Vulnerabilities / Threats
9/29/2009
06:32 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Microsoft Bing Ads Warn About Scams

As part of its ongoing security push, Microsoft is teaming up with the government and Western Union to run search ads to educate users about potential online fraud.

In keeping with expanding efforts to educate consumers about security risks, Microsoft, in conjunction with the Federal Trade Commission, the United States Postal Inspection Service and Western Union, has launched a series of online public service announcements (PSAs) on its Bing search engine to warn searchers about online scams.

The PSAs appear as sponsored ads atop Bing search results lists in response to keywords commonly targeted by scammers.

A search for "Microsoft Lottery," for example, returns a sponsored link at the top of the search results list titled "Advance Fee Fraud Scams," followed by the admonition, "Don't send money before verifying the source of the request."

The link leads to a Microsoft Web page that explains how advance fee fraud scams work.

Other keywords designed to trigger the PSAs -- such as "credit repair" and "mortgage foreclosure" -- lead to landing pages hosted by the FTC. However, these PSA links are intermingled with other sponsored links on Bing.com, making them less noticeable than the lone Microsoft ad triggered by the keywords "Microsoft Lottery."

"The campaign builds on similar information we recently began providing in Windows Live, all with the idea that by providing education within the product experience, consumers will be reminded to be cautious at the very moment it's most important," said Microsoft associate general counsel Tim Cranton, in a blog post. "Obviously, these particular issues are not the only scams or fraud consumers might come across online, but they certainly are some of the more prevalent scams out there. We see this campaign as a positive step in an ongoing effort to help make the Internet a safer place."

Microsoft has taken other steps in the same direction recently. Two weeks ago, Cranton announced a related effort to improve online security: the filing of five lawsuits aimed at curbing the spread of malicious online ads, or malvertising. And on Tuesday, Microsoft also released its own free antivirus software, Microsoft Security Essentials, in an effort to raise the security baseline of Windows systems.

Rohyt Belani, managing partner and co-founder of the Intrepidus Group, a security consultancy, said in a phone interview that organizations with large consumer bases have become more focused on educating consumers, partly in response to the FTC's "Red Flag Rule," which requires creditors and financial institutions to have identity theft prevention programs to detect and respond to activities that may be indicative of identity theft.


InformationWeek has published an in-depth report on smartphone security. Download the report here (registration required).

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5312
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

CVE-2012-6662
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.

CVE-2014-1424
Published: 2014-11-24
apparmor_parser in the apparmor package before 2.8.95~2430-0ubuntu5.1 in Ubuntu 14.04 allows attackers to bypass AppArmor policies via unspecified vectors, related to a "miscompilation flaw."

CVE-2014-7817
Published: 2014-11-24
The wordexp function in GNU C Library (aka glibc) 2.21 does not enforce the WRDE_NOCMD flag, which allows context-dependent attackers to execute arbitrary commands, as demonstrated by input containing "$((`...`))".

CVE-2014-7821
Published: 2014-11-24
OpenStack Neutron before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (crash) via a crafted dns_nameservers value in the DNS configuration.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?