Feeds

Googlewhack trick used to slip junk mail past spam filters

Spammers feel lucky

Internet Security Threat Report 2014

Advanced features in Google's search engine are being used by spammers to disguise the URLs of spamvertised sites. Hackers have been using Google search functions to hunt for vulnerabilities. Now their peers in the junk mail business are getting into the act, Symantec reports.

Google supports a variety of advanced query words that are capable of narrowing the scope of a search. Spammers have latched onto this functionality as a means to direct an end user to a URL advertising their products or services, without directly pointing at a site. The approach, as with so many in the field of spamming, is designed to bypass junk mail filters.

Symantec came across the technique after coming across spam emails containing a URL that, on casual inspection, resembled a "Google search results" link. However, when clicked, the URL directs surfers to a site selling replicas of expensive watches, pens, and jewelry.

The trick worked because a spammer had managed to make a search query that was specific to their website, using an advanced Google search combining the "inurl" and "intext" operators. Next comes the clever part: spammers simulate a user click on Google's seldom-used "I'm Feeling Lucky" button, so that surfers are taken directly to the first result that comes up for the entered search query. As the spammer has designed the query to yield only one result - that of the spamvertised site - surfers are taken directly to a junk-mail-promoted site after selecting what looks like a search result entry.

Having designed the trick, it's straightforward for spammers to pump out emails designed to evade junk mail filters. Fortunately anti-spam firms are able to counter the approach, which represents another skirmish in the ongoing war of the inboxes between those developing junk mails and filters. "As usual, spammers keep changing their techniques to defeat the filters," explains Symantec researcher Jitender Sarda. "But on the other hand, we develop new techniques and technology to counter them." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.