6 ms·

Google will warn users when sites contain social engineering ads

151 points by PirateDave 10y ago

putaside 10y ago
The only time I have been bothered with these kind of ads, is when DoubleClick serves me those on my Android. DoubleClick certainly is not the worst offender of this, but they are the biggest player. Is Google going to block/penalize the sites of their own customers? That would feel weird. Is Google going to block/penalize the sites of their competitors? That would also feel weird.
- tyingq 10y ago
  That's borderline comical. Sell customers Adsense and/or DoubleClick, then scrape the customer's site and flag it when your ad platform serves up questionable content.
- dudus 10y ago
  Usually the burden to approve an Ad is on the network that hosts/serve the Ad. Google does require approval for all Ads you want to serve to Google Search or Google Display Network, as well as Ads you want to sell through Doubleclick Ad Exchange. Doubleclick is actually a suite of different applications. I suppose you mean DFP (Doubleclick for Publishers). This is a google product but it doesn't necessarily display ads from Google Network. With DFP you can show ads from Google but also other networks or even your own negotiated ads. So in other words even though it's a Google Product it's designed to give publishers freedom on which ads will be displayed. If you use DFP to only show ads from Google Network such as adSense you can rest assured these are reviewed by Google for such social engineering tactics. I suppose they might block sites that use DFP to serve ads from other networks they can't vet and don't go through good review and were detected to contain bad Ads.
  - putaside 10y ago
    Google partners with these other networks (like Advertising.com and AppNexus). In the end it is their DFP .js code that invokes malicious ads/redirects. I blame the last in the chain, and I do not think that is unfair. Not all ads on adSense are reviewed. Or, if they are, the reviewers are doing a poor job. Locally, and on mobile devices, I get adSense ads like: "Your device has a virus. Click here to download our anti-virus software for 4.99$." Then the page shows the "404 broken robot"-graphic (it is an ad on adSense network, which spoofs Google, and scares you into downloading a paid, probably worthless, virus-scanner). I've reported numerous ads to Google over the years: Some competitors who were not playing by the rules, but also redirects to porn websites and the (locally) infamous: Your Whatsapp has expired! Enter your phone number, so we can mine that, and charge you weekly for a fake app. > I suppose they might block sites that use DFP to serve ads from other networks they can't vet and don't go through good review and were detected to contain bad Ads. Likely, but this seems weird (fix/penalize DFP partner networks first, don't penalize your users for using your own product). Also from a competitor sense: I am all for protection of users (use an adblocker!), but it does not feel right that a company with the resources of Google, finally manages to rid their own network of these malicious ads (let's say for sake of argument they have), then immediately puts the ban-hammer on their less resourceful competitor networks. Perhaps that is a side-effect of owning both analytics, the ad networks, and the browser people use to view those ads.
    - putasidemobile 10y ago
      I may have been too harsh on Google. If Google implements: "Hey, this javascript ad code is trying to redirect to another domain, let's throw up a warning." then that would be great (no matter if it hits their own ads). Google may also share information from SafeBrowsing with other companies, so they can opt to fix their stuff. Also that what I may view as terrible ads, Google sees as companies gradually finding the razorsharp edge of their program policies. For obvious reasons, we do not hear (or see) anything about the successful efforts to keep scam and spam away from their networks.
- zaphar 10y ago
  Typically at Google the teams in charge of a service like this and ads are pretty heavily fire-walled. After working there it would not at all surprise me if they did exactly that.
josephjrobison 10y ago
And Google's own Adwords ads looking more an more like organic search results and pushing the organic results further down the page isn't social engineering at all, right?
- gist 10y ago
  What's interesting is that this is moving more and more in the direction of the tried and trusted legacy yellow pages phonebook model. In that model you got a free listing in a category or two but had to pay to get either additional listings (in other categories) or for an advertisement (of various sizes) in order to get phone calls. The rationale (in addition to making money obviously) was that there had to be a way to determine the serious people trying to hawk a particular or good or service from the casual players. The thinking was that if a person took out a listing or an ad saying they "sold recumbent bicycles" they must be doing that because they were willing to pay to say so. So the theory is if you pay for say something you must be fairly serious about what you are saying (in terms of things you are selling).
  - tyingq 10y ago
    Ah, but without the loophole of naming your company "AAAAAAAAA Services" to land at the top of "organics" :)
    - gist 10y ago
      My gaming of the system was putting a display ad with multiple phone numbers representing different areas of the city. Worked very well. Learned that by observing what other businesses did (in entirely different areas I might add) and figuring that must be the reason (since I knew they didn't have all of those locations). Yellow pages, at least for what I did (was a "well developed category") was instant business and paid off very well. I increased the ad size every year. In some cases ran a small and large ad after being told (correctly) that some people liked to deal with a small company and some a large company. I landed a big contract once with the larger ad when only 3 companies were asked to bid. All this was well before the internet when there wasn't step by step guides and/or blog posts and things like this were never taught you either figured them out on your old or someone you knew was nice enough to tell you. (In the old days it wasn't typical to share info and secrets like it is today..)
FilterSweep 10y ago
From Wikipedia[0]: > Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud scheme. Honest question: When you take a look at the "manipulation of people into divulging confidential information" part, wouldn't this, by definition, incriminate the vast majority of the modern ("Internet 2.0") web, WRT unremovable-cookies, tracking, "analytics", and so forth? I fully admit there is a difference between downloading a random AdobeFlashPlayerUpdate.exe or MacKeeperApp.dmg from a malicious site and having all your personal data and information about you sent off to a 3rd party company......but where do we(or Google, here) draw the line? Just last week, Facebook started gleaning contacts from my phone and injecting them into the "People you may know" page - these were people I did NOT want on my Facebook - ranging from business contacts to tinder matches. I knew this was (sadly) standard behavior for users of the Facebook App, or users of "Facebook for Mobile", but I have never given my phone number to facebook, not once, and I only access it via a mobile browser. Is it social engineering to see my recent searches in the Amazon app on mobile reposted on Facebook on my desktop Web browser? [0]: https://en.wikipedia.org/wiki/Social_engineering_(security) https://en.wikipedia.org/wiki/Social_engineering_(security)
- huehehue 10y ago
  IIRC, you have to auth to Tinder with a FB account. Not saying that nothing shady is happening, because I believe it is, but note that there are hundreds of ways for a company like FB to connect the dots. Post locations, event invitations, friends of friends, searches, ads/trackers, even your behavior/patterns on the site. The only real options, IMO, are to delete FB or accept the uphill battle.
  - e40 10y ago
    IIRC, you have to auth to Tinder with a FB account. Wow. Just wow. That seems like such a horrifically bad idea. The worlds represented by FB and Tinder are almost diametrically opposed and I imagine that people who use both would never want any mixing. We are one FB bug away from some serious embarrassment.
diegorbaquero 10y ago
I'm not saying an ad-blocker IS the solution, but it works on blocking not only ads but making websites faster and safer.
- LeoNatan25 10y ago
  Ad blocking IS the solution. To many many problems.
Strilanc 10y ago
They count fake download buttons as social engineering. Excellent.
- _greim_ 10y ago
  What definition of "social engineering" are you using?
ilyanep 10y ago
Can't wait until Google has to block websites using AdSense because they themselves served such an ad through a reseller. ...or until they don't and have an Anti-Trust suit on their hands.
nxzero 10y ago
Most people don't realize that Google's "Safe Browser" sends via Chrome & Firefox the URL of ever single URL you visit to Google; as far as I'm able to tell.
- gruez 10y ago
  No, it doesn't. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...
  - nxzero 10y ago
    I've seen requests passed to Google, which is how I noticed it in the first place. This source appears to show at least for downloads the browser is sending data to the API: "From Firefox 32 on, downloads are checked against the local list and a remote list if the local list does not return a hit." SOURCE: http://www.ghacks.net/2014/07/23/prevent-firefox-sending-download-information-google/ http://www.ghacks.net/2014/07/23/prevent-firefox-sending-dow...
    - cremno 10y ago
      That article ends with a link to https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc#Remote_lookup_.28present_in_FF_32.2C_Windows-only.29 https://wiki.mozilla.org/Security/Features/Application_Reput... which contains: >These lookups are Windows-only, because we rely on signature information in order to suppress remote lookups and signature APIs are only available on Windows. If the binary is unsigned or its signature does not match a known good publisher and the filename ends in a known executable extension, Firefox sends a remote lookup to the application reputation service. This is more precise than your post including the quote.
ikeboy 10y ago
>[Update: Google published this news today on its corporate blog, but this was previously announced earlier this year. We’ve asked Google to clarify why it was republished, if that was in error, or if it represents any changes since the first announcement.] This was previously discussed at https://news.ycombinator.com/item?id=11032270 https://news.ycombinator.com/item?id=11032270.
- dgacmu 10y ago
  The actual news is this: https://security.googleblog.com/2016/04/improvements-to-safe-browsing-alerts.html https://security.googleblog.com/2016/04/improvements-to-safe... Google's expanded it from just protecting users to also notify the network admin via https://security.googleblog.com/2010/09/safe-browsing-alerts-for-network.html https://security.googleblog.com/2010/09/safe-browsing-alerts... (The "notify the AS owner" service existed before, but now it also notifies about social engineering content.) [/end doing job of reporter who should have done it themselves.]
michael_h 10y ago
Why stop there? When a site contains the offending ads, push them down to page four of the results. The ads will disappear in a matter of days.
- junto 10y ago
  I assumed this is already the case, but it it isn't, it is an awesome idea!
- kuschku 10y ago
  Finally a way for startups to compete with Google, when Google has to move all of their sites (YouTube, Blogger, etc) 4 pages down.
- partiallypro 10y ago
  So, punish companies for using AdSense, one of Google's core services? As many have pointed out here, AdSense is a big contributor to these ads. It seems it would be pretty easy to weed out on the AdSense platform, since they have to be bidding on "download" as a keyword to be assigned to that page.
6stringmerc 10y ago
What about on their own sites? Like YouTube? Yesterday I just saw a banner ad on a YouTube music video - from Google AdWords - that was alerting me I may need some "Drivers" for my machine and I should get them from some suspicious company called TechSoft or RealSoft or something like that. It was the "dying car alarm drops a sick beat" extended remix if that's of any interest. I did take a screenshot but don't have it handy right now.
- EvanAnderson 10y ago
  I regularly see ads during Youtube videos for what I would assume to be malware -- "driver updates" and the ilk. It would be nice if Google would get their own house in order.
  - ocdtrekkie 10y ago
    Why should Google get it's house in order? The best part about being a monopoly is everyone has to deal with you whether they like it or not. ;) And they can punish other people's websites for having malicious ads, including Google-sourced malicious ads, because that totally solves the problem! This comment was thick with sarcasm.
    - shiftpgdn 10y ago
      Because people start using Adblock and sucking the life out of their business. I just deployed adblock across the entire organization I work for as a basic security measure.
tyingq 10y ago
From the article: "Others pretend to be “Download” or “Play” buttons, as if clicking them would provide access to the video content or stream the user had wanted. " These are actively being served through Google Adsense, right now. Here's a few example, live sites, where I see "Download" buttons in an ad, in a context that would be confusing. http://www.getpaint.net/index.html http://www.getpaint.net/index.html http://downloads.tomsguide.com/PaintNET,0301-4883.html http://downloads.tomsguide.com/PaintNET,0301-4883.html http://filehippo.com/download_paint.net/ http://filehippo.com/download_paint.net/
- ProAm 10y ago
  Where do you see the button the www.getpaint.net? This is all I see and it looks legit [1] [1] http://imgur.com/S8iV9cX http://imgur.com/S8iV9cX
  - patja 10y ago
    I think you are blocking ads. I am too and that's what I see. From a device not blocking ads this is what I see: http://imgur.com/yZDK7og http://imgur.com/yZDK7og
    - ProAm 10y ago
      Yep definitely blocking ads. That is insanity without. 8|
      - putaside 10y ago
        A new trick is to use so many trackers that it won't fit on the screen when listing them all: http://i.imgur.com/AauOwVB.png http://i.imgur.com/AauOwVB.png (This is from a site which detects adblockers, and begs you to turn it off, because it's killing their business model)
        newjersey 10y ago
        I swear imgur redirected me to an album page earlier. But now https://i.imgur.com/AauOwVB.png https://i.imgur.com/AauOwVB.png it works. Strange. Ads like the paint.net ad runs afoul of > Mimicking site content, news articles, or text ads > Google doesn't allow ads that mimic publisher content or layout, or news articles and features. Ads may also not contain screenshots of Google AdWords text ads or otherwise simulate an AdWords text ad in any way. https://support.google.com/adwordspolicy/answer/176108?hl=en https://support.google.com/adwordspolicy/answer/176108?hl=en
elcapitan 10y ago
I didn't even know that there are ads that don't involve social engineering.
blaze33 10y ago
Well I block ads on my desktop so I'm not really seeing fake "download" buttons that often. On the other end what really bothers me on mobile (using the latest chrome) is ads automatically redirecting me to another site, happens quite regularly when I browse Google news. I don't really know if those ads use an exploit of some sort or if they consider I've clicked the ad when I only tried scrolling the page with my finger but that should clearly be checked. And it happens on well known newspapers websites, not that I was browsing some obscure shady part of the web...
MichaelGG 10y ago
That's rich, coming from them. When I used mobile apps with ads, the majority seemed to be fake "update battery driver"/"uninstall virus" type nonsense. In flashing red and yellow.
brador 10y ago
It's worth remembering that this is the pain point Adsense and Adwords originally solved for by only allowing a title, 2 lines of text, and a URL. And they did it so well they disrupted/killed a mutli-billion dollar industry of online flash ads practically overnight. And then they become that problem by taking on flash ads a few years ago.
- 55555 10y ago
  I think their USP was contextuality, no?
  - Retra 10y ago
    I would say no, but then, everything advertisers say works seems to have the exact opposite effect on me, so what do I know... I mean, the last thing I want out of ads is targeting. Nobody needs to tell me to buy things I already like.
  - brador 10y ago
    The contextuality came later once they had built out the backend systems and proven the core idea worked.
- spiderfarmer 10y ago
  It's not a flash ad problem. I have seen auto-expanding ads on Android phones without flash. I'm guessing HTML5 banners with javascript in them, but it's hard to find out if it happens only once every couple of days and only on mobile, where you can't look at the source of all scripts once it happens.
chinathrow 10y ago
Why warn? Why not simply drop/block them and notify the ad network/ad buyer?
- kuschku 10y ago
  Because then they’d hurt their own bottom line.
spriggan3 10y ago
Will they do that on their own sites too ? like youtube or blogger ? because yes, I got plenty of "Your computer is infected by a virus, Please call Microsoft hotline" popups from those.
- rcheu 10y ago
  I don't have Adblock on for Youtube and I've never gotten a popup like that. All of their ads are video ads. Are you sure you don't actually have a virus (that's causing the popups, not due to the message itself)?
  - kuschku 10y ago
    The in-video popups (at the bottom, about 20% of the height of the video) very often advertise malware for me, too.
dfar1 10y ago
This is a good start to solve an old problem. However they need to start filtering out their own ads. I don't know which is easier, catch them before it goes live, or after, but either way... that's something in the right direction.
guelo 10y ago
I'd rather my adblocker deal with these instead of my browser.
fireworks10 10y ago
I see this warning in effect on http://kat.cr http://kat.cr in Chrome: Deceptive site ahead Attackers on kat.cr may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).
JamilD 10y ago
Since sites like this are so ubiquitous, I wonder if users will see warnings like this so often that they'll start to ignore them and just click "proceed" without thinking. It's definitely a step forward in the right direction, provided Google Adsense, well, adheres to their own company's guidelines…
cha5m 10y ago
What hypocrites http://imgur.com/3Emyw5y http://imgur.com/3Emyw5y
jevinskie 10y ago
Hmm... I just saw this mess on Youtube today. An "Ads by Google" ad for some malware. http://i.imgur.com/vQkjZWU.jpg http://i.imgur.com/vQkjZWU.jpg

151 points by PirateDave 10y ago

The only time I have been bothered with these kind of ads, is when DoubleClick serves me those on my Android. DoubleClick certainly is not the worst offender of this, but they are the biggest player. Is Google going to block/penalize the sites of their own customers? That would feel weird. Is Google going to block/penalize the sites of their competitors? That would also feel weird.

tyingq 10y ago
That's borderline comical. Sell customers Adsense and/or DoubleClick, then scrape the customer's site and flag it when your ad platform serves up questionable content.
dudus 10y ago
Usually the burden to approve an Ad is on the network that hosts/serve the Ad. Google does require approval for all Ads you want to serve to Google Search or Google Display Network, as well as Ads you want to sell through Doubleclick Ad Exchange. Doubleclick is actually a suite of different applications. I suppose you mean DFP (Doubleclick for Publishers). This is a google product but it doesn't necessarily display ads from Google Network. With DFP you can show ads from Google but also other networks or even your own negotiated ads. So in other words even though it's a Google Product it's designed to give publishers freedom on which ads will be displayed. If you use DFP to only show ads from Google Network such as adSense you can rest assured these are reviewed by Google for such social engineering tactics. I suppose they might block sites that use DFP to serve ads from other networks they can't vet and don't go through good review and were detected to contain bad Ads.
- putaside 10y ago
  Google partners with these other networks (like Advertising.com and AppNexus). In the end it is their DFP .js code that invokes malicious ads/redirects. I blame the last in the chain, and I do not think that is unfair. Not all ads on adSense are reviewed. Or, if they are, the reviewers are doing a poor job. Locally, and on mobile devices, I get adSense ads like: "Your device has a virus. Click here to download our anti-virus software for 4.99$." Then the page shows the "404 broken robot"-graphic (it is an ad on adSense network, which spoofs Google, and scares you into downloading a paid, probably worthless, virus-scanner). I've reported numerous ads to Google over the years: Some competitors who were not playing by the rules, but also redirects to porn websites and the (locally) infamous: Your Whatsapp has expired! Enter your phone number, so we can mine that, and charge you weekly for a fake app. > I suppose they might block sites that use DFP to serve ads from other networks they can't vet and don't go through good review and were detected to contain bad Ads. Likely, but this seems weird (fix/penalize DFP partner networks first, don't penalize your users for using your own product). Also from a competitor sense: I am all for protection of users (use an adblocker!), but it does not feel right that a company with the resources of Google, finally manages to rid their own network of these malicious ads (let's say for sake of argument they have), then immediately puts the ban-hammer on their less resourceful competitor networks. Perhaps that is a side-effect of owning both analytics, the ad networks, and the browser people use to view those ads.
  - putasidemobile 10y ago
    I may have been too harsh on Google. If Google implements: "Hey, this javascript ad code is trying to redirect to another domain, let's throw up a warning." then that would be great (no matter if it hits their own ads). Google may also share information from SafeBrowsing with other companies, so they can opt to fix their stuff. Also that what I may view as terrible ads, Google sees as companies gradually finding the razorsharp edge of their program policies. For obvious reasons, we do not hear (or see) anything about the successful efforts to keep scam and spam away from their networks.
zaphar 10y ago
Typically at Google the teams in charge of a service like this and ads are pretty heavily fire-walled. After working there it would not at all surprise me if they did exactly that.

josephjrobison 10y ago

And Google's own Adwords ads looking more an more like organic search results and pushing the organic results further down the page isn't social engineering at all, right?

gist 10y ago
What's interesting is that this is moving more and more in the direction of the tried and trusted legacy yellow pages phonebook model. In that model you got a free listing in a category or two but had to pay to get either additional listings (in other categories) or for an advertisement (of various sizes) in order to get phone calls. The rationale (in addition to making money obviously) was that there had to be a way to determine the serious people trying to hawk a particular or good or service from the casual players. The thinking was that if a person took out a listing or an ad saying they "sold recumbent bicycles" they must be doing that because they were willing to pay to say so. So the theory is if you pay for say something you must be fairly serious about what you are saying (in terms of things you are selling).
- tyingq 10y ago
  Ah, but without the loophole of naming your company "AAAAAAAAA Services" to land at the top of "organics" :)
  - gist 10y ago
    My gaming of the system was putting a display ad with multiple phone numbers representing different areas of the city. Worked very well. Learned that by observing what other businesses did (in entirely different areas I might add) and figuring that must be the reason (since I knew they didn't have all of those locations). Yellow pages, at least for what I did (was a "well developed category") was instant business and paid off very well. I increased the ad size every year. In some cases ran a small and large ad after being told (correctly) that some people liked to deal with a small company and some a large company. I landed a big contract once with the larger ad when only 3 companies were asked to bid. All this was well before the internet when there wasn't step by step guides and/or blog posts and things like this were never taught you either figured them out on your old or someone you knew was nice enough to tell you. (In the old days it wasn't typical to share info and secrets like it is today..)

FilterSweep 10y ago

From Wikipedia[0]: > Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud scheme. Honest question: When you take a look at the "manipulation of people into divulging confidential information" part, wouldn't this, by definition, incriminate the vast majority of the modern ("Internet 2.0") web, WRT unremovable-cookies, tracking, "analytics", and so forth? I fully admit there is a difference between downloading a random AdobeFlashPlayerUpdate.exe or MacKeeperApp.dmg from a malicious site and having all your personal data and information about you sent off to a 3rd party company......but where do we(or Google, here) draw the line? Just last week, Facebook started gleaning contacts from my phone and injecting them into the "People you may know" page - these were people I did NOT want on my Facebook - ranging from business contacts to tinder matches. I knew this was (sadly) standard behavior for users of the Facebook App, or users of "Facebook for Mobile", but I have never given my phone number to facebook, not once, and I only access it via a mobile browser. Is it social engineering to see my recent searches in the Amazon app on mobile reposted on Facebook on my desktop Web browser? [0]: https://en.wikipedia.org/wiki/Social_engineering_(security) https://en.wikipedia.org/wiki/Social_engineering_(security)

huehehue 10y ago
IIRC, you have to auth to Tinder with a FB account. Not saying that nothing shady is happening, because I believe it is, but note that there are hundreds of ways for a company like FB to connect the dots. Post locations, event invitations, friends of friends, searches, ads/trackers, even your behavior/patterns on the site. The only real options, IMO, are to delete FB or accept the uphill battle.
- e40 10y ago
  IIRC, you have to auth to Tinder with a FB account. Wow. Just wow. That seems like such a horrifically bad idea. The worlds represented by FB and Tinder are almost diametrically opposed and I imagine that people who use both would never want any mixing. We are one FB bug away from some serious embarrassment.

diegorbaquero 10y ago

I'm not saying an ad-blocker IS the solution, but it works on blocking not only ads but making websites faster and safer.

LeoNatan25 10y ago
Ad blocking IS the solution. To many many problems.

Strilanc 10y ago

They count fake download buttons as social engineering. Excellent.

_greim_ 10y ago
What definition of "social engineering" are you using?

ilyanep 10y ago

Can't wait until Google has to block websites using AdSense because they themselves served such an ad through a reseller. ...or until they don't and have an Anti-Trust suit on their hands.

nxzero 10y ago

Most people don't realize that Google's "Safe Browser" sends via Chrome & Firefox the URL of ever single URL you visit to Google; as far as I'm able to tell.

gruez 10y ago
No, it doesn't. https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-...
- nxzero 10y ago
  I've seen requests passed to Google, which is how I noticed it in the first place. This source appears to show at least for downloads the browser is sending data to the API: "From Firefox 32 on, downloads are checked against the local list and a remote list if the local list does not return a hit." SOURCE: http://www.ghacks.net/2014/07/23/prevent-firefox-sending-download-information-google/ http://www.ghacks.net/2014/07/23/prevent-firefox-sending-dow...
  - cremno 10y ago
    That article ends with a link to https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc#Remote_lookup_.28present_in_FF_32.2C_Windows-only.29 https://wiki.mozilla.org/Security/Features/Application_Reput... which contains: >These lookups are Windows-only, because we rely on signature information in order to suppress remote lookups and signature APIs are only available on Windows. If the binary is unsigned or its signature does not match a known good publisher and the filename ends in a known executable extension, Firefox sends a remote lookup to the application reputation service. This is more precise than your post including the quote.

ikeboy 10y ago

>[Update: Google published this news today on its corporate blog, but this was previously announced earlier this year. We’ve asked Google to clarify why it was republished, if that was in error, or if it represents any changes since the first announcement.] This was previously discussed at https://news.ycombinator.com/item?id=11032270 https://news.ycombinator.com/item?id=11032270.

dgacmu 10y ago
The actual news is this: https://security.googleblog.com/2016/04/improvements-to-safe-browsing-alerts.html https://security.googleblog.com/2016/04/improvements-to-safe... Google's expanded it from just protecting users to also notify the network admin via https://security.googleblog.com/2010/09/safe-browsing-alerts-for-network.html https://security.googleblog.com/2010/09/safe-browsing-alerts... (The "notify the AS owner" service existed before, but now it also notifies about social engineering content.) [/end doing job of reporter who should have done it themselves.]

michael_h 10y ago

Why stop there? When a site contains the offending ads, push them down to page four of the results. The ads will disappear in a matter of days.

junto 10y ago
I assumed this is already the case, but it it isn't, it is an awesome idea!
kuschku 10y ago
Finally a way for startups to compete with Google, when Google has to move all of their sites (YouTube, Blogger, etc) 4 pages down.
partiallypro 10y ago
So, punish companies for using AdSense, one of Google's core services? As many have pointed out here, AdSense is a big contributor to these ads. It seems it would be pretty easy to weed out on the AdSense platform, since they have to be bidding on "download" as a keyword to be assigned to that page.

6stringmerc 10y ago

What about on their own sites? Like YouTube? Yesterday I just saw a banner ad on a YouTube music video - from Google AdWords - that was alerting me I may need some "Drivers" for my machine and I should get them from some suspicious company called TechSoft or RealSoft or something like that. It was the "dying car alarm drops a sick beat" extended remix if that's of any interest. I did take a screenshot but don't have it handy right now.

EvanAnderson 10y ago
I regularly see ads during Youtube videos for what I would assume to be malware -- "driver updates" and the ilk. It would be nice if Google would get their own house in order.
- ocdtrekkie 10y ago
  Why should Google get it's house in order? The best part about being a monopoly is everyone has to deal with you whether they like it or not. ;) And they can punish other people's websites for having malicious ads, including Google-sourced malicious ads, because that totally solves the problem! This comment was thick with sarcasm.
  - shiftpgdn 10y ago
    Because people start using Adblock and sucking the life out of their business. I just deployed adblock across the entire organization I work for as a basic security measure.

tyingq 10y ago

From the article: "Others pretend to be “Download” or “Play” buttons, as if clicking them would provide access to the video content or stream the user had wanted. " These are actively being served through Google Adsense, right now. Here's a few example, live sites, where I see "Download" buttons in an ad, in a context that would be confusing. http://www.getpaint.net/index.html http://www.getpaint.net/index.html http://downloads.tomsguide.com/PaintNET,0301-4883.html http://downloads.tomsguide.com/PaintNET,0301-4883.html http://filehippo.com/download_paint.net/ http://filehippo.com/download_paint.net/

ProAm 10y ago
Where do you see the button the www.getpaint.net? This is all I see and it looks legit [1] [1] http://imgur.com/S8iV9cX http://imgur.com/S8iV9cX
- patja 10y ago
  I think you are blocking ads. I am too and that's what I see. From a device not blocking ads this is what I see: http://imgur.com/yZDK7og http://imgur.com/yZDK7og
  - ProAm 10y ago
    Yep definitely blocking ads. That is insanity without. 8|
    - putaside 10y ago
      A new trick is to use so many trackers that it won't fit on the screen when listing them all: http://i.imgur.com/AauOwVB.png http://i.imgur.com/AauOwVB.png (This is from a site which detects adblockers, and begs you to turn it off, because it's killing their business model)
      - newjersey 10y ago
        I swear imgur redirected me to an album page earlier. But now https://i.imgur.com/AauOwVB.png https://i.imgur.com/AauOwVB.png it works. Strange. Ads like the paint.net ad runs afoul of > Mimicking site content, news articles, or text ads > Google doesn't allow ads that mimic publisher content or layout, or news articles and features. Ads may also not contain screenshots of Google AdWords text ads or otherwise simulate an AdWords text ad in any way. https://support.google.com/adwordspolicy/answer/176108?hl=en https://support.google.com/adwordspolicy/answer/176108?hl=en

elcapitan 10y ago

I didn't even know that there are ads that don't involve social engineering.

blaze33 10y ago

Well I block ads on my desktop so I'm not really seeing fake "download" buttons that often. On the other end what really bothers me on mobile (using the latest chrome) is ads automatically redirecting me to another site, happens quite regularly when I browse Google news. I don't really know if those ads use an exploit of some sort or if they consider I've clicked the ad when I only tried scrolling the page with my finger but that should clearly be checked. And it happens on well known newspapers websites, not that I was browsing some obscure shady part of the web...

MichaelGG 10y ago

That's rich, coming from them. When I used mobile apps with ads, the majority seemed to be fake "update battery driver"/"uninstall virus" type nonsense. In flashing red and yellow.

brador 10y ago

It's worth remembering that this is the pain point Adsense and Adwords originally solved for by only allowing a title, 2 lines of text, and a URL. And they did it so well they disrupted/killed a mutli-billion dollar industry of online flash ads practically overnight. And then they become that problem by taking on flash ads a few years ago.

55555 10y ago
I think their USP was contextuality, no?
- Retra 10y ago
  I would say no, but then, everything advertisers say works seems to have the exact opposite effect on me, so what do I know... I mean, the last thing I want out of ads is targeting. Nobody needs to tell me to buy things I already like.
- brador 10y ago
  The contextuality came later once they had built out the backend systems and proven the core idea worked.
spiderfarmer 10y ago
It's not a flash ad problem. I have seen auto-expanding ads on Android phones without flash. I'm guessing HTML5 banners with javascript in them, but it's hard to find out if it happens only once every couple of days and only on mobile, where you can't look at the source of all scripts once it happens.

chinathrow 10y ago

Why warn? Why not simply drop/block them and notify the ad network/ad buyer?

kuschku 10y ago
Because then they’d hurt their own bottom line.

spriggan3 10y ago

Will they do that on their own sites too ? like youtube or blogger ? because yes, I got plenty of "Your computer is infected by a virus, Please call Microsoft hotline" popups from those.

rcheu 10y ago
I don't have Adblock on for Youtube and I've never gotten a popup like that. All of their ads are video ads. Are you sure you don't actually have a virus (that's causing the popups, not due to the message itself)?
- kuschku 10y ago
  The in-video popups (at the bottom, about 20% of the height of the video) very often advertise malware for me, too.

dfar1 10y ago

This is a good start to solve an old problem. However they need to start filtering out their own ads. I don't know which is easier, catch them before it goes live, or after, but either way... that's something in the right direction.

guelo 10y ago

I'd rather my adblocker deal with these instead of my browser.

fireworks10 10y ago

I see this warning in effect on http://kat.cr http://kat.cr in Chrome: Deceptive site ahead Attackers on kat.cr may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).

JamilD 10y ago

Since sites like this are so ubiquitous, I wonder if users will see warnings like this so often that they'll start to ignore them and just click "proceed" without thinking. It's definitely a step forward in the right direction, provided Google Adsense, well, adheres to their own company's guidelines…

cha5m 10y ago

What hypocrites http://imgur.com/3Emyw5y http://imgur.com/3Emyw5y

jevinskie 10y ago

Hmm... I just saw this mess on Youtube today. An "Ads by Google" ad for some malware. http://i.imgur.com/vQkjZWU.jpg http://i.imgur.com/vQkjZWU.jpg