Feeds

Google results flog millions of compromised webpages

Top billing

The Essential Guide to IT Transformation

Two ongoing scams are tricking Google and other search engines into prominently displaying millions of compromised webpages that attempt to hijack end users' computers or steal their credit card numbers, researchers said.

One of the attacks is being used to direct people searching the web to an online store hawking pirated copies of popular software titles. Plugging the phrase "cheap vista for students" into Google, for instance, returned more than 19 million results, many of which redirected users to a site called soft4pcs.com.

A separate attack is the work of a botnet dubbed ASProx, which injects malicious links into misconfigured ASP webpages. Users who enter a wide array of search queries, such as "used corvette parts", received results pointing to a page that redirected to ads-t.ru, which attempted to serve a hostile Adobe Flash file that installs malware.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, said here that Google was returning more than 3.2 million results that contained the malicious script and Bing showed 188 million. Those numbers were significantly smaller when we tried the same search about 10 hours after the blog item was published.

The attacks highlight the intricate role search engines, websites, domain name registrars, and webhosts play in enabling campaigns that have the potential to scam large numbers of people. Most of the compromised webpages appeared to be hosted by legitimate websites with administrators who simply weren't careful enough. Stanford University, and the official websites for the Webby Awards and 1980s musician Bryan Adams, were just some of those complicit.

But attackers wouldn't bother compromising those pages if Google and other search engines didn't feature them prominently in their results. In a blog post published Thursday, researcher Denis Sinegubko lays out in painstaking detail how the software pirates were able to gin Google's system. If he can figure it out, so should Google and even its much smaller competitors.

"We don't comment on individual sites, but there is nothing particularly new going on here as far as I can tell," a Google spokesman wrote in an email to The Register. "I think it's important to keep in mind that search engines are a reflection of the content and information that is available on the Internet."

He went on to say that Google uses both algorithmic and manual techniques to detect such scams and removes entries when they're detected. But it's not unusual for the bad guys to find new ways to slip malicious pages into Google, he added, making for a never-ending game of cat and mouse.

Members of Microsoft's security team are actively working to remove the malicious links, according to one of them who asked not to be named because he wasn't authorized to speak to reporters. Among the actions taken, the team added ads-t.ru to a list of sites to flag, so results that contain that address should contain a warning as soon as Bing recrawls the pages.

Representatives of Yahoo didn't respond to emails seeking comment. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.