Feeds

Brute force attack yields keys to Google's kingdom

Spammers eye the Holy Grail

Next gen security for virtualised datacentres

This story was updated on 2nd October to add comment from Google.

Miscreants pushing Viagra and malware are making new progress infiltrating Google indexes, a feat that's considered the Holy Grail among spammers.

Google, which by some estimates carries out 60 per cent of the world's searches, goes to great lengths to filter naughty sites from its results. The proliferation of rogue sites that have made an end run around the controls is giving rise to conspiracy theories that Google has been hacked.

"If a smart spammer has really found a way to game the Google search results with spoofed or cloaked sites, and Google still doesn't have a fix, this could be a major issue with the underlying infrastructure of the entire Google operation," according to this post on The Google Watchdog blog. "This is the first time that I've ever been worried that Google's own index has been hacked."

The site notes that specific search terms return large number of domain names ending in .cn. When clicked, they redirect the user to a different address that attempts to install malware. The rogue sites catch the attention of Google search bots by appropriating keywords and other content from legitimate sites. Amazingly enough, the rogue sites manage to secure a higher ranking than the legitimate ones, according to Google Watchdog.

A major hack of the algorithm used to rank and filter sites is intriguing, but it's also unlikely. Despite Google's noble efforts to sanitize results, rogue sites have been slipping through for years, and Google Watchdog provides no data to suggest there is anything new afoot.

According to Roger Thompson, a Exploit Prevention Labs researcher who specializes in finding innocuous search terms that return toxic results, the perpetrators are mainly succeeding through sheer brute force. Spammers register thousands of domain names and create thousands of landing pages for each one and then embed thousands of legitimate sounding keywords in each one. Then they lie in wait. Once a page is entered into the Google index, the miscreants enter code into the page that causes it to redirect to a site that installs malware.

"We've seen a real surge of this thing over the last couple of months," Thompson says. "By putting out just the landing pages, they get up near the top of the search results and potentially get a lot more victims before they get shut down."

Domain names ending in .cn seem to be especially popular these days because they sell for as little as 13 cents apiece, Thompson said.

The Google Watchdog didn't provide examples of search strings that return the rogue sites. But Thompson has been supplying them for months in a series of blog posts titled Dangerous Searches. The phrase "toddler inflatable mattress" returns a fair number rogue sites. One of them at this address (we inserted a ? to prevent people from accidentally clicking on it) attempts to force install software on a user's machine, according to Thompson. Other searches that have worked in the past include "pokemon ruby gamesharks" and "blue book."

A Google engineer says the deluge of .cn sites has required the company explore new techniques for mitigation.

"This spam was a little different than the typical brute force attacks that people have tried before (.be, .info, etc.) and that we were looking at making some infrastructure changes to better tackle any .cn issues we saw," Matt Cutts, the head of Google's Webspam team, wrote in a blog entry. "There are a few changes to be made before I’m completely happy, but one is already done and another change is pending, so we’re in a better position now than (say) last week and I expect us to continue that progress." ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.