Advanced features in Google's search engine are being used by spammers to disguise the URLs of spamvertised sites. Hackers have been using Google search functions to hunt for vulnerabilities. Now their peers in the junk mail business are getting into the act, Symantec reports (http://www.symantec.com/enterprise/security_response/weblog/2007/11/googles_advanced_search_operat.html).

Google supports a variety of advanced query words that are capable of narrowing the scope of a search. Spammers have latched onto this functionality as a means to direct an end user to a URL advertising their products or services, without directly pointing at a site. The approach, as with so many in the field of spamming, is designed to bypass junk mail filters.

Symantec came across the technique after coming across spam emails containing a URL that, on casual inspection, resembled a "Google search results" link. However, when clicked, the URL directs surfers to a site selling replicas of expensive watches, pens, and jewelry.

The trick worked because a spammer had managed to make a search query that was specific to their website, using an advanced Google search combining the "inurl" and "intext" operators. Next comes the clever part: spammers simulate a user click on Google's seldom-used "I'm Feeling Lucky" button, so that surfers are taken directly to the first result that comes up for the entered search query. As the spammer has designed the query to yield only one result - that of the spamvertised site - surfers are taken directly to a junk-mail-promoted site after selecting what looks like a search result entry.

Having designed the trick, it's straightforward for spammers to pump out emails designed to evade junk mail filters. Fortunately anti-spam firms are able to counter the approach, which represents another skirmish in the ongoing war of the inboxes between those developing junk mails and filters. "As usual, spammers keep changing their techniques to defeat the filters," explains Symantec researcher Jitender Sarda. "But on the other hand, we develop new techniques and technology to counter them." ®

Related stories

Al Gore climate change site hacked (27 November 2007)
http://www.theregister.co.uk/2007/11/27/climate_change_hack/
Google petrol pumps debut next month (7 November 2007)
http://www.theregister.co.uk/2007/11/07/google_on_the_petrol_pump/
Symantec gobbles up Vontu (6 November 2007)
http://www.theregister.co.uk/2007/11/06/symantec_acquires_vontu/
Virtual! stripper! game! targets! Yahoo! (31 October 2007)
http://www.theregister.co.uk/2007/10/31/captcha-busting_trojan/
New cracks in Google mail (26 September 2007)
http://www.theregister.co.uk/2007/09/26/gmail_backdoor_vulnerability/
Unholy trinity of flaws put Google users at risk (24 September 2007)
http://www.theregister.co.uk/2007/09/24/google_vulns_put_users_at_risk/
Storm Worm linked to spam surge (14 September 2007)
http://www.theregister.co.uk/2007/09/14/storm_worm_analysis/
Fast flux foils botnet takedown (11 July 2007)
http://www.theregister.co.uk/2007/07/11/fast_flux_botnet/
One in 10 web pages laced with malware - Google (11 May 2007)
http://www.theregister.co.uk/2007/05/11/google_malware_map/
Google-based malware search tool surfaces (18 July 2006)
http://www.theregister.co.uk/2006/07/18/malware_search/
Desktop search and malware: friend or foe? (13 October 2005)
http://www.theregister.co.uk/2005/10/13/desktop_search_malware_risk/
Hacking Google for fun and profit (4 April 2005)
http://www.theregister.co.uk/2005/04/04/google_hacking/