FBI recommends using an ad blocker
The FBI warns of cyber criminals using search engine ads to impersonate brands, directing users to malicious sites that steal sensitive information. Users should verify URLs and report fraud.
Read original articleThe FBI has issued a warning regarding cyber criminals who are using search engine advertisement services to impersonate legitimate brands, leading users to malicious websites that can steal login credentials and financial information. These criminals purchase ads that closely resemble the actual business's domain, making it difficult for users to distinguish between genuine search results and fraudulent advertisements. When users click on these ads, they are directed to counterfeit websites that mimic the official pages of the impersonated brands. In some cases, these sites offer downloads that contain malware disguised as legitimate software. The FBI highlights that this tactic is particularly prevalent in the finance sector, especially with cryptocurrency exchanges, where users are prompted to enter sensitive information. To protect themselves, individuals are advised to verify URLs before clicking on ads, directly enter business URLs into browsers, and use ad-blocking extensions. Businesses are encouraged to utilize domain protection services and educate users about the risks of spoofed websites. Victims of such fraud are urged to report incidents to their local FBI field office or the FBI Internet Crime Complaint Center.
- Cyber criminals are impersonating brands through search engine ads to defraud users.
- Fraudulent ads lead to malicious sites that steal personal and financial information.
- Users should verify URLs and use ad-blocking tools for protection.
- Businesses should implement domain protection and educate users on spoofing risks.
- Victims are encouraged to report fraud to the FBI.
Related
Mac users served info-stealer malware through Google ads
Mac users targeted by info-stealer malware via Google ads promoting fake Arc browser for Mac. Malware sends data to Poseidon info stealer control panel, extracting wallets and passwords. Google disclaims responsibility. Users urged caution.
The Curious Case of Fullers Library and Its Deceptive Link Requests
A deceptive link-building scam involves organizations like Fullers Library and Lyndhurst STEM Club for Girls. They send misleading emails suggesting irrelevant links to boost search engine rankings, deceiving unsuspecting websites. Despite appearing legitimate, these requests are fraudulent. Website owners are warned to scrutinize link requests to avoid aiding such scams.
Yandex Cooperating with FSB to Single Out Dissidents
Russian activists warn that fake websites mimicking volunteer groups are FSB traps to collect personal data. Yandex is accused of promoting these sites, which are confirmed as fraudulent by actual volunteers.
Sextortion Scams Now Include Photos of Your Home
A new wave of sextortion scams uses personalized threats, including victims' home photos, demanding Bitcoin ransoms to prevent video release. The FBI advises caution and encourages reporting such incidents.
Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords
Hackers are using a fake OnlyFans account checker to distribute Lumma malware among cybercriminals, highlighting the risks of betrayal and deception within the cybercrime community.
POV:
Here's a particularly salient critique of these very same FBI recommendations, from my article:
> The FBI suggests “Before clicking on an advertisement, check the URL to make sure the site is authentic. A malicious domain name may be similar to the intended URL but with typos or a misplaced letter.” — this is useless advice in the face of unverified vanity URLs
In other words, there is code in the backend checking that all tracking/-ware has run on the browser, and refusing to let you login unless you let it all run, while none of it is necessary (as evidenced by older versions - and other sites - accepting only the top site being JS-enabled).
"We either track the living shit out of you, or you don't access the essential services you need, even though technically it is not needed."
The original Google site hit the perfect pitch, where they set a few unobtrusive ones out of the way alongside your results screen. Ironic they pioneered and eventually normalized what is now an epidemic of user-hostile spam all over the web. I feel as a whole we lose a lot more productivity and focus to this than we gain in economic activity.
https://www.microsoft.com/en-us/edge/learning-center/using-a...
https://support.microsoft.com/en-us/office/supported-browser...
The counter-argument that they don't need to know their customer/ad and are just dumb-pipes doesn't sit well with me: Them having awareness of ad-content and display-context is ostensibly part of their business model.
P.S.: I don't mean just liable for a part of the damages, although that would be a good start. I mean that if your Aunt Tillie gets served an ad of "Your computer is infected, click here to contact a Microsoft Technican" there should be some negative repercussions for the company, even if your Aunt Tillie is secretly the hacker BakinC00kies and spins up a honeypot.
The FBI now recommends using an ad blocker when searching the web:
https://news.ycombinator.com/item?id=34916239
734 points | 2 years ago | 430 comments
When situations like this happen, I mostly place the blame on ad companies. It’s their product, so it should be their responsibility to prevent abuses. But there is scant regulation, and the ad industry itself has little concern for privacy and data protection. Why would it waste money being proactive and effective against malicious ads?
It is nice to see the government recommending ad blockers. However, it bothers me that it is up to us, users and customers, to deal with the negligence of ad companies.
YouTube/hulu/disney+ still cut to ads instead of displaying them around the border of the content.
Carl’s Jr/Brawndo still haven’t purchased the FCC.
We are pretty close though.
I tried pihole maybe 8 years ago, and it just broke too many websites for me to leave it on for my wife. It really frustrated her.
The gold standard which works as an extension in both chrome and Firefox is uBlock Origin, annoyingly not to be confused with uBlock.
https://addons.mozilla.org/en-US/firefox/addon/ublock-origin
https://chromewebstore.google.com/detail/ublock-origin/cjpal...
Also be aware that Google continues to add restrictions to extension permissions such that uBlock Origin may not be as effective as it once was.
Governments should start holding companies that sell ad space responsible for the ads they run. There's no way any company with the resources of Alphabet or Meta should be serving up phishing ads in their search results.
The fact that Google is presently trying to degrade the performance of ad blockers with Manifest V3 is not a good look. This is why we have consumer protection laws.
Yeah, good luck doing that with all the various tracking links that mask the actual domain. Sometimes I try to click on links from legit account related emails that are blocked by UBO for being part of a tracker/ad network.
If you've ever looked for a recipe, you'll know how many obstacles there is without ublock. My hate is towards these type of websites.
This may be sadly outdated. Android Chrome and iOS Webkit probably account for majority of traffic nowadays, and neither allows adblock extensions.
Or does unlock origin lite cover everything?
I was thinking continent specific ad blockers etc
Related
Mac users served info-stealer malware through Google ads
Mac users targeted by info-stealer malware via Google ads promoting fake Arc browser for Mac. Malware sends data to Poseidon info stealer control panel, extracting wallets and passwords. Google disclaims responsibility. Users urged caution.
The Curious Case of Fullers Library and Its Deceptive Link Requests
A deceptive link-building scam involves organizations like Fullers Library and Lyndhurst STEM Club for Girls. They send misleading emails suggesting irrelevant links to boost search engine rankings, deceiving unsuspecting websites. Despite appearing legitimate, these requests are fraudulent. Website owners are warned to scrutinize link requests to avoid aiding such scams.
Yandex Cooperating with FSB to Single Out Dissidents
Russian activists warn that fake websites mimicking volunteer groups are FSB traps to collect personal data. Yandex is accused of promoting these sites, which are confirmed as fraudulent by actual volunteers.
Sextortion Scams Now Include Photos of Your Home
A new wave of sextortion scams uses personalized threats, including victims' home photos, demanding Bitcoin ransoms to prevent video release. The FBI advises caution and encourages reporting such incidents.
Hacker trap: Fake OnlyFans tool backstabs cybercriminals, steals passwords
Hackers are using a fake OnlyFans account checker to distribute Lumma malware among cybercriminals, highlighting the risks of betrayal and deception within the cybercrime community.