Google Finally Quashes Month-Old Malvertising Campaign

jfruh writes Since the middle of December, visitors to sites that run Google AdSense ads have intermittently found themselves redirected to other sites featuring spammy offerings for anti-aging and brain-enhancing products. While webmasters who have managed to figure out which advertisers are responsible could quash the attacks on their AdSense consoles, only now has Google itself managed to track down the villains and ban them from the service.

Comments

Don't do evil

[thsths]

unless it is profitable.

Google standards have certainly slipped. You would expect them to prevent this at all cost, and to have a system in place that prevents it from happening. But unfortunately the very opposite is happening: unruly ads are becoming more and more common, and Google doing very little to prevent it.

Re:Don't do evil

[phantomfive]

Yeah, I remember when Google's goal was to index the world's information. That seems to have taken a back seat to generating ever more revenue.

Re:Don't do evil

[bloodhawk]

No they are being called out for how slow they are, just like when we call out MS when they are slow on patches. It is even worse for google as they like to blow there own trumpet on how important security is to them.

Re:Don't do evil

[hairyfeet]

Nooo, folks are getting upset because Google USED to be consumer centric and seemed to really care about its end users, but for the past few years (since around the time they launched G+ and started pushing for real names and tying everything to a single user) they have seemed to toss that out the window in favor of ever higher stock prices.

I have to wonder if this is something that cannot be avoided as it seems every corp that reaches the top of the heap turns into an asshole. Its like they reach a certain point and their drive to innovate and be the best is replaced by a paranoid desire to hang onto what they have and crush competition, from MSFT's OEM contracts to Google's damned near word for word copies of those contracts when it comes to handset makers, its like they reach a point and the engineers are replaced by MBAs and they just turn into giant douchebags.

Re:Don't do evil

[houghi]

The first moment people were alerted was when they killed DejaNews.com But I said nothing, because I was not a Usenet user ...

Re:Don't do evil

[Jeff DeMaagd]

Sometimes it helps to at least read the abstract. The complaint was about the speed.

"Since the middle of December... ...only now has Google itself managed to track down the villains and ban them from the service."

Another issue is Google's ad system being vulnerable to being bait and switched, even allowing advertisers any opportunity to do that seems a poor decision.

Not a priority

[phantomfive]

Stopping malware is not a priority for advertising companies. The priority is to do whatever they can to help advertisers, because advertisers give them money. Money focuses people's priorities (including mine).

Re:Not a priority

[RogueyWon]

It should be a priority - because if it isn't, it will start hitting revenue. I'd gone years without using adblocking software, on the grounds that I knew a lot of sites I liked depended on advertising income.

When Yahoo! ads starting redirecting to ransomware-pushers a couple of months ago, I reversed my policy fast.

Re:Not a priority

[swillden]

Stopping malware is not a priority for advertising companies. The priority is to do whatever they can to help advertisers, because advertisers give them money. Money focuses people's priorities (including mine).

It is actually a priority. Google's ad-ranking system takes into account not just the revenue potential from an ad click but also "ad quality", a metric that considers various aspects of the ad, the site to which it links, and more, all related to the user experience. Because Google knows that it's important that when users click on a Google ad they have a good experience. Otherwise, they'll click less. Given that Google only gets paid when they click, that's directly bad for revenue. It likely also reduces the value of the ad to the advertiser, since users who do click may arrive more skeptical of what they'll find, and be less likely to buy. So advertisers will bid less, and that's bad for revenue.

To help the advertisers, Google provides feedback on what they can do to improve their ad quality metric, because it's one of two levels advertisers have to control how often their ad is shown (the other is how much money they bid for each click). Google also provides details statistics to enable advertisers to calculate their ROI from advertising on Google, which will quickly show the damage from any degradation in user trust in Google ads.

I don't know the details of what happened here, and although I could search the bug database to find out, if I knew the details I couldn't post. That said, I strongly suspect that what happened here is that the situation was more complicated than is presented in the article and that there were very good reasons why it took the Google ads team so long to address the issue. Because bad ads are bad for Google.

(Disclaimer: I work for Google, but don't speak for Google. My description of the ad ranking system is public knowledge and the rest is only my opinions.)

system is not foolproof ...

[thephydes]

"Google says that AdSense content is “reviewed by real people and clever machines” before appearing on websites. But the system doesn’t appear to be foolproof." If you actually believe that it's foolproof, then you could well be labeled a fool. just sayin

Re:system is not foolproof ...

[meerling]

Maybe they have too much 'young blood' and need some critical and skeptical 'old school'.
Age doesn't have anything to do with it, procedures and techniques on the other hand...

Re:This is why I use adblockers

[houghi]

I hate adds since the moment they were around. I always have hated them and not only online. I hate them in the streets. I hate them on TV. I hate them on cars. I hate them on clothes.

And there is no way of turning them off. Except perhaps for North Korea, you will be bombarded by ads. Here a quote that I really like.

People are taking the piss out of you everyday. They butt into your life, take a cheap shot at you and then disappear. They leer at you from tall buildings and make you feel small.

They make flippant comments from buses that imply you're not sexy enough and that all the fun is happening somewhere else.

They are on TV making your girlfriend feel inadequate. They have access to the most sophisticated technology the world has ever seen and they bully you with it.

They are The Advertisers and they are laughing at you.

You, however, are forbidden to touch them. Trademarks, intellectual property rights and copyright law mean advertisers can say what they like wherever they like with total impunity.

Fuck that.

Any advert in a public space that gives you no choice whether you see it or not is yours. It's yours to take, re-arrange and re-use.

You can do whatever you like with it. Asking for permission is like asking to keep a rock someone just threw at your head.

You owe the companies nothing. Less than nothing, you especially don't owe them any courtesy. They owe you.

They have re-arranged the world to put themselves in front of you. They never asked for your permission, don't even start asking for theirs.

- Banksy

The issue is far worse and all we do is treat it differently because it has "On the internet" in front of it.

Abusing Zedo and Doubleclick Ads

[billstewart]

I was ok with Google ads, because they were just a little box with some text links, no bulky images, no animation, no Flash, and if there was any Javascript in it, it was well-written and not a resource hog. (Eventually I gave up and let AdBlockPlus block them too, because collateral damage was easier than special-casing them.)

But Zedo, the folks with popunder windows? Kill them with fire, put all their domain names in /etc/hosts as 127.0.0.2, tell Firefox to block images from them, and block Javascript and Flash from anybody I could identify using a Zedo ad. (Same for X10.)

Doubleclick was an early ad company, and as far as I could tell, before Google bought them their slogan was "Be Evil. Buy Ads from the Dark Side, We've Got Cookies!" so I'd been blocking them in /etc/hosts for a long time.

So if Bad Guys were putting even more malware into Zedo and Doubleclick, that's just a reminder that blocking aggressive advertisers is a good idea.