Feeds

Miscreants subvert search results to punt malware

Using botnets to plant links and nurture zombie farms

5 things you didn’t know about cloud backup

Miscreants have set out to poison search results with links to malware infested sites via a new campaign.

Users searching Google or other prominent search engines for sites referring to innocuous terms ranging from "alternative router firmware" to "cotton gin and slavery" are often confronted with a list of results where at least some point to malware.

Comment spam attacks, which involve posting links to dodgy sites on blogs, have been taking place for at least three years. Search engines such as Google give priority to sites linked to from popular web destinations. Spammers and their hacking accomplices try to take advantage of this behaviour in order to illicitly gain higher places in search page rankings.

Crackers are now getting into the act in order to punt malware. The malign sites often appear in the top ten lists for a particular search term though rarely (if ever) as a top entry. Miscreants are essentially gaming search engines' ranking systems by automatically posting links to malign sites in blog and forum posts.

It's another example of bots being used to further an attempt to create further opportunities to ensnare the unwary, thereby creating a bigger network of compromised machines.

Anti-spyware firm Sunbelt Software said hackers have also created "tens of thousands of individual pages" that have been meticulously established with the goal of obtaining a high search engine ranking. "Just about any search term you can think of can be found in these pages," reports Sunbelt researcher Adam Thomas.

Sunbelt has unearthed evidence of a network of bots whose sole purpose is to post spam links and relevant keywords into online forms. This network, combined with thousands of pages, have given the attackers very good (if not top) search engine positions for various search terms, the security firm reports.

Surfers who stray onto the malicious sites with vulnerable systems are infected with a strain of malware called Scam-Iwin, using the infamous iFrame IE exploit. The exploit was patched by Microsoft months ago, but many vulnerable systems remain.

Computers infected with Scam-Iwin transmit false clicks to the hacker's URLs without the user's knowledge. These bogus hits generate income for hackers through a pay-per-click affiliate program. Scam-Iwin also attempts to download other items of malware (including Trojans and keystroke loggers) onto compromised PCs, Sunbelt reports.

Sunbelt has posted screenshots of several Google search results featuring links to malware-infecting sites, along with an additional explanation of the attack, here. ®

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?