7 ms·

They've allowed a prominent malware ad to appear on any search results for Blender for months despite numerous reports. They're not taking action on these bad a

They've allowed a prominent malware ad to appear on any search results for Blender for months despite numerous reports. They're not taking action on these bad actors. https://old.reddit.com/r/blender/comments/105tht4/be_aware_of_phishing_when_searching_for_blender/ https://old.reddit.com/r/blender/comments/105tht4/be_aware_o...

shadowgovt 4y ago
I just searched for Blender and I cannot reproduce this. ... but what I suspect happened is they got reports, took a few days to down the ad, the ad goes up under another URL, they get reports, take a few days to down the ad, etc. The malware vendors are tenacious and have a pretty much bottomless well of Turking for CAPTCHAs and backup accounts. ETA: none of this to imply that Google shouldn't fix the problem or that they don't need to divert more resources to it (if for no other reason than it does actually threaten their bottom line if they can't get on top of it and people conclude it's not worth it to keep recommending Google search to naive users). But the problem's generally harder to fix than most people believe.
- deminature 4y ago
  Why are they accepting ads for a product from anyone but the verified maker of the product in the first place? Surely there's budget in that river of ad money to do the most basic due diligence?
  - basch 4y ago
    Is that extortion? Pay us or malware displaces you as the first thing people see? That said, it’s pretty common to get a competitor ad above the top search result.
    - shadowgovt 4y ago
      It's not "extortion" so much as "stupid." "Pay us or we'll convince people our search results are crap" is a really bad business model.
      - basch 4y ago
        You know how many people will think “teamviewer or Firefox must have gotten hacked” before “google sent me to a bad site” OR not notice for days and have no idea where it came from?
  - shadowgovt 4y ago
    Being allowed to advertise on someone else's brand, trademark, etc. has been pretty much a cornerstone of online advertising since the birth of online advertising. It's justified as the way mom-and-pops have any hope at all of competing with big-box names; otherwise, Dan's Local Electronics couldn't show up on searches for Best Buy as a potential micro-targeted local alternative.
    - deminature 4y ago
      I'm not talking about advertising on someone else's brand, I'm talking about advertising AS someone else's brand, or malicious impersonation. The most basic vetting of advertising would catch this, but apparently this is not occurring.
      - shadowgovt 4y ago
        Our observation of what is occurring doesn't match what is occurring. Here's how the vetting you're imagining works: 1. The automated system goes to the advertised site. But Google's IPs are public knowledge, so the site vends a "safe" version to Google's checkers. 2. If Google sends a human being? Same story. That human's coming from a Google IP. 3. Google has a small set of non-Google IPs that they privately use for checking. This process seems to have broken down. My guess is malvertisers have caught wise and have managed to build a good list of those IPs to cloak against Google's back- and side-channel verifies too. In terms of the actual ad copy: I suspect a lot of that is checked automatically, and the rest is often checked by contractors. So you're trying to solve the "Build an AI to understand when something is confusing" problem. There's probably room for improvement here, but it's not as surprising as I wish it were that stuff slips through the cracks at that layer.
        Nextgrid 4y ago
        > But Google's IPs are public knowledge You're telling me that even though attackers of various sophistication are able to get clean, residential IPs all the time for nefarious purposes, Google can't do the same? Come on. It's not that they can't, it's that they don't care.
  - pixl97 4y ago
    Because in the vast majority if markets the manufacturer is not the reseller. This is even true in many places in the software market.
    - Nextgrid 4y ago
      True, but it seems like in the case of Blender, there is no reseller, so an easy solution is to literally blacklist the word "Blender" (when it comes to software - I'm sure they have semantic analysis behind the scenes to differentiate Blender the 3D software vs a smoothie blender). The ban can be reversed if an official from the Blender project reaches out (if they ever need to advertise for example).
      - shadowgovt 4y ago
        So nobody's allowed to advertise a better 3d modeling option on searches for "blender?"
        Nextgrid 4y ago
        You can allow it as targeting, but disallow the word "Blender" in the ad copy, which is what these scams would use to misrepresent themselves and trick the user into downloading malware.
        pixl97 4y ago
        Using your competitors name is legal in US advertising
- tyingq 4y ago
  It is sort of "whack-a-mole". I see some shady ads right now via adsense on https://getpaint.net https://getpaint.net Screenshot: https://imgur.com/a/WRvrddy https://imgur.com/a/WRvrddy Someone will report them, and they will go away, then reappear from a different Adwords account. They don't seem to have a smarter heuristic sort of thing to reject ads that only say, for example "Download Now".
- mirashii 4y ago
  Okay, so malware actors create new accounts and try new ways. That’s no surprise. That doesn’t adequately explain or forgive the behavior by Google here. They’re one of the largest, most profitable enterprises in history, it’s no longer an excuse.
  - shadowgovt 4y ago
    The behavior by Google here is "Doing everything they can figure out how to do to get the malvertisers off their network without breaking the network itself." It appears that, in the short run, the malvertisers are winning the arms race. ... but if you have any ideas they haven't tried, I suspect they'd love to hear about it in a job interview for any of the openings for ad quality SWE.
    - deminature 4y ago
      This is not some impossibly intractable algorithmic problem to solve. Simply actioning malware reports on the ad would be sufficient. If an ad receives hundreds of reports over the course of months, there's problem something wrong with it and should trigger a human review, at which point the malicious intent of the ad is obvious. Why include a report button on ads at all if its effectively a placebo button?
      - shadowgovt 4y ago
        What is your evidence that the malware reports aren't being actioned? The malware continuing to appear isn't sufficient evidence. Malware moves hosts and ad accounts all the time. ETA: from the article itself, in 2021 Google "Removed over 3.4 billion ads, restricted over 5.7 billion ads and suspended over 5.6 million advertiser accounts." That's a ton of action, but AdWords alone also serves 29 billion ad impressions a day. It doesn't take more than a few bad actors slipping through the cracks to get seen (and at these orders of magnitude, "a few" is still "millions." Completely impractical for human hand-review).
        deminature 4y ago
- _hcuq 4y ago
  Not really hard to fix. They know the true is blender.org. Just display that. But as policy they want to force companies to pay for clicks to their own brands.
QuantumYeti 4y ago
I came across this a few months ago (several ads offering their own downloads for blender from copycat sites). All their downloads were hosted on GitHub and had known viruses when uploaded to VirusTotal. I reported 3 of them to GitHub, but they only removed 2 of them immediately. Checking now, and the 3rd was finally removed, but it was left up for a while. Seems like searching for blender doesn't show me any ads until I scroll down for a while, so maybe they're temporarily fixing the issue by just not showing ads for blender? shrug

shadowgovt 4y ago

I just searched for Blender and I cannot reproduce this. ... but what I suspect happened is they got reports, took a few days to down the ad, the ad goes up under another URL, they get reports, take a few days to down the ad, etc. The malware vendors are tenacious and have a pretty much bottomless well of Turking for CAPTCHAs and backup accounts. ETA: none of this to imply that Google shouldn't fix the problem or that they don't need to divert more resources to it (if for no other reason than it does actually threaten their bottom line if they can't get on top of it and people conclude it's not worth it to keep recommending Google search to naive users). But the problem's generally harder to fix than most people believe.

deminature 4y ago
Why are they accepting ads for a product from anyone but the verified maker of the product in the first place? Surely there's budget in that river of ad money to do the most basic due diligence?
- basch 4y ago
  Is that extortion? Pay us or malware displaces you as the first thing people see? That said, it’s pretty common to get a competitor ad above the top search result.
  - shadowgovt 4y ago
    It's not "extortion" so much as "stupid." "Pay us or we'll convince people our search results are crap" is a really bad business model.
    - basch 4y ago
      You know how many people will think “teamviewer or Firefox must have gotten hacked” before “google sent me to a bad site” OR not notice for days and have no idea where it came from?
- shadowgovt 4y ago
  Being allowed to advertise on someone else's brand, trademark, etc. has been pretty much a cornerstone of online advertising since the birth of online advertising. It's justified as the way mom-and-pops have any hope at all of competing with big-box names; otherwise, Dan's Local Electronics couldn't show up on searches for Best Buy as a potential micro-targeted local alternative.
  - deminature 4y ago
    I'm not talking about advertising on someone else's brand, I'm talking about advertising AS someone else's brand, or malicious impersonation. The most basic vetting of advertising would catch this, but apparently this is not occurring.
    - shadowgovt 4y ago
      Our observation of what is occurring doesn't match what is occurring. Here's how the vetting you're imagining works: 1. The automated system goes to the advertised site. But Google's IPs are public knowledge, so the site vends a "safe" version to Google's checkers. 2. If Google sends a human being? Same story. That human's coming from a Google IP. 3. Google has a small set of non-Google IPs that they privately use for checking. This process seems to have broken down. My guess is malvertisers have caught wise and have managed to build a good list of those IPs to cloak against Google's back- and side-channel verifies too. In terms of the actual ad copy: I suspect a lot of that is checked automatically, and the rest is often checked by contractors. So you're trying to solve the "Build an AI to understand when something is confusing" problem. There's probably room for improvement here, but it's not as surprising as I wish it were that stuff slips through the cracks at that layer.
      - Nextgrid 4y ago
        > But Google's IPs are public knowledge You're telling me that even though attackers of various sophistication are able to get clean, residential IPs all the time for nefarious purposes, Google can't do the same? Come on. It's not that they can't, it's that they don't care.
- pixl97 4y ago
  Because in the vast majority if markets the manufacturer is not the reseller. This is even true in many places in the software market.
  - Nextgrid 4y ago
    True, but it seems like in the case of Blender, there is no reseller, so an easy solution is to literally blacklist the word "Blender" (when it comes to software - I'm sure they have semantic analysis behind the scenes to differentiate Blender the 3D software vs a smoothie blender). The ban can be reversed if an official from the Blender project reaches out (if they ever need to advertise for example).
    - shadowgovt 4y ago
      So nobody's allowed to advertise a better 3d modeling option on searches for "blender?"
      - Nextgrid 4y ago
        You can allow it as targeting, but disallow the word "Blender" in the ad copy, which is what these scams would use to misrepresent themselves and trick the user into downloading malware.
        pixl97 4y ago
        Using your competitors name is legal in US advertising
tyingq 4y ago
It is sort of "whack-a-mole". I see some shady ads right now via adsense on https://getpaint.net https://getpaint.net Screenshot: https://imgur.com/a/WRvrddy https://imgur.com/a/WRvrddy Someone will report them, and they will go away, then reappear from a different Adwords account. They don't seem to have a smarter heuristic sort of thing to reject ads that only say, for example "Download Now".
mirashii 4y ago
Okay, so malware actors create new accounts and try new ways. That’s no surprise. That doesn’t adequately explain or forgive the behavior by Google here. They’re one of the largest, most profitable enterprises in history, it’s no longer an excuse.
- shadowgovt 4y ago
  The behavior by Google here is "Doing everything they can figure out how to do to get the malvertisers off their network without breaking the network itself." It appears that, in the short run, the malvertisers are winning the arms race. ... but if you have any ideas they haven't tried, I suspect they'd love to hear about it in a job interview for any of the openings for ad quality SWE.
  - deminature 4y ago
    This is not some impossibly intractable algorithmic problem to solve. Simply actioning malware reports on the ad would be sufficient. If an ad receives hundreds of reports over the course of months, there's problem something wrong with it and should trigger a human review, at which point the malicious intent of the ad is obvious. Why include a report button on ads at all if its effectively a placebo button?
    - shadowgovt 4y ago
      What is your evidence that the malware reports aren't being actioned? The malware continuing to appear isn't sufficient evidence. Malware moves hosts and ad accounts all the time. ETA: from the article itself, in 2021 Google "Removed over 3.4 billion ads, restricted over 5.7 billion ads and suspended over 5.6 million advertiser accounts." That's a ton of action, but AdWords alone also serves 29 billion ad impressions a day. It doesn't take more than a few bad actors slipping through the cracks to get seen (and at these orders of magnitude, "a few" is still "millions." Completely impractical for human hand-review).
      - deminature 4y ago
_hcuq 4y ago
Not really hard to fix. They know the true is blender.org. Just display that. But as policy they want to force companies to pay for clicks to their own brands.

QuantumYeti 4y ago

I came across this a few months ago (several ads offering their own downloads for blender from copycat sites). All their downloads were hosted on GitHub and had known viruses when uploaded to VirusTotal. I reported 3 of them to GitHub, but they only removed 2 of them immediately. Checking now, and the 3rd was finally removed, but it was left up for a while. Seems like searching for blender doesn't show me any ads until I scroll down for a while, so maybe they're temporarily fixing the issue by just not showing ads for blender? shrug