Google malware watchdogs bite mom-and-pop shops
But not MySpace
Agentless Backup is Not a Myth
One morning last week, Alan Jay, director of Digital Spy, woke up to discover that Google was warning millions of web surfers that his UK-based entertainment news site was one "that may harm your computer."
Those brave enough to click on the Google link anyway were invited to learn more about malware by visiting a page at StopBadware.org that said Digital Spy "has been determined by Google's testing to be a site that hosts or distributes badware." Users who still wanted to access the site had no choice but to cut-and-paste its url into their browser address bar.
Google issues thousands of "harmful web site" warnings, often without notifying site operators.
Jay managed to get the warning removed five days later after tracing the problem to tainted banner ads that were served by one of the four advertising networks used by Digital Spy. Throughout the entire time, Jay says, Google and StopBadware refused to identify the source of the badware.
"We've been completely left in the dark, and we're in a situation where people think we have done something wrong," he says. "So Google’s policy here seems to be to punish an innocent site but not provide information to allow an advertising network to find out what the advert is that is causing the problem and stop it delivering elsewhere in the network."
Banner badware
Jay's experience comes as cyber crooks increasingly look to legitimate third-party ad networks as a vehicle for distributing software that silently installs Trojans and other forms of malware while an end user surfs presumably safe sites.
Last week, it was revealed that a company owned by Yahoo dished out an estimated 12 million ads on sites such as MySpace and PhotoBucket that installed a back door on unpatched Windows machines. Several days later, Roger Thompson of Exploit Prevention Labs said in a blog post that a banner ad infected a test machine while it surfed FaceBook. Malware-laced ads date back at least 14 months, when banners running on MySpace infected more than 1 million users with adware.
"How come they pick on me, for example, but they don't pick on ... one of the really big sites?" Jay asked. "They don't appear to have penalized any of the sites that were subject to this last week."
Few law-abiding denizens of the net have a problem with Google using its considerable computing heft to sniff out malicious sites and warn its users to stay away. Regrettably, such initiative is sorely lacking at Yahoo and Microsoft's Live.com. But the experience of Jay and others like him expose some of the pitfalls of a system that frequently doesn't inform webmasters of its findings, fails to provide enough information for them to identify the source, and, in the minds of many operators of smaller sites, gives large websites an unlimited number of get-out-of-jail-free cards.
Next page: The Internet is Large
COMMENTS
Lowe Alpine
wonder why google thinks a site full of rucksacks is harbouring nasties?
@Anthony: ad-killer
May I suggest searching for the Proxomitron. It's ancient, it's clunky, and it works. 3 out of 3 ain't that bad... :-) Seriously, I hardly ever see ads any more. I'm a parasite. So sue me. Obnoxious ads constitute a crime against humanity and should be punished accordingly. Dixit.
If Google want to play at being god...
I think the point that many of you are missing is that where adverts are the issue that Goolge has the technology to help stop the adverts being served but instead of providing that information so that the adverts can be stoped they tell you the page that they were being served from.
Now anyone who has a site that serves adverts will know this is less that useful. The minimum you need is (1) "where was the advert called from - the country - to deal with geo-targeting of advertsing systems" (2) the time it was called (3) the name of the malware being directed towards (4) the advertsing server / network the file is being loaded off and (5) if possible the name of the advert file that is the problem - at the moment usually a flash swf file.
In fact the final bit of information will often be enough.
I'm pretty certain that when they set their test suite on a site that it records this information and if that is the case they could stop the advert being delivered which is surely their goal.
Hopefully Google's Policy team will realise that they can help the situation more by providing enough information to allow the advert to be stopped than the current policy which is to hide their head in the sand and blame the site that was unfortunate enough to have the advert served on there site.
For those who say the sites should be more careful I would say that the example we say was subtle in the way it worked it didn't attack always and didn't appear to be harmful at all. Even more sophisticated all the celver code was held on a remote server which was interrogated in some hidden code to see if it should deply the badware. This is non trivial (if you don't know what you are looking for) and hard if you do.
It has taught us to be much more circumspect but also highlighted the fact that there is an organisation out there that could really help fight this problem but they choose to sit on their hands while waving them shouting "its there" when in fact it is somewhere else.
The additional problem is that as people see more of these "warnings" against sites they use regularly they will loose their effectiveness. A warning that really means something is worthwhile otherwise users will think that Google is "crying woolf" and start ignorning then and problem is that they also use this same warning for sites that have been compromised by hackers and which are dangereous to all visitors rather than being dangerous to 1 in 250,000.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Agentless Backup is Not a Myth
