Google Text Ads For Known Malware Sites

notthatwillsmith writes "We all know that Google purges known 'attack sites' — sites that deliver viruses, spyware, or other malware to visitors — from its index of searchable sites, but that doesn't stop the text ad giant from happily selling ads linking to those sites. One wouldn't think it would be any more difficult to cross-reference the list of purged sites with the list of advertisers than it was for the main search index, would it?" To be fair, the article says that Google shut down the ad when notified of it; and no other examples of linked malware are offered. Was this a one-time oversight?

Comments

Notify the end users

[Anonymous Coward]

Surely it wouldn't be beyond the wit of man for Google to replace ads with warnings that the site on which the ad is being viewed is suspect?

Re:Notify the end users

[larry bagina]

That might viloate the google/website contract. Howewver, that's not the issue here. Google is running ads with links to malware sites, not ads on the malware sites (though they probably do that too).

Re:Notify the end users

[RulerOf]

It wouldn't be too far of a jump to assume that voluntary termination is a clause they hold quite dearly in their side of that contract.

Re:Notify the end users

[Anonymous Coward]

However, that's not the issue here. Google ran an ad with a link to a malware site, not ads on the malware site

There, fixed that for you. This ad was also removed after Google was notified. This was not only explained in TFA, but also TFS.

Is there a demand for guides in the bad places?

[BenEnglishAtHome]

I wonder if there's a demand for a search engine that specializes in taking you to all the "bad places" on the 'net. What if a search engine indexed everything that others don't - hate sites, porn, spam markets, malware, everything - with the disclaimer that "You'd better not use us to get to any sites unless you've got a really hardened workstation and you're willing to assume all the risks"?

There have been times when I could have used such a thing; I'm wondering if the same is true for anyone else.

Re:Is there a demand for guides in the bad places?

[qoncept]

http://astalavista.box.sk/

Re:Is there a demand for guides in the bad places?

[wjh31]

i have to wondwe why you might want one of those unless you were after to proove rule 34, or were a racist, unless you were maybe doing some research into such things, but besides, i wasnt aware that google filtered out porn or hate-sites

Re:Is there a demand for guides in the bad places?

[geminidomino]

box.sk has a porn search!?

Re:Is there a demand for guides in the bad places?

[wild_quinine]

http://astalavista.box.sk/

Yeah, that used to list the bad places. Now it mostly lists the awful ones.

Re:Is there a demand for guides in the bad places?

[Ravon Rodriguez]

It doesn't. in fact, Google image search is an excellent source of free pr0n

Re:Is there a demand for guides in the bad places?

[BenEnglishAtHome]

i have to wondwe why you might want one of those

Fair question.

In my day job I work for the Internal Revenue Service. Years ago, I helped prototype a "lead development" process looking for tax non-compliance in entities that promoted themselves online. (Nowadays, that's everybody but not back then.) We started out looking at porn, hate peddlers, and rogue CPAs who dispensed bad advice (whatever you wanted to hear) for hefty fees. The CPAs were easy to find but the porn and hate guys? Not so much. You'd be surprised how many wholesome Midwest couples supplement their income by making beast porn and not paying taxes on their receipts. And if you think any of the white supremacist groups or similar wack-jobs out there actually comply with tax laws, I would like to tell you different.

The problem was that when we tried to find these dodgy porn sellers and hatemongers, they were tough to find. A search engine that actually had useful results would have been a good thing.

In other matters, I can remember when cjb.net was filled with not just awful porn but also cracker sites containing useful nuggets of tech information. They were also infested with whatever malware was around. At that time (What was it? About 5-8 years ago?), Google did index them. But I can easily imagine a need to get to similar neighborhoods today and finding that search engines are reluctant to point you to their malware-laden pages.

It hasn't been my job to poke around in such places for a long time but I think it's obvious that there are legitimate reasons to do so.

i wasnt aware that google filtered out porn or hate-sites

Google doesn't filter much. I know that there are lots of sites that simply don't appear in their results but I have no idea whether Google purges those sites because of potentially illegal content or if the sites themselves are opting out of being crawled. But no matter the cause of non-appearances, there still don't seem to be any search engines I know of that do a good job of indexing the content they have for these types of sites.

For example, in the situation I described a couple of paragraphs ago we found that the hate sites were very hard to track until we realized that long before we got interested in them, there were other people (namely, their victims) who had a huge interest in cataloging them. The Anti Defamation League catalog of hate sites was a gold mine, an absolutely invaluable resource. They had compiled their catalog by talking to victims and dealing with the bad guys. Trying to compile the same sort of catalog from Google results would be very, very difficult. (To be fair, back when I was doing this I mostly used HotBot and NorthernLight; this isn't a Google-specific complaint.) We started from the ADL catalog and spidered out from there, essentially building our own search database. It would have need nice if someone else had already done the work for us.

Besides, what's wrong with occasionally proving Rule 34? :-)

Re:Is there a demand for guides in the bad places?

[wjh31]

well thank you, that's very interesting/insightful, although ive yet to figure out how to 'mod up' in such a manner

give 'em a break

[v1]

To be fair, the article says that Google shut down the ad when notified of it; and no other examples of linked malware are offered. Was this a one-time oversight?

Given the amount of business Google gets, how can you possibly consider one instance anything but an oversight?

This is NOT "stuff that matters"

News flash! Local traffic cop overlooks jaywalker. Corruption, or honest mistake, you decide!

Re:give 'em a break

[Joce640k]

You can't expect them to check every single link on every single page in real time.

I could easily set up a page that waits for a visit from the google page-checker then modifies itself to contain bad stuff. That would give me a window of attack.

Re:give 'em a break

[jorghis]

You guys are missing the point. Its not a matter of humans checking each link and making an oversight. Its a matter of Google accepting ads from sites that its magical filtering system knows for a fact are spam sites/link farms/malware etc. If they didnt accept ads from sites that their database knows to be not so great websites then there wouldnt be any oversight. Computers dont make oversights so the only way this could have happened is if Google decided to apply a different standard for filtering their advertisers than they do to regular webpages.

Re:give 'em a break

[geminidomino]

Given the amount of business Google gets, how can you possibly consider one instance anything but an oversight?

If one were so inclined, one might, without any conspiracy theory or other leaps of unlogic, consider "one instance" to be "the first time they got caught,"

Re:give 'em a break

[Anonymous Coward]

I totally agree. The story is tagged "whocares" which sums it up nicely.

I thought that some users getting stories before the general audience was supposed to improve the overall quality of stories?

Re:give 'em a break

[lazlo]

Actually, Google probably just realized the truth: People actually click on search results. Ads, not so much.

Eliminating the malware from search results is far more important.

Re:give 'em a break

[maxume]

So a bunch of people are concerned that Google has too much information and will combine their databases in ways that are hostile to users, and a bunch of other people are concerned that Google isn't doing a good enough job combining their databases?

Re:give 'em a break

[Anonymous Coward]

Arresting or ticketing a jaywalker is NOT the proper role of the police. What possible harm can I cause others when I jaywalk? Get blood on the hood of their car when they run me over?

Ticketing the jaywalker is corruption.

Re:give 'em a break

[hmar]

The next time you get rear ended because you stopped short to avoid some idiot walking out in the street, remember that he couldn't possibly cause any harm.

Re:give 'em a break

[Anonymous Coward]

Yeah, but here's another oversight made:

http://www.antiad.net.cn/winrar.htm

Don't download the file from that site. It should be pretty obvious why, considering it disguises itself as CNet's own site. But this is found when you simply type in winrar on google. I fell for it because I'm a complete retard, but it's also an advertised site on google. Dangerous stuff.

Note: the file is just a dumb malware hack that overtakes the \etc\hosts file and all attempts to go to major sites like facebook and google redirect you to a fake, engrish hack of microsoft's site telling you to download their antispyware app. Thing is, it got through on the back of the installation of what I thought was a legitimate copy of winrar. Winrar still worked, but damn was that annoying. Lesson, don't trust google ads. And don't be an idiot, like me.

Re:give 'em a break

[Anonymous Coward]

To be fair, the article says that Google shut down the ad when notified of it; and no other examples of linked malware are offered. Was this a one-time oversight?

Given the amount of business Google gets, how can you possibly consider one instance anything but an oversight?

But they have done it many times before. Here's a sampling:
http://revealingerrors.com/tags/google
http://www.google-watch.org/evilgoo.html
http://e-strategyblog.com/2008/10/michele-bachmanns-geo-targeted-google-attack-ad/

Re:give 'em a break

[onedotzero]

Or, you could serve Googlebot different content to that which you serve other agents (cloaking: blackhat SEO 101).

Re:give 'em a break

[michaelhood]

This has been done, but Google now makes seemingly random subsequent visits from cloaked user agents and non-obvious IP blocks, so this vector's effectiveness is very limited now.

Re:give 'em a break

[Zadaz]

Except fooling a computer that relies on robots.txt is pretty trivial. And if Google didn't abide by robots.txt then they'd catch hell for that.

Compared to the tens (hundreds) of millions of ads Google serves a day, a single one being unpleasant is not statistically significant. Go out there and find us some valid data.

Re:give 'em a break

[DragonWriter]

You guys are missing the point. Its not a matter of humans checking each link and making an oversight. Its a matter of Google accepting ads from sites that its magical filtering system knows for a fact are spam sites/link farms/malware etc.

Its "magical filtering system" doesn't know what you say "for a fact". What it knows, for a fact, is that the site meets the criteria under which Google will not list the page in search results because it appears to be such a thing. Note that Google's business model is about deliverying a variety of things (e.g., search results) to web users so that it can deliver eyeballs to advertisers.

It has very little obligation to the purveyors of random internet sites to include those sites in search listings, as no one is paying them to do that. If it is a little overzealous (but not grossly so) in filtering out potential "bad" sites, that's not necessarily bad for them. OTOH, if they are overzealous in filtering out paying advertisers, that is bad for them. So it certainly makes sense for them not to apply the automatic filtering to paying advertisers to stop them for paying for and receiving ad placement.

OTOH, it would make sense for them to have a policy that permits human review of advertised sites with some kind of response, and using their automatic filter as a way of identifying sites that might need such review would be logical.

Re:give 'em a break

[Anonymous Coward]

Asking Google not to run ads for shady businesses and scam artists is exactly like asking TV, radio, and cable companies to do the same. I've seen quite a few scammy things advertised on air or through cable, sometimes quite prominently. Either they're selling crap products, or they're offering "free" services. The "free" ones are sneaky and usually happen to milk your credit card or bank account via consumer-unfriendly transaction agreements hidden in very very small print.

Now of course if Google does start declining to deal with these businesses, it would be a step in the right direction for the consumer and the public at large. Perhaps it could use its influence to bring similar practice into effect throughout the media industry. I suppose we'll have to wait and see...

Smoke, no fire

[Sneftel]

A one-time oversight? Probably not. Look, domain names are not exactly made of gold. It is entirely possible for an advertiser to create a domain name specifically and solely for the purpose of advertising on a particular ad network. That means no chance for Google to match it to its blacklist -- the site isn't in the blacklist anyway, or anywhere else for that matter. There's no need to SEO a link you're paying to advertise, after all. That's probably why the link doesn't come up in Google: Nobody links to it, nobody talks about it, nobody's SEOed it.

Bottom line: Without a human eyeball checking each submitted ad, and a team of investigators checking each suspicious-ish looking one, this sort of thing is not going to get caught until it's reported. Google isn't going to be our nanny in this regard. Oh well.

Re:Smoke, no fire

[Zerth]

Exactly, just because Google blacklists malware sites does not mean that all sites that aren't indexed by Google are malware sites.

That said, "antivirus pro 2009" and several other variations used to be advertised a few days ago, as well. I had to clean that crap off a machine in a remote office because the user got nailed by some fake UPS spam and our corporate antivirus(McCrappy) didn't prevent the install and didn't see the infection on the daily scan, only blocked the IE hijacking.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Not evil enough

[Anonymous Coward]

Sorry, this is just not evil enough, and looks more like an oversight. Post something about Microsoft instead if you want to post evil things companies do.

Re:Not evil enough

[postbigbang]

No, it's an instance of blind push advertising. It's like a Coke sign in a crack house.

Re:Not evil enough

[genner]

No, it's an instance of blind push advertising. It's like a Coke sign in a crack house.

How is that blind?
Crack heads get thirsty too.

Re:Not evil enough

[postbigbang]

They're not your more ideal customer....

Re:Not evil enough

[slash.duncan]

Hmm... within context, which Coke? =:^)

But really, as long as the customer isn't causing image problems for a company, most don't and shouldn't care /where/ their customers come from, or /what/ else they may do or buy or whatever.

And realistically, a Coke sign in a crack house is likely to have been ripped off from a bar or some such (maybe the bar tender was a customer and traded the Coke sign in for a hit?), or maybe somebody just thought it looked cool and bought it, like any of the other thousands of such signs folks have in their rec rooms or whatever. It's not like Coke likely had anything directly to do with it being there, other than licensing the use of its trademark to the sign maker and retailer, etc.

IOW, the Coke sign in the crack house is likely about as relevant as the Nike swish and the Just Do It logo (and yes, I'm aware of the double entendre, tho I noticed it /after/ I chose the example) on the addict's tee-shirt -- the one they pulled out of a bag left at the Goodwill or Salvation Army dropoff, or out of a dumpster they were diving in, looking for "recyclables".

Re:Not evil enough

[genner]

IOW, the Coke sign in the crack house is likely about as relevant as the Nike swish and the Just Do It logo

Maybe if a nike sign was hung at the local brothel.....

Re:GoogleAds should moderate themselves more.

[wjh31]

i thought it was possible to select what kind of content you were ok with having in your hosted google ads, i.e able to choose not to have anything mature advertised on your site

Antivirus xp 2008

[layingMantis]

My roommate got that virus on his laptop. It's a P3 500Mhz, a little old and slow to run these kitchen sink firewall/antivirus programs that are out now.

I did get SpyHunter to identify the problems, which it did admirably. (you gotta pay for it to actually FIX the problem).

When you go into Safe Mode and try to delete some of the offending files, it STILL access denies you. I had to use Task Manager to stop the explorer shell altogether, then 'DEL' them from the command line. Once done I ran ole' trusty Autoruns to clean up.

I told him that virus is usually contracted from the bigger gay porn sites and he just looked sheepish.

Re:Antivirus xp 2008

[Anonymous Coward]

I'm not sure why you're modded offtopic; my guess is some moderator didn't RTFA and therefore didn't realize you were actually discussing the article instead of the summary!

Re:Responsibility

[Sir_Dill]

If you bothered to RTFA you would have found out that the authors were only able to cite one example for which Google "ponied up" by removing the offending ad as soon as they were notified. Hell if you bothered to read the summary you would have seen that.

That doesn't sound like a blind eye.

Quit trolling

Furthermore its a fine line between due diligence and big brother. Especially in in today's internet climate. I am not surprised that the group doing the adwords doesn't know enough about the group doing the filtering to be able to filter automatically. Its very easy to say Google should know what Google is doing but we all know that interdepartmental communications in large companies sometimes don't work all that well.

It would be interesting if the bloggers that posted this "poke the big guy piece" had more than just this one incident. It would also be interesting to know how many other sites have been removed. If this was the first and they are now going to be crosschecking, then it shouldn't happen again.

Comment removed

[account_deleted]

Comment removed based on user account deletion

But no one ever clicks on the ads

[Progman3K]

So why worry?
At least this way the malware companies pay someone and end up infecting no one.

Seriously have YOU ever clicked on an ad?

I've put adwords on my site www.gentooxo.org thinking it would help me pay for the site's hosting and the bandwidth I use to distribute my customized-for-olpc linux distro but you know what? According to my stats NO ONE has ever clicked on an ad!
And that's after about two thousand visits to the site and maybe 200 downloads!

Here is my 'required by google' policy on the ads:
http://gentooxo.org/disclaimer.shtml/

So useless are the ads that I am thinking I will simply drop them...

Re:But no one ever clicks on the ads

[Progman3K]

Oops, link should have been: http://gentooxo.org/disclaimer.shtml

Re:But no one ever clicks on the ads

[Anonymous Coward]

I don't usually click on ads, but in your case, I suspect the lack of clicks is due to poor placement. They don't catch the eye -- at all.

Try embedding them in a block of text, or putting them in the header, or something.

Re:But no one ever clicks on the ads

[Anonymous Coward]

I have some ads on a shitty blog I set up just to see if you could "make money" with a blog (a while back I looked into a number of online money making scam, err, schemes).
I've never advertised it.
It has been running for 12 months. I now have 3k hits and "made" $2.34

Re:But no one ever clicks on the ads

[Progman3K]

Try embedding them in a block of text, or putting them in the header, or something

Ah, but in the contract you must accept with Google, they explicitly forbid you to do anything to attract attention to the ads, which does sort of make sense...

All that and a poison apple, might as well remove the ads entirely.

Re:But no one ever clicks on the ads

[repvik]

There. You've got a click. Happy now?

Re:But no one ever clicks on the ads

[Progman3K]

Must be your target-demographic...
Obviously (in my case) only geeks and nerds would visit (YAY Geeks and Nerds!)

In your case... You didn't say what your blog is about, it would be interesting to note the difference.

Re:But no one ever clicks on the ads

[gad_zuki!]

2k total visits? You need a lot more traffic to make use of ads. I would think something along the lines of 2k a day. Even then its not a lot.

Re:But no one ever clicks on the ads

[ledow]

I helped put Google Ad's on a site my brother runs... http://www.scoutingresources.org.uk/

We get enough money from the ad's to host the site (which has some pretty hefty bandwidth needs at the moment but we have a very charitable host who does us lots of favours) and run a couple of camps for the Scouts every year. The clickthrough ratio is the same as my own sites, about 0.30%, but the number of visitors means it's actually profitable. Of course, we get that amount of visitors but being useful, prevelant, having lots of information, and being around for nearly 10 years helps - however we have never paid to advertise it, on-line or off. As far as I know, we've never had an article in any big Scouting magazines or anything. Just local stuff and general Googling. We don't sell anything, we don't take bribes, we don't like to anything that we review/use (advertisers/sponsors are *clearly* marked as such). So I guess it's just the number of eyes that determine click-through's, than anything else. I haven't seen the statistics in a while but I'm pretty sure we get a thousand visitors an hour or something stupid like that, for as far as you can trust web-based metrics.

Ad's get clicked on. In fact, the last few times we've been approached by camping specialists to sponsor the site, it's been for much less than the Google ad's bring in on their own.

Re:But no one ever clicks on the ads

[Progman3K]

There. You've got a click. Happy now?

Not if you got infected.
Although Google does promise that they use your site's Google index rating to select the ads and in the case of GentooXO, that would mean things that have to do with the OLPC, so there is almost no chance malware writers would write ads for this segment...

I use ad-blocking techniques, so every time I check the site I see no ads at all but the few times I have seen it from someone else's computer, the ads DID seem targetted to the OLPC, which is sort of neat.

I didn't click on the ads though, that is another stipulation in the Google adwords contract, you must never click on your own ads.

Anyone here ever read the contract? It is really long!

Re:But no one ever clicks on the ads

[trongey]

Progman3K,
Your target demographic is people who want something for free. Do you really expect them to click on ads for for stuff that costs money?

Re:But no one ever clicks on the ads

[hansamurai]

You can pretty much put them wherever you want as long as you don't go "HEY! CLICK ON THESE ADS!" Really, the only limitation they have is don't tell people to click them and don't put anything directly above the ad besides something like "Sponsored Links".

Re:But no one ever clicks on the ads

[hansamurai]

I just added ads to my site and I've already paid for half of my hosting in about a week. I think the problem is your target demographic: Linux users. Most of them are obviously quite knowledgeable about things like Firefox, Adblock, Opera, Noscript, etc. My site kind of falls in between with video games. There are knowledgeable people and then there are just kids doing kid stuff.

Plus 2000 hits is not that much, click through ratio is really not that good for any site, your sample size is just not that big. But I did click an ad for you, so you just earned like 40 cents. Yay!

Re:But no one ever clicks on the ads

[sukotto]

Even though your project looks pretty cool, I'd be surprised to hear you get much traffic. And ad clickthroughs are small (even at the best of times)... like 1% of users will even LOOK at the ad. Of those, only a few percent will click.

What you describe is a teeny tiny micro-niche site. I mean, come on...
A do it yourself, operating system for a laptop that's not readily available to the general public?
(You might be able to buy one during the once-a-year buy-1-get-1 sale... and even then changes are good that you never actually received it).

Of course you didn't get any money :-)

Re:But no one ever clicks on the ads

[Progman3K]

Bah, it doesn't matter!

I wasn't doing it for the money anyway.

I will remove the ads. Felt cheap putting them there to begin with.

For the record, my G1G1 OLPC was ordered in mid-November and was received in late January.

It has a defective keyboard (which I can fix) but otherwise it is a great little machine. I am just worried about playing around in there (my big hands) since it is the only unit I have.

Re:But no one ever clicks on the ads

[maxume]

Until teh Google reads this thread and cancels his account.

Re:But no one ever clicks on the ads

[Actually, I do RTFA]

Seriously have YOU ever clicked on an ad?

No. And I never installed Gator or the Comet Cursor toolbar either.

Re:But no one ever clicks on the ads

[hansamurai]

It could happen, but he didn't outright ask anyone to click his ads. I still chose to do it myself, I actually saw one for O'Reilly and spent a few minutes there checking out their new stuff.

Re:But no one ever clicks on the ads

[maxume]

When I go reward clicking, I try to click on ads for companies that look dubious or that I don't like.

I suppose I would also click on an ad for something I thought I might buy, but I tend to be a bit of tightwad, so that doesn't really come up.

Re:But no one ever clicks on the ads

[Opr33Opr33]

I felt bad that a fellow /.er's ads were ignored so I went to your sight. At first I thought you must have already disabled the ads because I couldn't find any. Then I remembered to turn off Adblock. I clicked the ads just to give you some clicks but I do want to point out that the ads were both unobtrusive and relevant to your site.

What Google should really be responsible for...

[Moryath]

Google should really be responsible for testing its own links and purging/fixing the latest scam, "referrer redirect" hijacks.

It's a form of attack wherein a hijacked website works correctly... as long as your Referrer string doesn't include certain key words ("Google", "Yahoo", "MSN", etc). The trick being, the website won't know they have been hacked because if they get a notice saying they have, then test their own homepage directly, it still works. If you have a referrer, you get redirected to a drive-by download page (for something like "Windows Antivirus 2009" or similar).

Why is this insidious? Because it gets around a lot of the "known registry", "anti-phishing" plugins.

Google served up the link; they should have a responsibility to do a periodic check that the links they serve aren't going to a bad place, and inform the victim if they've been referrer-redirect hijacked.

Re:What Google should really be responsible for...

[causality]

Google should really be responsible for testing its own links and purging/fixing the latest scam, "referrer redirect" hijacks.

It's a form of attack wherein a hijacked website works correctly... as long as your Referrer string doesn't include certain key words ("Google", "Yahoo", "MSN", etc). The trick being, the website won't know they have been hacked because if they get a notice saying they have, then test their own homepage directly, it still works. If you have a referrer, you get redirected to a drive-by download page (for something like "Windows Antivirus 2009" or similar).

Why is this insidious? Because it gets around a lot of the "known registry", "anti-phishing" plugins.

Google served up the link; they should have a responsibility to do a periodic check that the links they serve aren't going to a bad place, and inform the victim if they've been referrer-redirect hijacked.

That's one thing I don't understand: If I can either refuse to send an HTTP Referrer header or forge it to always point to the site's index page (I use the Firefox RefControl extension but there are others that do the same), certainly Google can do this and avoid that entire set of problems. In fact I've yet to see a good argument for why there even is such a thing as a referrer header or what benefit it's supposed to provide. I can definitely see why advertisers like it, but from the point of view of a user it's useless or nearly useless; if I thought Webmasters needed to know the site I went to before I visited theirs, I would send them an e-mail to tell them.

Re:What Google should really be responsible for...

[Anonymous Coward]

Google should really be responsible for testing its own links and purging/fixing the latest scam, "referrer redirect" hijacks.

It's a form of attack wherein a hijacked website works correctly... as long as your Referrer string doesn't include certain key words ("Google", "Yahoo", "MSN", etc). The trick being, the website won't know they have been hacked because if they get a notice saying they have, then test their own homepage directly, it still works. If you have a referrer, you get redirected to a drive-by download page (for something like "Windows Antivirus 2009" or similar).

Why is this insidious? Because it gets around a lot of the "known registry", "anti-phishing" plugins.

Google served up the link; they should have a responsibility to do a periodic check that the links they serve aren't going to a bad place, and inform the victim if they've been referrer-redirect hijacked.

Nice idea but impossible. I work in google adwords qualified company and we ourselves create thousands of google ads per day. And we aren't the largest company in the country by any means. And the country is smaller that most states of USA...

The amount of ads is mind boggling.

Google employees checking every single one periodically? That is impossible. Also, why not demand that Youtube employees would watch through every video?

Now... Did Google do something wrong? Perhaps. If they delivered ads to location they had already banned from search. And I know they do - As I have managed some MFA (made for adsense) sites that Google redeemed "Worthless ad sites that users don't want to get to" (and they were correct, sure. But Well, I needed money. It worked.). Buying users there through adwords keeps working even after the site gets +100 filter in organic results.

Re:What Google should really be responsible for...

[Anonymous Coward]

We are also assuming that, when registered, this malicious site was in fact malicious, rather than a dummy page set up for a month or so, then unleashed at a later time (after adwords had been established)

Re:What Google should really be responsible for...

[Chaos Incarnate]

In fact I've yet to see a good argument for why there even is such a thing as a referrer header or what benefit it's supposed to provide. I can definitely see why advertisers like it, but from the point of view of a user it's useless or nearly useless; if I thought Webmasters needed to know the site I went to before I visited theirs, I would send them an e-mail to tell them.

It's useful for bandwidth control; if some other site is leeching content, you can block/redirect requests from that referrer.

The only real alternative at present (that I'm aware of) is to replace any images or files with something that's harder to inline into another site's content like a Flash gallery. We've already gone too far that way; no need to give sites another excuse.

Re:What Google should really be responsible for...

[zacronos]

Google served up the link; they should have a responsibility to do a periodic check that the links they serve aren't going to a bad place, and inform the victim if they've been referrer-redirect hijacked.

That's easier said than done. Here are some reasons:

• The page was almost certainly clean when the ad was set up.
• What if they use a database of known ip addresses (such as those available for free for PeerGuardian) to attempt to avoid attacking a Google ip address, rather than looking at the referrer?
• Many of the redirects are much more sophisticated today -- they don't do a server-side redirect request, they send some javascript to make the browser do a client-side redirect. That makes things difficult because now your spider must include a javascript interpreter.
• What if there's a 10-second delay before the redirect? If your spider leaves the site too soon, it'll never know. In contrast, many users would likely still be on the page after 10 seconds.
• What if the attack is only initiated as a result of some particular sort of user interaction, like a click on the page (similar to much of today's popup code)? How do you reliably test for all possible variations on that?
• How often do you test the links? Once a day? That'll take a lot of resources for someone as big as google. Once a week? On average that means a site will have 3-4 days in the wild before they even get checked, and that frequency still might take a lot of resources.
• What if, even after all that, the page only attempts to attack one out of every ten opportunities? Even if you check the link periodically, and are able to duplicate the circumstances necessary to trigger the attack, you may not catch the attempt until you've tested the page several times. At once a week checking each link, that would mean on average a month or more in the wild.

Re:What Google should really be responsible for...

[smoker2]

A lot of cgi is protected by not accepting connections from anywhere other than the localhost, because you don't want people accessing scripts in ways other than those you expose. As a first line of defence it's quite useful. You must be able to control the input as much as possible. None of my mySQL DBs are accessible outside localhost for example (although that doesn't rely on headers, it's hard coded in the connection string).

Re:What Google should really be responsible for...

[makomk]

A lot of cgi is protected by not accepting connections from anywhere other than the localhost, because you don't want people accessing scripts in ways other than those you expose. As a first line of defence it's quite useful. You must be able to control the input as much as possible. None of my mySQL DBs are accessible outside localhost for example (although that doesn't rely on headers, it's hard coded in the connection string).

Yeah, but you can't safely do that using the referer header, since the attacker can send anything they want (including localhost). You need to look at where the connection is actually coming from.

Re:What Google should really be responsible for...

[TheMidnight]

Google employees checking every single one periodically? That is impossible. Also, why not demand that Youtube employees would watch through every video?

Don't give Viacom any bright ideas...

Re:What Google should really be responsible for...

[michaelhood]

Maybe someone should create a Firefox extension that allows you to optionally hide your referrer only when it would expose a 3rd-party URL.

i.e. you pass a normal referrer if you're clicking from one page to another within the same domain/site, but it's scrubbed if you're coming from one domain to the other. This would fix most of the hotlinking concerns, and still allow a modicum of user privacy.

Marketers (including myself) won't like it, but I'm pro-privacy before pro-marketing.

Re:What Google should really be responsible for...

[michaelhood]

What if there's a 10-second delay before the redirect? If your spider leaves the site too soon, it'll never know. In contrast, many users would likely still be on the page after 10 seconds.

Just about any setTimeout()-delivered attack would be effective. Spiders execute a very, very limited subset of JavaScript. And that's only recently, many don't execute any at all still.

There are plenty of rumors that Google is using automated, modified Gecko engines for certain types of spidering. This would allow them to properly execute JavaScript for purposes like this.

This is not nearly as efficient as their normal spider, for obvious reasons, but I think we'll start to see more of it as "blackhat" marketers become more creative in hiding nefarious deeds.

the cop parable

[Teferison]

Taking the local traffic cop a step further:
How would you react if you knew a cop received money to direct you to an dealer, although that dealer is wanted by the same police department?

Re:the cop parable

[Jellybob]

I'd be pissed off.

Everyone else can tell me where the local dealer is without me having to pay them for the information ;)

Re:the cop parable

[FrozenFOXX]

Taking the local traffic cop a step further: How would you react if you knew a cop received money to direct you to an dealer, although that dealer is wanted by the same police department?

I'd start to wonder why a police officer was directing me to a drug dealer. Actually, my first reaction would be, "What the hell is a cop doing talking to me?" I don't think the analogy is working as intended.

Re:the cop parable

[Teferison]

True the analogy is not working 100%, but what I wanted to say, is that google is doing more then "overlooking" malware. They are advertising these sites, thus making money with those ads. I don't want to imply that they do this deliberately, but it's not an oversight, they could and should automatically compare the advertisers with their malware black lists.

it's like that with any media.

[Anonymous Coward]

GO to the back of any magazine and you will inevitably find at least one questionable business. Even the main advertisements on the front can be questionable: Enron used to publish big colorful ads.

Advertisements and editorial content has always been a separate thing.

Re:Responsibility

[jorghis]

Its very easy to say Google should know what Google is doing but we all know that interdepartmental communications in large companies sometimes don't work all that well.

/sarcasm on
Yes, I am sure that with all the smart people at google it never occured to ANYONE that maybe it would be a good idea to use that spam/malware site filter on adwords. Its not like those are two of the most well known groups at Google or anything. /sarcasm off

Google has been selling ads to link farms forever even though it (attempts) to filter them out of search results. It is their policy to do so even though they do everything they can to lower their rank in regular search results.

It would be easy for them to do so but they choose not to do it. Come on guys, if Google filtered and MS did not everyone would be ranting about how MS is promoting malware and spam to make a quick buck.

Re:GoogleAds should moderate themselves more.

[Anonymous Coward]

Tell my mother-in-law that.

Seriously. Some of these are scams, but there are also real genuine people getting married to real genuine people through weird international hookup things.

You have to be kidding

[Dishevel]

notthatwillsmith must be a reporter from NBC or somthing. Did you seriously write a big evil corporation story about 1 text ad? Then at the end you do the whole "Was this a one-time oversight?" thing. Good job on findiung and sensationalizing Nothing.

Re:You have to be kidding

[Anonymous Coward]

Actually he's the editor-in-cheese of Maximum PC magazine, the site that the story links to.

And apart from a serious Peggle addiction, he's a pretty good guy.

Re:GoogleAds should moderate themselves more.

[geminidomino]

I'm glad they gave you net access in the pokey, Hans...

(What? Too soon? :) )

Comment removed

[account_deleted]

Comment removed based on user account deletion

Some badware (working) links in Google Shopping

[Anonymous Coward]

http://www.google.com/products?q=powerbook+g3+lithium+ion+battery+M4685&btnG=Search+Products&show=dd&scoring=p

Still links to malware sites, it's a search for a powerbook g3 battery on google shopping... the $60.06 ones are all links to badware

Tech support - unsafe site my ass

[zakezuke]

I recently got infected with Antivirus 2008. Googling for a solution, mainly which windows exploit was used to get it on the system I found the following type of comments.

"You are infected with a malware that you picked up because of your browsing habits"

Yeah right, I got infected because of Google Ads, which can be found on many a mainstream site. I actually had just updated my virus definitions (avast), and updated my firewall. My windows updates are not as up to date as they could be, which is rather why I ask which one takes care of this exploit?

The behavior was a forced reboot with no option to run cmd to abort it. After windows said something about not connecting to "all" network drives, which is odd as I don't have any network drives setup. Then the process "brastk.exe" appeared.

Re:Tech support - unsafe site my ass

[slash.duncan]

I recently got infected with Antivirus 2008. Googling for a solution, mainly which windows exploit was used to get it on the system I found the following type of comments.

"You are infected with a malware that you picked up because of your browsing habits"

Yeah right, I got infected because of Google Ads, which can be found on many a mainstream site.

As they said, infected due to your browsing habits.

If you were running an ad blocker, you couldn't have been infected by an ad. It almost certainly required scripting, with a good chance it required cross-site scripting, as well. Thus, scripting off by default, regardless of your ad viewing preferences, would have stopped it in most cases, and even if you had that mainline site whitelisted, the malware site it tried to load stuff from would have fallen into the no-scripting default and thus would have been blocked.

Also, browsing habits could well be defined as inclusive of the platform you choose to browse from, and almost certainly would include your choice of browser. You don't here of so many getting infected running say firefox on MS, and even fewer running any of the even semi-common Linux platform browsers...

All of those can be reasonably included in browsing habits, yet changing just one of them, one of adblocker, script-blocker, browser, browser-platform, would have likely made you immune. Change all four of them, still keeping in mind they all fit reasonably within the definition of browsing habits, and the chances of being infected by an ad that's blocked, requiring scripting that's turned off, targeting a browser you aren't running, on an OS that if you run at all, you don't consider secure enough to browse the web with, are practically nil!

So yes, browsing habits, indeed. Just because they are common browsing habits doesn't make them /safe/ browsing habits.

Re:Tech support - unsafe site my ass

[zakezuke]

All of those can be reasonably included in browsing habits, yet changing just one of them, one of adblocker, script-blocker, browser, browser-platform, would have likely made you immune. Change all four of them, still keeping in mind they all fit reasonably within the definition of browsing habits, and the chances of being infected by an ad that's blocked, requiring scripting that's turned off, targeting a browser you aren't running, on an OS that if you run at all, you don't consider secure enough to browse the web with, are practically nil!

I'm sure what is meant is "if you're going to search for vvarzz you're going to get infected". I could change my platform, I could run an ad blocker.

Browser, well, I got infected using firefox v2.0.0.18. I "should" update.

Google doesn't give a damn as long as they're paid

[glindsey]

You want proof? Google for "spybot" or for "adaware" and see how many deceiving pieces of malware are advertised in the sponsored links:

"spybot": 3 sidebar, 1 at the top.
"adaware": 3 at the top
"ad-aware": 1 sidebar, 1 at the top

I'm always sure to tell my friends and relatives the actual URL for Spybot S&D or LavaSoft because of these scamming low-lifes. I've reported them a half-dozen times to Google, gotten an automated response, and never seen a change.

Re:Responsibility

[halcyon1234]

One thing I can never figure out: Gmail's spam filter is awesomely amazingly accurate. In the years I've had my gmail account, I think maybe 3 spams have made it through, and I've had 0 false positives.

Given that, why can't they apply that same well-learned spam filter to their ad words? An email subject line and an ad-words tag line are not all that dissimilar. It might cut down on the 99.9% of crap that comes through along the lines of "make 40k per month", "looking for [insert term]? find it here!", and "natural herbs online that pharmacy don't want you to know about!"

Unless there's one of those "things" going on. Maybe Google is perfectly capable of filtering them out, but they chose not to. They know that their adwords are unobtrusive to most, and blocked by the rest-- and maybe they know that their spammy ad words don't actually generate any significant business. So they gladly allow them, knowing the ads are worthless-- but will gladly take the spammer's money.

It'd be a beautifully perverse poetic justice: the spammers are shelling out cash hand over fist to buy a worthless product because they perceive it will earn them tons of cash. =)

NEWS FLASH

[Cowmonaut]

News Flash: The Internet is a potentially dangerous place! There are bad things out there.

Is anyone particularly surprised that a business isn't actively trying to police it? That would be a huge sinkhole of money.

Oh and their anti-malware site protection on search results isn't perfect either. Occasionally stuff still slips through.

Nothing to see here, move along...

Google wants money

[Anonymous Coward]

Google doesn't give a f*ck, i've seen it happen, not with malware sites but with an electronics store scam. They'd change their name every few months but they always had their google ads to lure customers. They "sold" high-end cameras, plasma tvs, whatever, for very low prices, never sending the items to the customers. Some people did warn Google; did Google care? No.

Slashdot Posting Known Spam Stories

[Colonel Korn]

It seems like half of the stories here are posted for us to go through the same gratuitous cycle. A halfway baseless article criticizes or praises a company that for some reason a lot of us like and a lot of us dislike. A lot of people post about the article proving that the company is evil. Other people respond and defend the company. A few posts on either side are reasonable and balanced. A few are reasonable and unbalanced. Most are just a big pile of poorly concealed flame. Then we repeat in 90 minutes with a new target.

I'm getting tired of criticizing Google, myself. I am not a fan of the company by any means, but what's the point of posting roughly the same hate cycle 3 times a week? Half of the more unique stories are even beginning to feel pointless to me now, since most of the discussions end up heading toward creationists, atheists, or a general left vs right (or libertarians vs. everyone) brawl.

Hey kdawson!

[Anonymous Coward]

Quit posting rational, cautionary, suffices--how can we complain about that?

(Seriously, good reminder)

Other examples. Google still evil.

[Animats]

That's not a lone example. Search with Google for "craigslist auto posting software". These are all paid Google ads:

• "CL Posting Software www.adsoncraigs.com The worlds Best Selling CraigsIist software. Works with new CAPTCHA!"
• "Craigs Works Must Try Us webtrafficus.com We do the work no software To Buy Best Service All Ads Guaranteed Up"
• TopPost Inc. www.toppost.com The Leader in Posting Services 866-895-6888 -- info@toppost.com
• Buy Craiglist accounts Phone verified accounts, hassle-free, only 4.95$/account . www.craigsup.com

We track the "bottom feeders" in Google AdWords over at SiteTruth. We consider about 36% of Google's advertisers, out of a set of 20,000 ad domains, to be "bottom-feeders" - no visible business address, or we have other negative info. If you download AdRater, our Greasemonkey script for Firefox, we rate the advertiser behind every Google ad you see and display a rating icon on top of the ad. (Yes, the plugin "phones home". It tells us lots of stuff about the advertiser, which we're interested in, and very little about the user's browsing, which we don't care about. The plugin is open source, so you can check this.)

With the information we have, it's painfully obvious that Google isn't picky about their advertisers. The example in the article is one of many, not a unique exception.

Google CEO Eric Schmidt was quoted last month as saying "The Internet is fast becoming a cesspool" Was he complaining, or boasting? Much of that is Google's doing.

to "do no evil," they should first check 'em out

[swschrad]

and if the links go to EvilLand, send the deposit back, and notify SpamHaus and the other badware trackers.

Re:Responsibility

[mfh]

Well thanks for the mod bomb. But I don't care if this also gets -1 Troll. Google rakes in cash and doesn't care where they get it from. They sell our information to THE HIGHEST BIDDER.

Most of the people interested in buying information from Google, use that info for nefariously shady dealings.

There is no coincidence that Double-Click and Google are one and the same.

Do no evil? LOLOLOLOLOLOLOLOLOLOLOLOLOL

Re:Responsibility

[mfh]

Unless there's one of those "things" going on. Maybe Google is perfectly capable of filtering them out, but they chose not to.

Claiming to do no evil since day one is more profitable than conceding a loss to Satan's forces and being honest. You have to tell the truth to get out of Hell. Remember, we're dealing with Double Click here, not just Google. They are one-and-the-same.

Google isn't entirely innocent

[lemur666]

A while back my credit card info was stolen and I first noticed it because of some suspicious charges.

What were the charges?

Google adwords. Several hundred dollars worth and all pointing to malware sites.

Clearly, the first for steps whomever stole my credit card info were to set up ads directing folks to sites that could potentially be used to infect more machines, steal more info, etc.

This was almost a year ago, so Google (at some level) has to know that this sort of thing is going on. And if it's still going on a year later, it must still be successful as a way to spread malware.

Not it's possible Google isn't doing anything about it because they think that if they start policing it, they may be exposed to more liability.

Re:Responsibility

[Mister Whirly]

Maybe Google should change their motto to "Do slightly less evil than the other guy."

Re:GoogleAds should moderate themselves more.

[jonbryce]

One of the sites I visit on a regular basis is a site called housepricecrash.co.uk . It is a site for people who think real estate is going to fall in price.

The google ads on that site are mostly for property investment clubs, which is the last thing their readers are going to visit.

Re:Responsibility

[RenderSeven]

LOLOLOLOLOLOLOLOLOLOLOLOLOL

Just checking... is that "Laughing out loud out loud out loud out loud" or "Laughing out laughing out laughing out laughing out loud"? :)

Its still in beta

[paziek]

Google AdWords are still in beta, its a work in progress. Soon we shall see final release without such bugs.

Re:Responsibility

[mfh]

I'd have to say that is someone who can't contain their laughter.... similar to the old fashioned "Bwhahahahahah!!!"

Just reported Google Ad yesterday

[Anonymous Coward]

I found an add for a money making scheme - "Make $1000/day using Google" best of all!
The ad also says only a CC is needed - yea, ahem, sounds like phishing to me!
I'm afraid Google may have to implement some new technology to filter out future garbage like that: Actual humans actually reading through AdSense candidates!