Feeds

Google malware watchdogs bite mom-and-pop shops

But not MySpace

SANS - Survey on application security programs

One morning last week, Alan Jay, director of Digital Spy, woke up to discover that Google was warning millions of web surfers that his UK-based entertainment news site was one "that may harm your computer."

Those brave enough to click on the Google link anyway were invited to learn more about malware by visiting a page at StopBadware.org that said Digital Spy "has been determined by Google's testing to be a site that hosts or distributes badware." Users who still wanted to access the site had no choice but to cut-and-paste its url into their browser address bar.

Image of Google page showing warning for Befuddled.co.uk. It reads in part: "Warning - visiting this web site may harm your computer!"

Google issues thousands of "harmful web site" warnings, often without notifying site operators.

Jay managed to get the warning removed five days later after tracing the problem to tainted banner ads that were served by one of the four advertising networks used by Digital Spy. Throughout the entire time, Jay says, Google and StopBadware refused to identify the source of the badware.

"We've been completely left in the dark, and we're in a situation where people think we have done something wrong," he says. "So Google’s policy here seems to be to punish an innocent site but not provide information to allow an advertising network to find out what the advert is that is causing the problem and stop it delivering elsewhere in the network."

Banner badware

Jay's experience comes as cyber crooks increasingly look to legitimate third-party ad networks as a vehicle for distributing software that silently installs Trojans and other forms of malware while an end user surfs presumably safe sites.

Last week, it was revealed that a company owned by Yahoo dished out an estimated 12 million ads on sites such as MySpace and PhotoBucket that installed a back door on unpatched Windows machines. Several days later, Roger Thompson of Exploit Prevention Labs said in a blog post that a banner ad infected a test machine while it surfed FaceBook. Malware-laced ads date back at least 14 months, when banners running on MySpace infected more than 1 million users with adware.

"How come they pick on me, for example, but they don't pick on ... one of the really big sites?" Jay asked. "They don't appear to have penalized any of the sites that were subject to this last week."

Few law-abiding denizens of the net have a problem with Google using its considerable computing heft to sniff out malicious sites and warn its users to stay away. Regrettably, such initiative is sorely lacking at Yahoo and Microsoft's Live.com. But the experience of Jay and others like him expose some of the pitfalls of a system that frequently doesn't inform webmasters of its findings, fails to provide enough information for them to identify the source, and, in the minds of many operators of smaller sites, gives large websites an unlimited number of get-out-of-jail-free cards.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.