Some fun with bing and java...

[lab34]

Sorry the article is in french, but in brief:

You go to Bing, search java, the first link propose you a download link that mimic the java installer,
it asks you to send an sms to a phone number that costs 4,50 EUR to receive a code.

Maybe it works in France only.

I've test it with Chrome and Edge, with BD IS. No problem...

VT is showing that avira and eset are detecting it today:
Scan report for http://r9.jav.fufush.xyz/fr/index/listado/?pk_campaign=Jav at 2017-05-21 09:45:17 UTC - VirusTotal

Note: nothing is downloaded, it's only HTML...

Spoiler: Bing+Java

 

[brod56]

That ad is only working in France. Nothing for me here in Portugal

 

[lab34]

We have the same kind of ads for flash or vlc...


This time, no code, but the vlc_setup.exe contains bad things.
Antivirus scan for 2d3656aa683216ddd85e515b9845f18ff919798d0f227d38d51943cc79372fd6 at 2017-05-21 09:57:50 UTC - VirusTotal

 

[Atlas147]

Interesting that bing would throw out malware laced installs as their first result, and they wonder why barely anyone uses them

 

[lab34]

Yes, I have the same feeling about the Windows store.

I've bought a Lumia to my wife last year, with windows 8.
Nice OS, I would say between Android and IOS in term of usability. And the phone was super cheap and still fluid. Well optimized.
But the store is...

A lots of apps let you think that they are "officials" and that not the case (youtube, wikipedia...). I'm feeling like in a jungle...

 

[Winter Soldier]

Someone has probably exploited SEO techniques to get the first result on Bing search.
And someone else should investigate at this point.

 

[roger_m]

I went to the site and downloaded the Java installer. It wanted me to install a Chrome extension before letting me download the file. But it did give me the option to skip that and start the download. The downloaded installer has the same filename as legitimate Java installer, but is an adware downloader. It can download and run the genuine installer, but also wants to download unwanted third party software as well.

 

[lab34]

Someone has probably exploited SEO techniques to get the first result on Bing search.
And someone else should investigate at this point.

There is an (i) after the link, so that means "announce". I think they just paid for that...