Yet when I search for "download Firefox", the thing I see is malvertising. https://i.imgur.com/IRQ85fx.png
I just went and downloaded the app from that add and compared the checksum against the APK on my phone of the same version (version 42.0.2, downloaded from Google Play)
They both match. (Both SHA256 checksums are D0B5A524ABFD5AD9D73DFF4DA398423CB7B337797FBA0C039F3A44CAE259B4B0, if you want to verify it from me as well)
So that site is providing an untampered download of firefox, so there is no "malware" anywhere.
In fact that site (HTZapps) seems to be a curated list of "safe" apps available to download, an alternative app store much like fdroid or the amazon app store.
It even follows the Adsense guidelines on their download page (clearly called out advertisements, no more than 3 on the page, only one above the fold, they don't interrupt the flow of the page, etc...)
It's an advertisement which seeks to get users to download software from an unofficial source. The site does not provide links to the official sources.
The advertiser has paid money to get users to go to their site instead of the official source. The advertiser seeks to misdirect users into visiting their site (which is loaded with ads) instead of the official one. I consider this misdirection to be malicious.
You're correct though in that just randomly picking mirrors is a bad idea. I seriously doubt your average person is utilizing checksums.
Sure, if you're utilizing checksums the way they should be then go ahead. But honestly, even I don't care that much - my ad-heuristic was sufficient so far :). I should probably start using them. I guess it's like with all things crypto - the UX sucks so bad that most people don't bother.
Well...it would take a particularly craft individual and far too much time, but spoofing a malicious MD5 checksum should be considered plausible. The chances of it being malicious, however, are drastically reduced to such a large degree as that it is safe to consider it negligible. (Note: I only make this claim about MD5 checksums, not SHA-1 or SHA-2. I do not consider MD5 secure in any manner and my trust of SHA-1/SHA-2 isn't exactly high either.)
I provide SHA-1 and MD5 checksums of any software I distribute - if only because I think it is the proper thing to do. Even if most people don't bother checking them (let alone know how to check them)
http://www.codeproject.com/Articles/11643/Exploiting-MD5-col...
Their home page looks like what i'd expect an app store's home page to look like, full of apps. There's not even any ads on the home page!
And besides, i don't care what it looks like "at first glance". if you are going to call out someone's website as "malware" then you'd better do your damn homework first.