Feeds

Microsoft's search excels in spreading malware

Easily beats out Google and Yahoo!

SANS - Survey on application security programs

Everybody knows that Windows Live Search, Microsoft's little search engine that could, lags far behind Google and Yahoo! in the race to capture eyeballs. Here's one place where the software juggernaut's offering leads the pack: referrals for sites that actively try to infect end users' machines with some of the vilest malware known to man.

To see for yourself, type "veicolo commerciale noleggio" into Live.com and watch what gets returned. The first result (at the time of writing, anyway) is for a site at b9n3q3.info/yb6u46p76.html, which uses a Javascript to redirect users to another site. This second site actively tries to install several varieties of malware, in some cases the nasty Trojan known as Rustock. This return is just one of many malicious referrals Live.com makes when entering the above search term, which is Italian for "commercial vehicle rental."

According to researchers at Sunbelt-Software, Live.com's affair with malicious sites runs so torrid that malware-related returns on the search engine number in the thousands. Terms that trigger similar results tend to be Italian phrases, including, to name a few, "adsl offerta toscana," "istituto geografico italiano," "dvd da scaricare" and "testi reggae." Sunbelt blogged here about the sludge fest two weeks ago, but Live.com has continued to spew the noxious results unabated. Google and Yahoo long ago managed to filter most of the same sites from their returns.

"I don't think it was very responsible to keep these malware sites up for so long," says Francesco Benedini, a spyware researcher at Sunbelt. "I'm not saying Google and Yahoo! don't have a problem, but it's much more invasive on Live.com."

A Microsoft representative says in a statement that "to the extent that spammers are successful in essentially manipulating results, they will hurt the user experience on all search engines".

That left us scratching our heads for a couple reasons. For one, the same search terms don't appear to generate malicious returns on Google or Yahoo!, so how can the rep claim this is an industry-wide problem? And for another, what does spam have to do with this? We're wondering if our inquiry got mixed up with someone else's.

Some of the crud being returned on Live.com is sneakier than others. Many returned links, for instance one at www.lassi.com.es, don't attempt to infect PCs using a US-based IP address. Machines with IP addresses from Italy and possibly elsewhere are not so fortunate.

This isn't the first time Microsoft's net properties have dished up unsavory offerings. Last month the company admitted its Windows Live Messenger client displayed banner ads promoting an application blacklisted as a security risk. Shortly after Microsoft made the admission, MSN Groups was caught displaying ads for a separate piece of software widely regarded as rogue. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.