Feeds

Google results flog millions of compromised webpages

Top billing

5 things you didn’t know about cloud backup

Two ongoing scams are tricking Google and other search engines into prominently displaying millions of compromised webpages that attempt to hijack end users' computers or steal their credit card numbers, researchers said.

One of the attacks is being used to direct people searching the web to an online store hawking pirated copies of popular software titles. Plugging the phrase "cheap vista for students" into Google, for instance, returned more than 19 million results, many of which redirected users to a site called soft4pcs.com.

A separate attack is the work of a botnet dubbed ASProx, which injects malicious links into misconfigured ASP webpages. Users who enter a wide array of search queries, such as "used corvette parts", received results pointing to a page that redirected to ads-t.ru, which attempted to serve a hostile Adobe Flash file that installs malware.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, said here that Google was returning more than 3.2 million results that contained the malicious script and Bing showed 188 million. Those numbers were significantly smaller when we tried the same search about 10 hours after the blog item was published.

The attacks highlight the intricate role search engines, websites, domain name registrars, and webhosts play in enabling campaigns that have the potential to scam large numbers of people. Most of the compromised webpages appeared to be hosted by legitimate websites with administrators who simply weren't careful enough. Stanford University, and the official websites for the Webby Awards and 1980s musician Bryan Adams, were just some of those complicit.

But attackers wouldn't bother compromising those pages if Google and other search engines didn't feature them prominently in their results. In a blog post published Thursday, researcher Denis Sinegubko lays out in painstaking detail how the software pirates were able to gin Google's system. If he can figure it out, so should Google and even its much smaller competitors.

"We don't comment on individual sites, but there is nothing particularly new going on here as far as I can tell," a Google spokesman wrote in an email to The Register. "I think it's important to keep in mind that search engines are a reflection of the content and information that is available on the Internet."

He went on to say that Google uses both algorithmic and manual techniques to detect such scams and removes entries when they're detected. But it's not unusual for the bad guys to find new ways to slip malicious pages into Google, he added, making for a never-ending game of cat and mouse.

Members of Microsoft's security team are actively working to remove the malicious links, according to one of them who asked not to be named because he wasn't authorized to speak to reporters. Among the actions taken, the team added ads-t.ru to a list of sites to flag, so results that contain that address should contain a warning as soon as Bing recrawls the pages.

Representatives of Yahoo didn't respond to emails seeking comment. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.