5 ms·

The malvertisement thing has become real bad. The other day I had a problem so I used chrome, where I unfortunately hadn't installed an add blocker yet. I searc

by tedivm 4y ago

The malvertisement thing has become real bad. The other day I had a problem so I used chrome, where I unfortunately hadn't installed an add blocker yet. I searched for my bank (I know, I should have put the URL in directly, but I was being lazy since it was a new chrome install and I didn't have the url in my history yet). I hit the first link, logged in (my password manager would have saved me here, but again it wasn't installed), and realized that it was a fake website. Fortunately I changed my password again before it was an issue- and then my bank locked my account when they saw the suspicious activity. So nothing bad really happened to me other than some inconvenience. However I'm still amazed that Google would let their search results get poisoned with these ads for phishing sites.

rom-antics 4y ago
This is why the appeal-to-ethics argument against adblocking holds no weight with me. Yes, maybe I stole $0.0001 from the publisher by not looking at an advert. But I also didn't have my bank password stolen and my files cryptolockered. It's a small price to pay for security.
- hgsgm 4y ago
  I don't know about "stole" but the value of those ads is more like $100/yr/user
  - TremendousJudge 4y ago
    I know people who got robbed of more than that by scams that showed up on ads
- BizarreByte 4y ago
  You shouldn’t feel bad, advertisements online are user hostile and a security threat. It’s not like a billboard that is at most annoying as you avert your gaze, despite what online ad supporters want you to believe. The ad companies could cleanup the business and actually enforce security/safety standards, but that would cost money and god forbid they lose some.
- kmoser 4y ago
  There is no reasonable appeal-to-ethics argument. When it comes to accepting code and/or data onto my computer, or more precisely my screen, I can and should have 100% control over what I accept. My computer, my choice.
- WorldMaker 4y ago
  The other appeal-to-ethics argument is that major advertising networks should not (ever) do business with malware companies, scammers, and bad actors. Their ethical responsibility of doing their business, which they profit from, is at the very least some form of due diligence on who they form business relationships with. Ethics is a two-way street.
- scarface74 4y ago
  That doesn’t help. My mom downloaded malware when she was searching for a printer driver. It was organic search and not an ad. It’s about time for her to upgrade anyway. I’m going to encourage her to get a new $599 Mac Mini. Yes I know there is nothing inherently more secure about the Mac than your typical Windows computer besides perhaps code signing. But isn’t targeted as heavily.
jaclaz 4y ago
And you are young enough and tech-savvy enough to know about all these mechanisms, you made a mistake because you were in a hurry or distracted. Think of how many people (older and/or not technically proficient) fall in this same trap everyday. Since ads are paid for (and an invoice is made for the payment), google could well verify the id of the people placing the ad and the correspondence with the "real" organization/website. They send postcards with a code to verify addresses/titolarity for google business profiles: https://support.google.com/business/answer/4588357?hl=en https://support.google.com/business/answer/4588357?hl=en and they don't double and triple check ads for banks and similar?
- pancrufty 4y ago
  The "I'm behind 7 proxies" meme gained sentience by now. The "real" credit card was stolen in a similar practice from another user. The phone number was entered by my grandma. The address verification was submitted someone fooled in a previous stint. You can't block, detect nor prosecute these people. Google could only try to protect "PayPal" searches but for the rest of them it's going to be a feat. Let's not make it sound like a computer could just tell that all of these are obvious scams. To a computer there's little difference between mybank.tld and mybankverified.tld. Domain age has plenty of false positives and negatives too.
sneak 4y ago
How did you log into the bank with valid credentials if it's on the wrong domain? My password manager won't fill it in on the wrong domain and I literally don't know my banking password.
- tedivm 4y ago
  My bank's website (their real one) was having an issue with Firefox so I installed Chrome just to log into the bank. Since I normally don't use chrome I hadn't installed a password manager yet. I copy/pasted my password out of my password manager.
  - sneak 4y ago
    Any time you copy/paste from a password manager, alarm bells should be ringing.
    - Obscurity4340 4y ago
      Why's that?
      - sneak 4y ago
        Phishing. Password managers will work automatically on the correct domain.
        efreak 4y ago
        When they're installed. Which it wasn't, in this case.
navigate8310 4y ago
It is also advised not to search for customer care numbers of prominent services on Google. Most results will have fake numbers listed that may lead to social engineering of the caller.

by tedivm 4y ago

rom-antics 4y ago

This is why the appeal-to-ethics argument against adblocking holds no weight with me. Yes, maybe I stole $0.0001 from the publisher by not looking at an advert. But I also didn't have my bank password stolen and my files cryptolockered. It's a small price to pay for security.

hgsgm 4y ago
I don't know about "stole" but the value of those ads is more like $100/yr/user
- TremendousJudge 4y ago
  I know people who got robbed of more than that by scams that showed up on ads
BizarreByte 4y ago
You shouldn’t feel bad, advertisements online are user hostile and a security threat. It’s not like a billboard that is at most annoying as you avert your gaze, despite what online ad supporters want you to believe. The ad companies could cleanup the business and actually enforce security/safety standards, but that would cost money and god forbid they lose some.
kmoser 4y ago
There is no reasonable appeal-to-ethics argument. When it comes to accepting code and/or data onto my computer, or more precisely my screen, I can and should have 100% control over what I accept. My computer, my choice.
WorldMaker 4y ago
The other appeal-to-ethics argument is that major advertising networks should not (ever) do business with malware companies, scammers, and bad actors. Their ethical responsibility of doing their business, which they profit from, is at the very least some form of due diligence on who they form business relationships with. Ethics is a two-way street.
scarface74 4y ago
That doesn’t help. My mom downloaded malware when she was searching for a printer driver. It was organic search and not an ad. It’s about time for her to upgrade anyway. I’m going to encourage her to get a new $599 Mac Mini. Yes I know there is nothing inherently more secure about the Mac than your typical Windows computer besides perhaps code signing. But isn’t targeted as heavily.

jaclaz 4y ago

And you are young enough and tech-savvy enough to know about all these mechanisms, you made a mistake because you were in a hurry or distracted. Think of how many people (older and/or not technically proficient) fall in this same trap everyday. Since ads are paid for (and an invoice is made for the payment), google could well verify the id of the people placing the ad and the correspondence with the "real" organization/website. They send postcards with a code to verify addresses/titolarity for google business profiles: https://support.google.com/business/answer/4588357?hl=en https://support.google.com/business/answer/4588357?hl=en and they don't double and triple check ads for banks and similar?

pancrufty 4y ago
The "I'm behind 7 proxies" meme gained sentience by now. The "real" credit card was stolen in a similar practice from another user. The phone number was entered by my grandma. The address verification was submitted someone fooled in a previous stint. You can't block, detect nor prosecute these people. Google could only try to protect "PayPal" searches but for the rest of them it's going to be a feat. Let's not make it sound like a computer could just tell that all of these are obvious scams. To a computer there's little difference between mybank.tld and mybankverified.tld. Domain age has plenty of false positives and negatives too.

sneak 4y ago

How did you log into the bank with valid credentials if it's on the wrong domain? My password manager won't fill it in on the wrong domain and I literally don't know my banking password.

tedivm 4y ago
My bank's website (their real one) was having an issue with Firefox so I installed Chrome just to log into the bank. Since I normally don't use chrome I hadn't installed a password manager yet. I copy/pasted my password out of my password manager.
- sneak 4y ago
  Any time you copy/paste from a password manager, alarm bells should be ringing.
  - Obscurity4340 4y ago
    Why's that?
    - sneak 4y ago
      Phishing. Password managers will work automatically on the correct domain.
      - efreak 4y ago
        When they're installed. Which it wasn't, in this case.

navigate8310 4y ago

It is also advised not to search for customer care numbers of prominent services on Google. Most results will have fake numbers listed that may lead to social engineering of the caller.