Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Microsoft

Some Bing Ads Redirecting To Malware 146

Posted by timothy from the which-is-worse-malware-or-av-nagware dept.
An anonymous reader writes "Security firm ThreatTrack Security Labs today spotted that certain Bing ads are linking to sites that infect users with malware. Those who click are redirected to a dynamic DNS service subdomain which in turns serves the Sirefef malware from 109(dot)236(dot)81(dot)176. ThreatTrack notes that the scammers could of course be targeting other keywords aside from YouTube. The more popular the keywords, the bigger the potential for infection."
This discussion has been archived. No new comments can be posted.

Some Bing Ads Redirecting To Malware More

Some Bing Ads Redirecting To Malware

Comments Filter:

  • Posting (Score:5, Funny)

    by c00rdb ( 945666 ) on Thursday October 10, 2013 @05:42PM (#45096439)
    Posting to undo accidental mod

  • I know it's another stereotypical diss on Bing but (Score:5, Funny)

    by themushroom ( 197365 ) on Thursday October 10, 2013 @05:45PM (#45096479) Homepage

    People use Bing?

    • And we get the MS logo instead of the Borg Bill. :(

    • Re: (Score:2)

      by Mitreya ( 579078 )

      People use Bing?

      Yes. More than a few software packages try to incorporate a Bing bar plug in and set the search engine/homepage to Bing. That includes some software that is not outright malware (well, at least not before they chose to make money on pushing toolbars).

      DirectX install tries to peddle Bing Bar which is installed with default settings.

    • Re:I know it's another stereotypical diss on Bing (Score:5, Funny)

      by interkin3tic ( 1469267 ) on Thursday October 10, 2013 @06:20PM (#45096803)
      Hey man, google STEALS your information! MS told me so. So that must mean that MS doesn't do that. I mean, they'd be HYPOCRITES otherwise. So I use Bing to keep my porn searches safe. My sexual attraction to boobs and butts will remain safe from the NSA.

    • Well there's Steve Ballmer, Bill Gates, Steve Ballmer's mom, and Bill Gates' mom.......and that's about it.

    • That was my first thought, too. My second was, "People still use Windows?"

    • Re: (Score:2)

      by Bremic ( 2703997 )

      Surely if Bing gives you a link to Bing, then Bing is linking you to malware...

    • Apparently. And they both just got... sbinged?

    • I do when Google tries to be too helpful and fails to give me the results I actually want, assumning I mistyped.

      Clearly most people have never used it, yet there seems to be a strong opinion that it's rubbish. I wonder how people know.

      • Re: (Score:2)

        by mcgrew ( 92797 ) *

        Clearly most people have never used it, yet there seems to be a strong opinion that it's rubbish.

        I tried it when it first came out. It was rubbish. Occasionally when Google goes haywire and gives me shit results I'll try Bing again... and get even shittier results. The last time I tried Bing, I was looking to find how to register for an ISBN. Bing's top result was a hardware store.

        People think it's rubbish because they've tried it and seen that it's rubbish.

        • Strange. When I typed "How to register for an ISBN" into Bing I got a page full of relevant results.
    • Yep. 4 of them to be exact.
    • I use it for Bing rewards. I have no loyalty to any particular search engine and if Microsoft's going to pay me to use theirs, so be it.

    • Re: (Score:2)

      by DiEx-15 ( 959602 )
      Well, I'd rather be Scroogled than Balmered any day.

  • This also in... (Score:3)

    by mythosaz ( 572040 ) on Thursday October 10, 2013 @05:48PM (#45096507)

    ...ad hosting network (that happens to be used by major search providers) compromised to serve malware.

    I suppose you can be mad at Microsoft for not constantly scanning their customers, but "Bing ads" is still misleading in the usual headline sensationalism way...

    • Re:This also in... (Score:5, Insightful)

      by ShaunC ( 203807 ) on Thursday October 10, 2013 @05:59PM (#45096609)

      ...ad hosting network (that happens to be used by major search providers)

      ...like Bing and Yahoo (whose search results come from Bing).

      "Bing ads" is still misleading in the usual headline sensationalism way...

      Yeah, it's not like the service itself is named [wikipedia.org] Bing Ads [microsoft.com], or anything.

    • Re:This also in... (Score:5, Insightful)

      by girlintraining ( 1395911 ) on Thursday October 10, 2013 @06:05PM (#45096661)

      I suppose you can be mad at Microsoft for not constantly scanning their customers, but "Bing ads" is still misleading in the usual headline sensationalism way...

      Actually, you can't. A standard tactic is to serve regular, unmodified ads, to IP address blocks known to have businesses that to this. For example, the google crawler -- many websites will show different pages if you simply sub the user agent string in as Google; Bypassing compulsory registration, not displaying navigation ... adding piles of SEO words to the bottom of the page, and the list goes on.

      Microsoft can't be expected to protect against stuff like this; Every website that allows javascript to be injected from a 3rd party website is equally vulnerable. And that's most of them; Including Slashdot; It has script links to rpxnow.com and fsdn.com. Hundreds of websites link into Google's ajax and analytics pages. A great many websites simply break if you disable 3rd party javascript.

      So blame Microsoft if you want, but really, the people you want work at ORACLE.

      • Here was the comment I was looking for. I've seen third-party ads attack from plenty of reputable (and not so reputable) sites. As much as I love piling on MS, Bing, and IE, I don't think it's wholly fair to single them out for this issue. Of course, anecdotes are worth little more than the electrons that carry the information to your eyes, but I'm fairly confident most of us have been called in to clean up an infection from [typical site used by many].

        Now, if you want to talk about Microsoft's awful ad

      • Re: (Score:3)

        by rk ( 6314 )

        Oracle? Believe me, I've a got a hate on for Oracle and the list and litany against them is long and storied, but how are they responsible for 3rd party Javascript?

        • Re:This also in... (Score:5, Funny)

          by Nemyst ( 1383049 ) on Thursday October 10, 2013 @11:02PM (#45098283) Homepage
          When in doubt, blame Oracle. It works surprisingly often!

          • Re: (Score:2)

            by rk ( 6314 )

            I hope it's not because Java and Javascript is getting confused. I run into a surprising number of techies that think the two are closely related, and apart from some syntax they both inherited from C, the only thing the have in common is "Java" in the name, which is Netscape's fault, not Oracle's. True, Oracle owns the JavaScript trademark, but it's the Mozilla Foundation that actually develops it.

      • Re: (Score:3)

        by rtb61 ( 674572 )

        Perhaps a legal review is required. How far should the advertiser be allowed to seperate themselves from the contents of the Ads they serve. The generate profits by promoting products and seem to be completely free from any responsibility for the reality of the advertisements versus what they actually promote.

        At the moment advertisers make money by selling products, blatantly promoted with lies and regardless if the impact of those products upon victims the promoters get to wander off laughing with those

    • '"Bing ads" is still misleading '

      No, it's the literal truth. The ad network is Bing Ads: http://advertise.bingads.microsoft.com/en-us/sign-up?s_cid=us_smb_a_web_bing_footer [microsoft.com]

  • Nothing to be afraid of here, unless the same ads are place beside Yahoo! search results.

  • Perspective (Score:5, Insightful)

    by Empiric ( 675968 ) on Thursday October 10, 2013 @05:51PM (#45096539)
    ...and for those of us who think that ads -are- malware, just targeted at a different processor, AdBlock still takes out two birds with one stone...
  • Why not? .... Money is money .....

  • One more reason for me to not use Bing (Score:4, Insightful)

    by harvestsun ( 2948641 ) on Thursday October 10, 2013 @06:01PM (#45096633)
    Aside from the other obvious reasons, such as "it looks awful" and "for the types of things I search for, it's vastly inferior to Google".

  • What kind of idiot moron (Score:1)

    by Anonymous Coward

    Clicks on ads? They deserve to be infected with sirefef. Plus, it's job security for me. Sirefef is a piece of cake to remove for me, but my customers are dead in the water. Money is money.

  • Security firm ThreatTrack Security Labs today spotted that certain Bing ads are linking to sites that infect users with malware.

    What do they expect? Of course Bing is going to link to microsoft.com.

  • The actual article is here.. (Score:5, Insightful)

    by Dynamoo ( 527749 ) on Thursday October 10, 2013 @06:18PM (#45096787) Homepage
    The actual article is here [threattracksecurity.com]. TheNextWeb is a stupid site that doesn't work at all if you are not running Javascript. I choose to block most scripts, partly because.. a lot of ads are infected with malware. Yuk.

  • Who's responsible for the ads served (Score:4, Insightful)

    by EMG at MU ( 1194965 ) on Thursday October 10, 2013 @06:18PM (#45096791)
    I think the pertinent question is whether Microsoft or Google or Yahoo should responsible for the ads they show.

    Take any given major website, turn off AdBlockPlus, FlashBlock (or alternatives), and NoScripts (or alternatives). How many ads can you count that are of the nature: "Learn that 1 wierd trick to lose 10 pounds" or "Enter your age to see if you qualify for money to go back to school" or "blah blah obvious scam".

    They are everywhere. Now for me, I think much less of a website and the entity that owns it if they are serving these ads. I actually feel that if you get scammed through one of them it should be the website's fault for being party to a crime, because they served you the malicious ad.

    If I had a brick and mortar business, and people paid me to stand inside my business and "demo products" or something, and you came in and got scammed, you would be pissed at my business. The business might also be liable.

    Obviously the internet is different than meat space. Obviously you cant fix stupid. So who is responsible for serving a malicious ad?

    • Re:Who's responsible for the ads served (Score:5, Informative)

      by Animats ( 122034 ) on Thursday October 10, 2013 @08:05PM (#45097507) Homepage

      I think the pertinent question is whether Microsoft or Google or Yahoo should responsible for the ads they show.

      That's a very good question. Because the major search engines do not vet their advertisers very well. Google had to pay $500,000,000 to the USDOJ when they were caught willfully running ads for an obvious drug dealer. [wsj.com] (No, it wasn't about "Canadian pharmacies". Some Google apologists tried to spin it that way, but the details came out.) Google has since clamped down. They had to; they were on DOJ probation for two years, with felony charges hanging over them. "Oxycontin no prescription" no longer returns ad results. Same for "viagra". Bing now pops up an "Is it legit?" box for searches like that.

      Google's clampdown was narrow. Searches with "foreclosure" and "credit repair" have a high population of scammers. Financial search keywords carry a high price, because the marks can be taken for big amounts.

      It's possible to measure basic advertiser legitimacy. We do that with SiteTruth [sitetruth.com], which tries to find the real-world business behind the ad. For over 30% of Google advertisers (by domain name), there's no identifiable real-world business behind the ad. (Running an anonymous business is illegal in some states and in the EU.) That's embarrassing, and highly profitable for Google.

  • All ad networks do this (Score:5, Insightful)

    by onyxruby ( 118189 ) <onyxruby&comcast,net> on Thursday October 10, 2013 @06:26PM (#45096841)

    Not defending Bing in particular here, but every ad network gets utilized to deliver ads by malicious parties. Every ad company you can think of has staff that work full time just to look for and filter out malicious ads. A pretty significant portion [securitybistro.com] of all malware is delivered my ads that are unwittingly served by sites from Facebook to CNN or any other site you can think of.

    Here's a nice link to a NIST [pdfeigchxu....awccadrja] report on the matter that you can get to once the government gets back to work. The problem goes back many, many years, so why on earth is this being reported as news?

    • Re: (Score:2)

      by swb ( 14022 )

      My understanding of this is that the ad networks historically didn't do much if any scrutiny and the business was largely built on near total automation which made it very easy for malware-based ads to filter through.

      Have they changed this? I would guess that having people do this manually would not be remotely cost effective given the revenue per ad.

      • I sincerely doubt that they have people manually review much of anything (new accounts perhaps?). Companies are going to fight this kind of thing at the macro level, not at the micro level. I'm sure security staff investigate individual instances of note that are flagged by automated system in order to beef up security knowledge or see if an account should be banned. That being said I would imagine that they have automate the overwhelming majority of the work.

        The ad agencies have been battling this kind of

  • surely i'm not alone? (Score:3)

    by steak ( 145650 ) on Thursday October 10, 2013 @08:13PM (#45097547) Homepage Journal

    doesn't every body love bonzi buddy?

  • This just in: a freaking buttload of Google ads redirect to malware. If you want an example, type in "[insert name of any manufacturer or anything] support" into Google. 100% of the paid results are fakes, scams, or install malware. This has been true for years. Why don't they do anything about it? $$$$$$$$$ of course.
  • Because of this I was messing around and found the biggest act of defiance anyone or group can do is turn off cookies.

  • Use ABP/ABE, noscript and ghostery. (Score:1)

    by Anonymous Coward

    Advertisers have risen from their graves to eat your brains. Stop them with adblock plus / edge, noscript and ghostery.

    You know they are effective when advertisers call them the 'trifecta of evil' - http://www.makeuseof.com/tag/adblock-noscript-ghostery-trifecta-evil-opinion/

    Oh, and if you happen to be an advertiser who is reading this comment, I have a very special message to you. Advertisers: please kill yourself. You failed out of your chosen field and profession and have become an advertiser. You ha

  • Bing ads that infect users Microsoft Windows computers with malware, shurly :)

Slashdot Top Deals

I tell them to turn to the study of mathematics, for it is only there that they might escape the lusts of the flesh. -- Thomas Mann, "The Magic Mountain"

Close