Feeds

Brute force attack yields keys to Google's kingdom

Spammers eye the Holy Grail

SANS - Survey on application security programs

This story was updated on 2nd October to add comment from Google.

Miscreants pushing Viagra and malware are making new progress infiltrating Google indexes, a feat that's considered the Holy Grail among spammers.

Google, which by some estimates carries out 60 per cent of the world's searches, goes to great lengths to filter naughty sites from its results. The proliferation of rogue sites that have made an end run around the controls is giving rise to conspiracy theories that Google has been hacked.

"If a smart spammer has really found a way to game the Google search results with spoofed or cloaked sites, and Google still doesn't have a fix, this could be a major issue with the underlying infrastructure of the entire Google operation," according to this post on The Google Watchdog blog. "This is the first time that I've ever been worried that Google's own index has been hacked."

The site notes that specific search terms return large number of domain names ending in .cn. When clicked, they redirect the user to a different address that attempts to install malware. The rogue sites catch the attention of Google search bots by appropriating keywords and other content from legitimate sites. Amazingly enough, the rogue sites manage to secure a higher ranking than the legitimate ones, according to Google Watchdog.

A major hack of the algorithm used to rank and filter sites is intriguing, but it's also unlikely. Despite Google's noble efforts to sanitize results, rogue sites have been slipping through for years, and Google Watchdog provides no data to suggest there is anything new afoot.

According to Roger Thompson, a Exploit Prevention Labs researcher who specializes in finding innocuous search terms that return toxic results, the perpetrators are mainly succeeding through sheer brute force. Spammers register thousands of domain names and create thousands of landing pages for each one and then embed thousands of legitimate sounding keywords in each one. Then they lie in wait. Once a page is entered into the Google index, the miscreants enter code into the page that causes it to redirect to a site that installs malware.

"We've seen a real surge of this thing over the last couple of months," Thompson says. "By putting out just the landing pages, they get up near the top of the search results and potentially get a lot more victims before they get shut down."

Domain names ending in .cn seem to be especially popular these days because they sell for as little as 13 cents apiece, Thompson said.

The Google Watchdog didn't provide examples of search strings that return the rogue sites. But Thompson has been supplying them for months in a series of blog posts titled Dangerous Searches. The phrase "toddler inflatable mattress" returns a fair number rogue sites. One of them at this address (we inserted a ? to prevent people from accidentally clicking on it) attempts to force install software on a user's machine, according to Thompson. Other searches that have worked in the past include "pokemon ruby gamesharks" and "blue book."

A Google engineer says the deluge of .cn sites has required the company explore new techniques for mitigation.

"This spam was a little different than the typical brute force attacks that people have tried before (.be, .info, etc.) and that we were looking at making some infrastructure changes to better tackle any .cn issues we saw," Matt Cutts, the head of Google's Webspam team, wrote in a blog entry. "There are a few changes to be made before I’m completely happy, but one is already done and another change is pending, so we’re in a better position now than (say) last week and I expect us to continue that progress." ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.