectors entirely seems appropriate. Of course, not only are ad networks vectors for malware, they don’t even serve a useful purpose to you that might justify the risk.
- Spooky23 5y agoGoogle is better than some, but is vulnerable to certain types of malicious use. Locksmith scams aren't a solved problem, AKAIK.
- Macha 5y agoConceptually, yes. Big vendors in this space have teams to detect malicious activity in their advertising network, but any team that claims to detect 100% is merely detecting 100% of what they know of. Browsers have gotten better and updates have gotten much faster, so less of that is drive by virus infections by exploiting the browser, but there's still cases of "Pick some users that you think are (a) real users and (b) naive enough" and serve them a exe download that contains a virus.
- annoyingnoob 5y agoI've instructed all of my users to never, ever, click on a Google ad when they've searched for something. Its been a couple of years now since someone has shown be a screen with a tech support scam on it. I had one user that was hitting tech support scams monthly. He would go to Google, search for Amazon, then click the first link on the page (which always had the little Ad word next to it).
- MattGaiser 5y agoI would argue that has more knowledge threat than a technical threat though.
- annoyingnoob 5y agoNo matter, cannot trust Google ads in our organization.
- colonelxc 5y agoThis is part of the reason the Google Safe Browsing project was created. At the time there were a lot of malicious sites either trying to get high SEO or paying for ads. The goal was to make it safe(r) to go to google and search (and click!) on things. For a project that didn't directly make money (there are some 'cloud' offerings now), Safe Browsing probably was a very high return on investment.