25 ms·

Google-hosted malvertising leads to fake Keepass site that looks genuine

382 points by bovem 3y ago

trelane 3y ago
Wait, there are people that don't just get it from their distro?!
- matrss 3y ago
  Windows still exists. Or does that have a package repository now?
miohtama 3y ago
One solution to mitigate malverising is as transparency. Each as should contain the legal contact details (company name, country) of the advertiser. It does not solve the issue fully, but consumers will surely avoid East European suspicious companies advertising. It will also make it easier for the security researchers to track down bad actors and will bring some liability to the ad platform (Google). Facebook already does this for political ads, so it is doable.
- mrkramer 3y ago
  Or you simply can have a database of all websites' SSL certificates[0] and compare it to the website you are accessing or in this case, compare it to the website that buys ad placement. [0] https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/ https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certi...
- timthelion 3y ago
  That would be amazing.
- sccxy 3y ago
  Why East European are suspicious? Little xenophobic?
  - hn_throwaway_69 3y ago
    It's not xenophobic, it's just realistic. If you tried to run a fake, malware-laden website in a Western country you would eventually be shut down and prosecuted. These scams mostly fester in nations with weaker institutions, not just Eastern Europe but also China and India. Their authorities are simply not interested in preventing this kind of unlawful activity.
    - sccxy 3y ago
      Google is US based company, when we will see "eventually be shut down and prosecuted" for spreading malware?
    - jve 3y ago
      Can you somehow quantify it or is it your gut feeling? Any articles out there? I don't know if they catch small fish as in this example, it just isn't in the news. The bigger fish happens to be in the news, like shutting down international scam call center - 2 in LV, 1 in LT. Video from police cam if anyone wants to see smashing windows: https://www.vp.gov.lv/lv/jaunums/verieniga-starptautiska-operacija-valsts-policija-partrauc-viltus-finansu-brokeru-zvanu-centru-darbibu https://www.vp.gov.lv/lv/jaunums/verieniga-starptautiska-ope... We are also being educated in many places including schools, government institutions, posters, jobs etc about the risks, about how scammers work and stuff like that.
      - jowea 3y ago
        At least for Russia itself there's plenty of articles about it. Here's one: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick... > In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim.
        jve 3y ago
        > Eastern European countries, including Ukraine and Russia. Okay, the term is used in geographical context and not geopolitical.
- brucethemoose2 3y ago
  That would cost Google and Facebook revenue. They are not going to do it unless a government makes them do it, or if the legal liability risk is too great.
  - bluGill 3y ago
    This is why punitive damages were invented: companies who didn't want to do the right thing because of money would be made to pay even more than if they had done the right thing in the first place.
    - quaxj 3y ago
      [flagged]
sccxy 3y ago
Can you prosecute Google for spreading viruses and helping criminals?
- izacus 3y ago
  That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding their power and reach. Why would you want that? (And that also goes for people who want Apple to replace their government at law enforcement).
  - Nextgrid 3y ago
    > Why would you want that? If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair. Why shouldn't Google be held to the same standard?
    - WrockBro 3y ago
      The problem is you have to prove intent to build a legal case. If the person holding a banner doesn't know whatever they're advertising is illegal then they wouldn't be liable. A case could be made if they're informed it's illegal and they continue anyways, but that isn't likely to happen.
      - JumpCrisscross 3y ago
        If a billboard starts advertising meth, you obviously go after the meth dealer. But the billboard owner—who painted the ad onto it—should also have liability (albeit civil).
    - DannyBee 3y ago
      "If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair." For the most part, you would not. While it is not protected by the first amendment in the US to advertise illegal products, it is also not particularly restricted in most of the US. To whit: If you hold up a big banner saying "fentanyl sale - 30 cents per gram", you would not have committed a crime or an actionable legal tort in most places. The thing that is actionable everywhere is deceptive/fraudulent/misleading advertising.
baal80spam 3y ago
I consider myself a security-conscious person and I'm not sure I would've spotted this. Another reason to use uBo with zero regrets.
- sschueller 3y ago
  What is uBo?
  - Semaphor 3y ago
    uBlock Origin, the best adblocker, and only full-featured on FF (but still better than the rest on the adtech browser): https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
  - Nextgrid 3y ago
    uBlock Origin, the gold standard when it comes to ad and tracker blocking.
  - lfglopes 3y ago
    https://github.com/gorhill/uBlock#readme https://github.com/gorhill/uBlock#readme
  - bovem 3y ago
    uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
  - andybak 3y ago
    Someone saving themselves 3 keypresses, approximately 1.5 seconds effort and causing a flurry of unneccesary replies.
    - s3p 3y ago
      "uBo" "uBlock Origin" How is that a difference of 3 keys?
Unfrozen0688 3y ago
Another reason to use ublock origin / Brave shields. Thanks for another article to send the adblocker complainers. THIS shit is what is killing the net, not adblock users.
- brucethemoose2 3y ago
  Yeah. I was briefly an adblock complainer, but I have swung so far to the other side I can't even see my old high horse, and not just because of ad served malware.
  - bluGill 3y ago
    Ads have broken an unwritten contract with the general public. They by this unwritten contract must be for legitimate products not scams. They must be things that I do not find offensive. This is an unwritten contract because there are other evil things that I have not thought of that they must not do.
Unfrozen0688 3y ago
I have seen similar but this one is VERY convincing. I would not have caught this. A "normie" would have no chance. Who know who many are infected.
abfaqb 3y ago
1) Use an ad blocker, always. 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? 3) IDN shouldn't be enabled by default.
- entuno 3y ago
  Yeah, it's really bad that Google don't actually show the proper characters in the URL. It's hard to spot - but at least if they displayed the actual URL then you'd have a chance.
- mschuster91 3y ago
  > 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? Because advertisers usually want to send links to a tracker site of their own first so that they can verify if their numbers match up with what Google reports. No one trusts anyone in the advertising space, and for good reasons. Advertising has always been a space filled to the brim with crooks and fraudsters.
  - ykonstant 3y ago
    >Advertising has always been a space filled to the brim with crooks and fraudsters. If I ever work at a cubicle, I will hang this sentence on a large frame over my desk, then stay silent and stare every time someone comes and complains about my ad blockers.
    - shiroiuma 3y ago
      Unless you're working at an adtech company, why would anyone complain about your ad blockers at work? Or even notice?
      - brucethemoose2 3y ago
        There was a brief period in my tech history where I viewed adblockers as "somewhat immoral." I am waaay past that now.
Semaphor 3y ago
Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode
- tialaramex 3y ago
  The TLD registries are supposed to each have defined rules for IDN which can prohibit abuses and to police the use of your service. If you operate the registry for say, Switzerland, it makes sense to allow what Swiss and maybe German people would want, then forbid everything else. But if you operate .COM or .INFO or .FREE-MONEY or whatever, your goal isn't to help anybody it's to obtain the most money possible without anybody senior going to jail. Crooks want to pay you money to help them target victims? Yes please. So in practice the browser vendors have to cook up heuristics to try to guess whether the IDN is a trick and in this case I'd guess Chrome's heuristic didn't consider this a problem whereas Mozilla's did. I believe Mozilla were so exasperated by the IDN abuses at these registries they may have just switched off IDN rendering for the entire registries affected which is thorough.
  - Semaphor 3y ago
    Ah, that is interesting, thank you.
    - Semaphor 3y ago
      Also apparently wrong.
      - tialaramex 3y ago
        https://kb.mozillazine.org/Network.IDN.whitelist https://kb.mozillazine.org/Network.IDN.whitelist.* Disappointingly .info is whitelisted, if it wasn't (like .com) then Firefox would use Punycode here instead. Perhaps Mozilla should re-consider the decision for info, or, perhaps they have and they decided that .info is doing enough (though clearly not in this case) to say that on balance it's acceptable.
disillusioned 3y ago
I fell victim to a ridiculously stupid and expensive punycode ad scam on Facebook a number of years ago, advertising new antminers. Absolutely idiotic, and infuriating, but the biggest mistake was assuming the likes of Facebook or Google actually reviewed and approved ads and protected its users from this sort of garbage, in addition to simply not noticing the tiniest dot in the address bar.
TeMPOraL 3y ago
That's a neat trick. I can imagine getting caught by this if I saw the link in non-ad context. The attackers made a smart choice here. Usual Unicode substitutions are something I've learned to spot, because the substituted letters look off, even if a tiny bit. But here? I didn't notice the dot under "k" even with an arrow pointing at it, because to me, it looked like a tiny speck of dust or dirt on the monitor. $deity knows I have many of those on my screen, and they're the kind of noise visual system is good at ignoring.
- vbezhenar 3y ago
  Тhеrе'rе рlеntу оf lеttеrs whiсh аre vеrу hаrd tо distinguish. Brоwsеrs аrе suрроsеd to саtсh thаt, but thеy dоn't аlwауs dо.
- mlok 3y ago
  I would have fallen like you. But because I use dark mode / a dark theme, this is displayed as a white dot on a black background and does not look like dust on my screen. I clearly see it. It is a white light-emitting pixel, not mistaken with a light-blocking speck of dust similar to a black pixel. I had never imagined dark mode as a security enhancement :)
  - asddubs 3y ago
    I have a lamp above my monitor, so the dust on it is illuminated making the dark mode version less noticeable
vultour 3y ago
Browsers should display punycode by default in the address bar. 99.9% of these websites are scams. If you live in a place that commonly uses non-ASCII characters in the URL then you should be able to manually toggle it on.
- matrss 3y ago
  That or whitelist specific characters based on the users locale. E.g. on a system set to german I could expect umlauts and ß to be rendered properly, but anything else should just show the punycode. Basically any legitimate use case should be covered by that.
noirscape 3y ago
Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The only place punycode really gets used are spam domains in practice. Even most Cyrillic and Asian domains don't use punycode. I get the concept of punycode and it is impressive technically but for domains it's just been a massive phishing headache.
- usr1106 3y ago
  I fully support national languages, ASCII is not suitable for a huge part of mankind. But it's obvious that Unicode as it is is not suitable for security critical applications. Myself, speaking several European languages, I need less than 10 Unicode characters (each of them actually still 8 bit ISO 8859-15 codes). Well, need and need, most of the sites don't even register a punycode domain, but some uglified ASCII version of their name. As a practical step browsers should ask the user whether they want to allow URLs in a certain language the first time a non-ASCII character is entered. With just one or a couple of languages allowed, the attack surface would be drastically reduced for most users.
  - noirscape 3y ago
    Agreed on ASCII not being suitable for a huge chunk of mankind for messaging. That said, in lieu of a better defined set of characters, it is a reliable set of characters that largely don't overlap when it comes to homograph attacks on human readable identifiers. The only single character ones in ASCII with noticable issues are 0/O and I/l/1 (this is also why on latin alphabet gift cards, you'll often see these characters omitted entirely). The other homograph attacks on ASCII are mostly font kerning dependent (and even the two I mentioned can still be made distinct from each other in fonts). I'm not dunking on Unicode here to be clear, Unicode is awesome. That said, bolting Unicode into unique identifiers humans are meant to read is a bad idea because of the homographs. Again; just look at how non-latin alphabet countries generally (don't) work with Unicode in things like usernames. > As a practical step browsers should ask the user whether they want to allow URLs in a certain language the first time a non-ASCII character is entered. This would probably help on top of the usual algorithmic blocklists that Firefox and Chrome already use (which largely rely on trying to match what sets of Unicode are used in a domain name to pick between Unicode and punycode rendering).
jasode 3y ago
>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via the Google ad that looks entirely legitimate and then again via a lookalike domain,” Jérôme Segura, head of threat intelligence at security provider Malwarebytes, Back in 2017, Google Chrome 59 supposedly fixed the Punycode phishing attack. E.g. story: https://www.engadget.com/2017-04-17-google-chrome-phishing-unicode-flaw.html https://www.engadget.com/2017-04-17-google-chrome-phishing-u... Maybe a dedicated criminal studied the Chromium source code that checks Punycode and noticed a flaw where it would allow 'ķ' in place of 'k' ??? https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ --> fake "аррӏе.com" triggers phishing warning https://xn--eepass-vbb.info/ https://xn--eepass-vbb.info/ --> fake "ķeepass.info" does not trigger warning
- rob74 3y ago
  The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?
  - rapind 3y ago
    ķ does look a lot like screen dirt though. ö not so much.
    - high_5 3y ago
      Yeah it's really frustrating for me to look at it because of such appearance.
    - dspillett 3y ago
      Also the , may be somewhat obscured by link underlining, which additions atop a letter would not be.
Stem0037 3y ago
While there's no foolproof way to detect scams like these, there are some proactive steps we can take: 1. Always type in URLs manually when downloading critical software to bypass the potential risks from ads. 2. Make use of browser plugins that identify malicious websites or unverified SSL/TLS certificates. 3. Before making any downloads, inspect the TLS certificate of the website by clicking on the padlock icon next to the URL bar. Look for inconsistencies like a different company name or issue date.
- eviks 3y ago
  Isn't ignoring ads easier (so 0. Use an adblocker)? How often would a scam rank higher than the legitimate domain? Maybe also 4. use a package manager?
  - avery17 3y ago
    Ads always appear at the top so scams always rank higher than legitimate domains.
    - eviks 3y ago
      no they don't > (so 0. Use an adblocker) Also it's easier to ignore them than manually entering urls with a typo leading you to some other unsafe domain
- praash 3y ago
  > 1. Always type in URLs manually This is the time for typosquatters to strike :(
eviks 3y ago
Why is the ad screenshot clean without the cedilla mark under K?
jve 3y ago
Why doesn't that sponsored ad show www.ķeepass.info? I only see the screenshot from browser where it shows that speck of dust there.
- tidenly 3y ago
  Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually. Attackers exploit this by first using a genuine domain to get the ad approved, and then altering the info after the campaign starts. I saw a similar attack like this on twitter a month or so ago.
SenAnder 3y ago
The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!
- hexmiles 3y ago
  But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode. Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.
  - josephcsible 3y ago
    > But we need these alphabets to allow people of various culture to be able to have url in their native language Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.
    - hexmiles 3y ago
      sure, it can be done, but is not a solution to the problem as it will still leave a lot of people vulnerable. We, probably, need to rethink how we handle identity on the web but is a hard problem to solve
- jowea 3y ago
  It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet. Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv
beeboobaa 3y ago
While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.
- Tostino 3y ago
  While stopping journalists from using any footage of war regardless of context.
- hkt 3y ago
  My seven year old kept being advertised shaving equipment, including razors. Obviously they know dad has a massive beard. Jokes aside though, I'd rather nobody be piqueing his interest in blades so I've adblocked the entire house.
  - Obscurity4340 3y ago
    It's be funny if there was baby shaving cream—like baby shampoo but shaving cream and for babies (as advertised on bottle)
    - bluGill 3y ago
      There is. Goes with a plastic razor that won't cut anything. I've seen it before, it might or might not still be in the toy section of your local WalMart.
      - Obscurity4340 3y ago
        Vaguely remember the Hulk shaving kit. If I ever had a son, he would totes be receiving one like immediately for the bath aha
        Obscurity4340 3y ago
        There's something so adorable and poignant about your "little man" emulating Hulk for your woman
erie 3y ago
Google once hosted isis website, it was in English, French and Arabic, reporting it was cumbersome and could not take screenshots of it before I helped removing it. I used builtwith to detect the host, found it was a google smb solution at the time.
pjc50 3y ago
Advertising intermediaries should be held partly liable for fraudulent adverts, or advertising should be aggressively de-anonymised, or maybe both. I'm not a fan of German-style "impressum" requirements for general publishing, but advertising is different in the way it aggressively inserts itself onto other sites in ways which (crucially) the user has no control over. Other than blocking all ads. It ought to be possible to click on the corner of an ad and get the company number and business address of those responsible for it. "Overseas" adverts originating in different countries should be even more heavily checked, because if they're fraudulent then recourse is much harder even if they're not anonymous.
botanical 3y ago
On Firefox Beta, for me it shows the punycode by default even though network.IDN_show_punycode is set to false by default
im3w1l 3y ago
What can I as a user even do to protect myself from this? Like what is the best practice for finding the official website of some organization in a high stakes situation?
- josephcsible 3y ago
  To answer the first half of your post, use Firefox and enable network.IDN_show_punycode in about:config.
- deely3 3y ago
  Always check URL, and never use browser that hide URL or show unicode in an URL string I suppose.
nrdxp 3y ago
It's must be serendipitous that the article just above this in my feed is about an AI banning someone for life from advertising on Meta because the AI thought they were trafficking animals for advertising python courses. And my guess is, absolutely nothing will be done, accountability wise, in either case.
baz00 3y ago
This is one of the many reasons I use an ad blocker. That entire advert is not visible on any of my machines therefore I will never click it.
BLKNSLVR 3y ago
"the company has said it promptly removes fraudulent ads as soon as possible after they’re reported" If they wanted to be part of the solution they'd vet the ads before they're made public. But that doesn't scale, and so people get scammed and society suffers and Google makes more money than it knows what to do with. Pretty fair trade...? As others have said in one way or another, blocking internet advertising is part of healthy and safe internet usage.
- ankit219 3y ago
  I guess it's a fine line. If Google starts pre screening ads and then bans somewhat legit ads - which may or may not look as legit - then we will see reports about them. Moderation is a tough problem to solve. We want convenience with the right stuff, and strong blocks with even slightly shady stuff. They are bound to miss a thing or two. Question here is that is this an edge case or a prominent one (as in do they have a lot of ads approved like these) with Google ads, which the article fails to answer.
  - rangerelf 3y ago
    I think you're giving them an unnecessary pass, the incentives are completely in their favor: don't screen ads, make money off ads that are frauds, scams, age-inappropriate, etc... wait for "someone" to report those ads as such; meanwhile, keep making money off them, and the scammers/frauds/etc keep making marks. The human-friendly way would be to screen ads before airing them, which means hiring teams to do the screening; have an appropriate legal language in the ad screening section saying that ads may be rejected for "Reasons" which will be explained in the rejection note, and the rejection can be appealed upon which another person will deal with the rejection review process. It's not a difficult problem, but it gets in the way of making money hand over fist.
    - ankit219 3y ago
      I think I probably am giving them an unnecessary pass. There is another case in the below links about FB ads where Facebook banned an advertiser's account because of usage of words "panda" and "python". While that case is unrelated, if someone prescreens the ads without having the required context, (let's be real here, it would be reviewed by someone in Philippines or India, not USA) they are likely to block stuff they do not understand but told to err on the side of the caution - which is what you presumably want to avoid the cases as in this title. > the rejection can be appealed upon which another person will deal with the rejection review process It still requires someone to have context about what you are running an advert on. Still hard to find, still not as reliable, and would either end up blocking many legit ads, or passing some objectionable ads. It does not just hurt their bottomline, but the bottomline of every good faith advertiser on the network. I agree that just reporting post seeing the ad is a poor feedback mechanism. Maybe some sort of AI. They do verify advertisers though as they say. Maybe that should be more stringent.
LanceH 3y ago
Seeing as I have to jump through hoops with know-your-customer laws, it would be nice if companies had to do that also in all these instances that make life difficult. * misleading ads * spam phone callers * counterfeit products on Amazon and the like * email Everything seems to be built to make me 100% reachable by any crook out there, yet I can't reach these companies enabling this through any means at all.
- ipython 3y ago
  This. The information asymmetry that underlies the scam economy absolutely infuriates me.
johnklos 3y ago
"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a response from Google in more than a decade. It makes me wonder if all the phishing and spam I'm reporting even does anything. Honestly, it's time for the world to move on from Google. They haven't been safe to use as a search engine for more than two years. After clients had been sent to phishing sites by Google's ads, I decided to block these domains on all the networks I administer: googlesyndication.com googleadservices.com googletagservices.com googletagmanager.com google-analytics.com
- giancarlostoro 3y ago
  To be even more frank, Google's search capabilities diminished around late 2000s early 2010s for me. I used to be able to write out anything verbatim and find it. Now I can't even get the double quotes trick to work properly. Google's strengths have been slowly crippled for years. Windows has a similar problem: marketing / ads is ruining an otherwise decent product.
  - DistractionRect 3y ago
    I don't know if it still works, but plus triple double quotes used to work as a verbatim match. Iirc I picked it up here when they broke double quote search a while back (which they fixed at some point). But last I checked, +"""search phrase""" works
    - petemir 3y ago
      A tip I saw here a couple of weeks ago that restored some quality to searches was to, after searching, open the drop-down menu from “Tools”, select “all results” and then “verbatim”. I do all of my searches in incognito so sadly I don’t know if the options is remembered or not.
NietTim 3y ago
This has been a problem with googles ad network for over a decade now, apparently they don't think it's profitable enough to make sure this never happens again.
throwaway62989 3y ago
On Gecko-based browsers: about:config -> network.IDN_show_punycode = false
millzlane 3y ago
Same issue from one year ago with gimp. https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/ https://www.bleepingcomputer.com/news/security/google-ad-for...
xtagon 3y ago
See: https://keepass.info/integrity.html https://keepass.info/integrity.html (you may want to manually type it into the address bar...) and download their PGP keys. That way you can verify KeePass downloads using their signatures, which you can save and sign with your own key to really verify the paranoid way. If you ever land on a bad download site, you'll know something's up after you verify and it doesn't match.
- briHass 3y ago
  Also, on Windows, both the installer and the main executable are digitally signed with a valid code signing cert: 'Open Source Developer, Dominik Reichl'
ipython 3y ago
Yet another day I'm glad I've protected my family with network-wide ad blocking through pihole. Slowly they've learned that clicking on the top links ("sponsored") don't work so now they're trained to look for the first organic search result whenever using Google.
- millzlane 3y ago
  With uBO rules, I don't even see those top results. https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
Flott 3y ago
In Firefox about:config switching network.IDN_show_punycode to true could HELP spotting these kind of scams. But I believe that, in the end, once it's showing in Google results, it's game over. Ads in search result are looking close enough to regular search result for people to just trust it and click.
WirelessGigabit 3y ago
The fact that they're using Punycode is only a secondary problem. The first one is that Google Ads allow you to show an arbitrary URL below your ad without you showing that you own it. The second one is allowing the URL shown to be different from where you send the users. But I would like to see an option to render URLs as Punycode, and not their original form.
deleted 3y ago
[deleted]

382 points by bovem 3y ago

trelane 3y ago

Wait, there are people that don't just get it from their distro?!

matrss 3y ago
Windows still exists. Or does that have a package repository now?

miohtama 3y ago

One solution to mitigate malverising is as transparency. Each as should contain the legal contact details (company name, country) of the advertiser. It does not solve the issue fully, but consumers will surely avoid East European suspicious companies advertising. It will also make it easier for the security researchers to track down bad actors and will bring some liability to the ad platform (Google). Facebook already does this for political ads, so it is doable.

mrkramer 3y ago
Or you simply can have a database of all websites' SSL certificates[0] and compare it to the website you are accessing or in this case, compare it to the website that buys ad placement. [0] https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certificate/ https://www.cloudflare.com/learning/ssl/what-is-an-ssl-certi...
timthelion 3y ago
That would be amazing.
sccxy 3y ago
Why East European are suspicious? Little xenophobic?
- hn_throwaway_69 3y ago
  It's not xenophobic, it's just realistic. If you tried to run a fake, malware-laden website in a Western country you would eventually be shut down and prosecuted. These scams mostly fester in nations with weaker institutions, not just Eastern Europe but also China and India. Their authorities are simply not interested in preventing this kind of unlawful activity.
  - sccxy 3y ago
    Google is US based company, when we will see "eventually be shut down and prosecuted" for spreading malware?
  - jve 3y ago
    Can you somehow quantify it or is it your gut feeling? Any articles out there? I don't know if they catch small fish as in this example, it just isn't in the news. The bigger fish happens to be in the news, like shutting down international scam call center - 2 in LV, 1 in LT. Video from police cam if anyone wants to see smashing windows: https://www.vp.gov.lv/lv/jaunums/verieniga-starptautiska-operacija-valsts-policija-partrauc-viltus-finansu-brokeru-zvanu-centru-darbibu https://www.vp.gov.lv/lv/jaunums/verieniga-starptautiska-ope... We are also being educated in many places including schools, government institutions, posters, jobs etc about the risks, about how scammers work and stuff like that.
    - jowea 3y ago
      At least for Russia itself there's plenty of articles about it. Here's one: https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/ https://krebsonsecurity.com/2021/05/try-this-one-weird-trick... > In Russia, for example, authorities there generally will not initiate a cybercrime investigation against one of their own unless a company or individual within the country’s borders files an official complaint as a victim.
      - jve 3y ago
        > Eastern European countries, including Ukraine and Russia. Okay, the term is used in geographical context and not geopolitical.
brucethemoose2 3y ago
That would cost Google and Facebook revenue. They are not going to do it unless a government makes them do it, or if the legal liability risk is too great.
- bluGill 3y ago
  This is why punitive damages were invented: companies who didn't want to do the right thing because of money would be made to pay even more than if they had done the right thing in the first place.
  - quaxj 3y ago
    [flagged]

sccxy 3y ago

Can you prosecute Google for spreading viruses and helping criminals?

izacus 3y ago
That would make Google responsible for the work of police - you're saying that Google should be actively trying to identify "criminals" (by whatever definitnion of whatever state in US or even their legal departmeny - quotes deliberate) and prevent them from being able to do business in modern web world. Effectively you want Google to be the law enforcement corporation and not your government thus massively expanding their power and reach. Why would you want that? (And that also goes for people who want Apple to replace their government at law enforcement).
- Nextgrid 3y ago
  > Why would you want that? If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair. Why shouldn't Google be held to the same standard?
  - WrockBro 3y ago
    The problem is you have to prove intent to build a legal case. If the person holding a banner doesn't know whatever they're advertising is illegal then they wouldn't be liable. A case could be made if they're informed it's illegal and they continue anyways, but that isn't likely to happen.
    - JumpCrisscross 3y ago
      If a billboard starts advertising meth, you obviously go after the meth dealer. But the billboard owner—who painted the ad onto it—should also have liability (albeit civil).
  - DannyBee 3y ago
    "If someone were to stand outside holding a big banner advertising something malicious/illegal they'll be in legal trouble pretty quickly, which I think is fair." For the most part, you would not. While it is not protected by the first amendment in the US to advertise illegal products, it is also not particularly restricted in most of the US. To whit: If you hold up a big banner saying "fentanyl sale - 30 cents per gram", you would not have committed a crime or an actionable legal tort in most places. The thing that is actionable everywhere is deceptive/fraudulent/misleading advertising.

baal80spam 3y ago

I consider myself a security-conscious person and I'm not sure I would've spotted this. Another reason to use uBo with zero regrets.

sschueller 3y ago
What is uBo?
- Semaphor 3y ago
  uBlock Origin, the best adblocker, and only full-featured on FF (but still better than the rest on the adtech browser): https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- Nextgrid 3y ago
  uBlock Origin, the gold standard when it comes to ad and tracker blocking.
- lfglopes 3y ago
  https://github.com/gorhill/uBlock#readme https://github.com/gorhill/uBlock#readme
- bovem 3y ago
  uBlock Origin: https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/ https://addons.mozilla.org/en-US/firefox/addon/ublock-origin...
- andybak 3y ago
  Someone saving themselves 3 keypresses, approximately 1.5 seconds effort and causing a flurry of unneccesary replies.
  - s3p 3y ago
    "uBo" "uBlock Origin" How is that a difference of 3 keys?

Unfrozen0688 3y ago

Another reason to use ublock origin / Brave shields. Thanks for another article to send the adblocker complainers. THIS shit is what is killing the net, not adblock users.

brucethemoose2 3y ago
Yeah. I was briefly an adblock complainer, but I have swung so far to the other side I can't even see my old high horse, and not just because of ad served malware.
- bluGill 3y ago
  Ads have broken an unwritten contract with the general public. They by this unwritten contract must be for legitimate products not scams. They must be things that I do not find offensive. This is an unwritten contract because there are other evil things that I have not thought of that they must not do.

Unfrozen0688 3y ago

I have seen similar but this one is VERY convincing. I would not have caught this. A "normie" would have no chance. Who know who many are infected.

abfaqb 3y ago

1) Use an ad blocker, always. 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? 3) IDN shouldn't be enabled by default.

entuno 3y ago
Yeah, it's really bad that Google don't actually show the proper characters in the URL. It's hard to spot - but at least if they displayed the actual URL then you'd have a chance.
mschuster91 3y ago
> 2) In advertisements, Google shouldn't allow the advertiser to modify the domain that is displayed. Really, why do they even do this? Because advertisers usually want to send links to a tracker site of their own first so that they can verify if their numbers match up with what Google reports. No one trusts anyone in the advertising space, and for good reasons. Advertising has always been a space filled to the brim with crooks and fraudsters.
- ykonstant 3y ago
  >Advertising has always been a space filled to the brim with crooks and fraudsters. If I ever work at a cubicle, I will hang this sentence on a large frame over my desk, then stay silent and stare every time someone comes and complains about my ad blockers.
  - shiroiuma 3y ago
    Unless you're working at an adtech company, why would anyone complain about your ad blockers at work? Or even notice?
    - brucethemoose2 3y ago
      There was a brief period in my tech history where I viewed adblockers as "somewhat immoral." I am waaay past that now.

Semaphor 3y ago

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default? edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

tialaramex 3y ago
The TLD registries are supposed to each have defined rules for IDN which can prohibit abuses and to police the use of your service. If you operate the registry for say, Switzerland, it makes sense to allow what Swiss and maybe German people would want, then forbid everything else. But if you operate .COM or .INFO or .FREE-MONEY or whatever, your goal isn't to help anybody it's to obtain the most money possible without anybody senior going to jail. Crooks want to pay you money to help them target victims? Yes please. So in practice the browser vendors have to cook up heuristics to try to guess whether the IDN is a trick and in this case I'd guess Chrome's heuristic didn't consider this a problem whereas Mozilla's did. I believe Mozilla were so exasperated by the IDN abuses at these registries they may have just switched off IDN rendering for the entire registries affected which is thorough.
- Semaphor 3y ago
  Ah, that is interesting, thank you.
  - Semaphor 3y ago
    Also apparently wrong.
    - tialaramex 3y ago
      https://kb.mozillazine.org/Network.IDN.whitelist https://kb.mozillazine.org/Network.IDN.whitelist.* Disappointingly .info is whitelisted, if it wasn't (like .com) then Firefox would use Punycode here instead. Perhaps Mozilla should re-consider the decision for info, or, perhaps they have and they decided that .info is doing enough (though clearly not in this case) to say that on balance it's acceptable.

disillusioned 3y ago

I fell victim to a ridiculously stupid and expensive punycode ad scam on Facebook a number of years ago, advertising new antminers. Absolutely idiotic, and infuriating, but the biggest mistake was assuming the likes of Facebook or Google actually reviewed and approved ads and protected its users from this sort of garbage, in addition to simply not noticing the tiniest dot in the address bar.

TeMPOraL 3y ago

That's a neat trick. I can imagine getting caught by this if I saw the link in non-ad context. The attackers made a smart choice here. Usual Unicode substitutions are something I've learned to spot, because the substituted letters look off, even if a tiny bit. But here? I didn't notice the dot under "k" even with an arrow pointing at it, because to me, it looked like a tiny speck of dust or dirt on the monitor. $deity knows I have many of those on my screen, and they're the kind of noise visual system is good at ignoring.

vbezhenar 3y ago
Тhеrе'rе рlеntу оf lеttеrs whiсh аre vеrу hаrd tо distinguish. Brоwsеrs аrе suрроsеd to саtсh thаt, but thеy dоn't аlwауs dо.
mlok 3y ago
I would have fallen like you. But because I use dark mode / a dark theme, this is displayed as a white dot on a black background and does not look like dust on my screen. I clearly see it. It is a white light-emitting pixel, not mistaken with a light-blocking speck of dust similar to a black pixel. I had never imagined dark mode as a security enhancement :)
- asddubs 3y ago
  I have a lamp above my monitor, so the dust on it is illuminated making the dark mode version less noticeable

vultour 3y ago

Browsers should display punycode by default in the address bar. 99.9% of these websites are scams. If you live in a place that commonly uses non-ASCII characters in the URL then you should be able to manually toggle it on.

matrss 3y ago
That or whitelist specific characters based on the users locale. E.g. on a system set to german I could expect umlauts and ß to be rendered properly, but anything else should just show the punycode. Basically any legitimate use case should be covered by that.

noirscape 3y ago

Punycode is of questionable use anyway. Granted I'm mostly looking into this from a primary latin alphabet perspective, but for the various non-latin alphabet sites I've browsed over the past decade all of them just stuck to regular ASCII domains. (Heck you see this even with usernames on websites that allowed Unicode to be used; most non-latin alphabet users will still stick to the Latin alphabet for usernames.) The only place punycode really gets used are spam domains in practice. Even most Cyrillic and Asian domains don't use punycode. I get the concept of punycode and it is impressive technically but for domains it's just been a massive phishing headache.

usr1106 3y ago
I fully support national languages, ASCII is not suitable for a huge part of mankind. But it's obvious that Unicode as it is is not suitable for security critical applications. Myself, speaking several European languages, I need less than 10 Unicode characters (each of them actually still 8 bit ISO 8859-15 codes). Well, need and need, most of the sites don't even register a punycode domain, but some uglified ASCII version of their name. As a practical step browsers should ask the user whether they want to allow URLs in a certain language the first time a non-ASCII character is entered. With just one or a couple of languages allowed, the attack surface would be drastically reduced for most users.
- noirscape 3y ago
  Agreed on ASCII not being suitable for a huge chunk of mankind for messaging. That said, in lieu of a better defined set of characters, it is a reliable set of characters that largely don't overlap when it comes to homograph attacks on human readable identifiers. The only single character ones in ASCII with noticable issues are 0/O and I/l/1 (this is also why on latin alphabet gift cards, you'll often see these characters omitted entirely). The other homograph attacks on ASCII are mostly font kerning dependent (and even the two I mentioned can still be made distinct from each other in fonts). I'm not dunking on Unicode here to be clear, Unicode is awesome. That said, bolting Unicode into unique identifiers humans are meant to read is a bad idea because of the homographs. Again; just look at how non-latin alphabet countries generally (don't) work with Unicode in things like usernames. > As a practical step browsers should ask the user whether they want to allow URLs in a certain language the first time a non-ASCII character is entered. This would probably help on top of the usual algorithmic blocklists that Firefox and Chrome already use (which largely rely on trying to match what sets of Unicode are used in a domain name to pick between Unicode and punycode rendering).

jasode 3y ago

>A closer link at the link, however, shows that the site is not the genuine one. In fact, ķeepass[.]info —at least when it appears in the address bar—is just an encoded way of denoting xn--eepass-vbb[.]info, which it turns out, is pushing a malware family tracked as FakeBat. Combining the ad on Google with a website with an almost identical URL creates a near perfect storm of deception. “Users are first deceived via the Google ad that looks entirely legitimate and then again via a lookalike domain,” Jérôme Segura, head of threat intelligence at security provider Malwarebytes, Back in 2017, Google Chrome 59 supposedly fixed the Punycode phishing attack. E.g. story: https://www.engadget.com/2017-04-17-google-chrome-phishing-unicode-flaw.html https://www.engadget.com/2017-04-17-google-chrome-phishing-u... Maybe a dedicated criminal studied the Chromium source code that checks Punycode and noticed a flaw where it would allow 'ķ' in place of 'k' ??? https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ --> fake "аррӏе.com" triggers phishing warning https://xn--eepass-vbb.info/ https://xn--eepass-vbb.info/ --> fake "ķeepass.info" does not trigger warning

rob74 3y ago
The first "punycode attacks" were using letters that were completely indistinguishable from the "real" ones (e.g. by using Cyrillic letters). I guess the assumption is that the user would be able to identify any letters with diacritics (even if they're indistinguishable from specks of dust on your screen) and avoid them - after all, you wouldn't go to "göogle.com" either?
- rapind 3y ago
  ķ does look a lot like screen dirt though. ö not so much.
  - high_5 3y ago
    Yeah it's really frustrating for me to look at it because of such appearance.
  - dspillett 3y ago
    Also the , may be somewhat obscured by link underlining, which additions atop a letter would not be.

Stem0037 3y ago

While there's no foolproof way to detect scams like these, there are some proactive steps we can take: 1. Always type in URLs manually when downloading critical software to bypass the potential risks from ads. 2. Make use of browser plugins that identify malicious websites or unverified SSL/TLS certificates. 3. Before making any downloads, inspect the TLS certificate of the website by clicking on the padlock icon next to the URL bar. Look for inconsistencies like a different company name or issue date.

eviks 3y ago
Isn't ignoring ads easier (so 0. Use an adblocker)? How often would a scam rank higher than the legitimate domain? Maybe also 4. use a package manager?
- avery17 3y ago
  Ads always appear at the top so scams always rank higher than legitimate domains.
  - eviks 3y ago
    no they don't > (so 0. Use an adblocker) Also it's easier to ignore them than manually entering urls with a typo leading you to some other unsafe domain
praash 3y ago
> 1. Always type in URLs manually This is the time for typosquatters to strike :(

eviks 3y ago

Why is the ad screenshot clean without the cedilla mark under K?

jve 3y ago

Why doesn't that sponsored ad show www.ķeepass.info? I only see the screenshot from browser where it shows that speck of dust there.

tidenly 3y ago
Crazily enough, the domain shown under the ad on google ads isn't automatically pulled. You can set it manually. Attackers exploit this by first using a genuine domain to get the ad approved, and then altering the info after the campaign starts. I saw a similar attack like this on twitter a month or so ago.

SenAnder 3y ago

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

hexmiles 3y ago
But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode. Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.
- josephcsible 3y ago
  > But we need these alphabets to allow people of various culture to be able to have url in their native language Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.
  - hexmiles 3y ago
    sure, it can be done, but is not a solution to the problem as it will still leave a lot of people vulnerable. We, probably, need to rethink how we handle identity on the web but is a hard problem to solve
jowea 3y ago
It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet. Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv

beeboobaa 3y ago

While Google is waging war against adblockers on YouTube they are once again showing they absolutely cannot be trusted with the responsibility of showing safe ads. That, and them showing war videos in ads to little kids.

Tostino 3y ago
While stopping journalists from using any footage of war regardless of context.
hkt 3y ago
My seven year old kept being advertised shaving equipment, including razors. Obviously they know dad has a massive beard. Jokes aside though, I'd rather nobody be piqueing his interest in blades so I've adblocked the entire house.
- Obscurity4340 3y ago
  It's be funny if there was baby shaving cream—like baby shampoo but shaving cream and for babies (as advertised on bottle)
  - bluGill 3y ago
    There is. Goes with a plastic razor that won't cut anything. I've seen it before, it might or might not still be in the toy section of your local WalMart.
    - Obscurity4340 3y ago
      Vaguely remember the Hulk shaving kit. If I ever had a son, he would totes be receiving one like immediately for the bath aha
      - Obscurity4340 3y ago
        There's something so adorable and poignant about your "little man" emulating Hulk for your woman

erie 3y ago

Google once hosted isis website, it was in English, French and Arabic, reporting it was cumbersome and could not take screenshots of it before I helped removing it. I used builtwith to detect the host, found it was a google smb solution at the time.

pjc50 3y ago

Advertising intermediaries should be held partly liable for fraudulent adverts, or advertising should be aggressively de-anonymised, or maybe both. I'm not a fan of German-style "impressum" requirements for general publishing, but advertising is different in the way it aggressively inserts itself onto other sites in ways which (crucially) the user has no control over. Other than blocking all ads. It ought to be possible to click on the corner of an ad and get the company number and business address of those responsible for it. "Overseas" adverts originating in different countries should be even more heavily checked, because if they're fraudulent then recourse is much harder even if they're not anonymous.

botanical 3y ago

On Firefox Beta, for me it shows the punycode by default even though network.IDN_show_punycode is set to false by default

im3w1l 3y ago

What can I as a user even do to protect myself from this? Like what is the best practice for finding the official website of some organization in a high stakes situation?

josephcsible 3y ago
To answer the first half of your post, use Firefox and enable network.IDN_show_punycode in about:config.
deely3 3y ago
Always check URL, and never use browser that hide URL or show unicode in an URL string I suppose.

nrdxp 3y ago

It's must be serendipitous that the article just above this in my feed is about an AI banning someone for life from advertising on Meta because the AI thought they were trafficking animals for advertising python courses. And my guess is, absolutely nothing will be done, accountability wise, in either case.

baz00 3y ago

This is one of the many reasons I use an ad blocker. That entire advert is not visible on any of my machines therefore I will never click it.

BLKNSLVR 3y ago

"the company has said it promptly removes fraudulent ads as soon as possible after they’re reported" If they wanted to be part of the solution they'd vet the ads before they're made public. But that doesn't scale, and so people get scammed and society suffers and Google makes more money than it knows what to do with. Pretty fair trade...? As others have said in one way or another, blocking internet advertising is part of healthy and safe internet usage.

ankit219 3y ago
I guess it's a fine line. If Google starts pre screening ads and then bans somewhat legit ads - which may or may not look as legit - then we will see reports about them. Moderation is a tough problem to solve. We want convenience with the right stuff, and strong blocks with even slightly shady stuff. They are bound to miss a thing or two. Question here is that is this an edge case or a prominent one (as in do they have a lot of ads approved like these) with Google ads, which the article fails to answer.
- rangerelf 3y ago
  I think you're giving them an unnecessary pass, the incentives are completely in their favor: don't screen ads, make money off ads that are frauds, scams, age-inappropriate, etc... wait for "someone" to report those ads as such; meanwhile, keep making money off them, and the scammers/frauds/etc keep making marks. The human-friendly way would be to screen ads before airing them, which means hiring teams to do the screening; have an appropriate legal language in the ad screening section saying that ads may be rejected for "Reasons" which will be explained in the rejection note, and the rejection can be appealed upon which another person will deal with the rejection review process. It's not a difficult problem, but it gets in the way of making money hand over fist.
  - ankit219 3y ago
    I think I probably am giving them an unnecessary pass. There is another case in the below links about FB ads where Facebook banned an advertiser's account because of usage of words "panda" and "python". While that case is unrelated, if someone prescreens the ads without having the required context, (let's be real here, it would be reviewed by someone in Philippines or India, not USA) they are likely to block stuff they do not understand but told to err on the side of the caution - which is what you presumably want to avoid the cases as in this title. > the rejection can be appealed upon which another person will deal with the rejection review process It still requires someone to have context about what you are running an advert on. Still hard to find, still not as reliable, and would either end up blocking many legit ads, or passing some objectionable ads. It does not just hurt their bottomline, but the bottomline of every good faith advertiser on the network. I agree that just reporting post seeing the ad is a poor feedback mechanism. Maybe some sort of AI. They do verify advertisers though as they say. Maybe that should be more stringent.

LanceH 3y ago

Seeing as I have to jump through hoops with know-your-customer laws, it would be nice if companies had to do that also in all these instances that make life difficult. * misleading ads * spam phone callers * counterfeit products on Amazon and the like * email Everything seems to be built to make me 100% reachable by any crook out there, yet I can't reach these companies enabling this through any means at all.

ipython 3y ago
This. The information asymmetry that underlies the scam economy absolutely infuriates me.

johnklos 3y ago

"The ads were paid for by an outfit called Digital Eagle, which the transparency page says is an advertiser whose identity has been verified by Google." OF COURSE they were verified by Google. Google verifies identity by accepting money. Give them money, and you're verified. "Google representatives didn’t immediately respond to an email" Are there real humans at Google who actually answer email? I haven't seen a response from Google in more than a decade. It makes me wonder if all the phishing and spam I'm reporting even does anything. Honestly, it's time for the world to move on from Google. They haven't been safe to use as a search engine for more than two years. After clients had been sent to phishing sites by Google's ads, I decided to block these domains on all the networks I administer: googlesyndication.com googleadservices.com googletagservices.com googletagmanager.com google-analytics.com

giancarlostoro 3y ago
To be even more frank, Google's search capabilities diminished around late 2000s early 2010s for me. I used to be able to write out anything verbatim and find it. Now I can't even get the double quotes trick to work properly. Google's strengths have been slowly crippled for years. Windows has a similar problem: marketing / ads is ruining an otherwise decent product.
- DistractionRect 3y ago
  I don't know if it still works, but plus triple double quotes used to work as a verbatim match. Iirc I picked it up here when they broke double quote search a while back (which they fixed at some point). But last I checked, +"""search phrase""" works
  - petemir 3y ago
    A tip I saw here a couple of weeks ago that restored some quality to searches was to, after searching, open the drop-down menu from “Tools”, select “all results” and then “verbatim”. I do all of my searches in incognito so sadly I don’t know if the options is remembered or not.

NietTim 3y ago

This has been a problem with googles ad network for over a decade now, apparently they don't think it's profitable enough to make sure this never happens again.

throwaway62989 3y ago

On Gecko-based browsers: about:config -> network.IDN_show_punycode = false

millzlane 3y ago

Same issue from one year ago with gimp. https://www.bleepingcomputer.com/news/security/google-ad-for-gimporg-served-info-stealing-malware-via-lookalike-site/ https://www.bleepingcomputer.com/news/security/google-ad-for...

xtagon 3y ago

See: https://keepass.info/integrity.html https://keepass.info/integrity.html (you may want to manually type it into the address bar...) and download their PGP keys. That way you can verify KeePass downloads using their signatures, which you can save and sign with your own key to really verify the paranoid way. If you ever land on a bad download site, you'll know something's up after you verify and it doesn't match.

briHass 3y ago
Also, on Windows, both the installer and the main executable are digitally signed with a valid code signing cert: 'Open Source Developer, Dominik Reichl'

ipython 3y ago

Yet another day I'm glad I've protected my family with network-wide ad blocking through pihole. Slowly they've learned that clicking on the top links ("sponsored") don't work so now they're trained to look for the first organic search result whenever using Google.

millzlane 3y ago
With uBO rules, I don't even see those top results. https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock

Flott 3y ago

In Firefox about:config switching network.IDN_show_punycode to true could HELP spotting these kind of scams. But I believe that, in the end, once it's showing in Google results, it's game over. Ads in search result are looking close enough to regular search result for people to just trust it and click.

WirelessGigabit 3y ago

The fact that they're using Punycode is only a secondary problem. The first one is that Google Ads allow you to show an arbitrary URL below your ad without you showing that you own it. The second one is allowing the URL shown to be different from where you send the users. But I would like to see an option to render URLs as Punycode, and not their original form.

deleted 3y ago

[deleted]