Feeds

Google results flog millions of compromised webpages

Top billing

SANS - Survey on application security programs

Two ongoing scams are tricking Google and other search engines into prominently displaying millions of compromised webpages that attempt to hijack end users' computers or steal their credit card numbers, researchers said.

One of the attacks is being used to direct people searching the web to an online store hawking pirated copies of popular software titles. Plugging the phrase "cheap vista for students" into Google, for instance, returned more than 19 million results, many of which redirected users to a site called soft4pcs.com.

A separate attack is the work of a botnet dubbed ASProx, which injects malicious links into misconfigured ASP webpages. Users who enter a wide array of search queries, such as "used corvette parts", received results pointing to a page that redirected to ads-t.ru, which attempted to serve a hostile Adobe Flash file that installs malware.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, said here that Google was returning more than 3.2 million results that contained the malicious script and Bing showed 188 million. Those numbers were significantly smaller when we tried the same search about 10 hours after the blog item was published.

The attacks highlight the intricate role search engines, websites, domain name registrars, and webhosts play in enabling campaigns that have the potential to scam large numbers of people. Most of the compromised webpages appeared to be hosted by legitimate websites with administrators who simply weren't careful enough. Stanford University, and the official websites for the Webby Awards and 1980s musician Bryan Adams, were just some of those complicit.

But attackers wouldn't bother compromising those pages if Google and other search engines didn't feature them prominently in their results. In a blog post published Thursday, researcher Denis Sinegubko lays out in painstaking detail how the software pirates were able to gin Google's system. If he can figure it out, so should Google and even its much smaller competitors.

"We don't comment on individual sites, but there is nothing particularly new going on here as far as I can tell," a Google spokesman wrote in an email to The Register. "I think it's important to keep in mind that search engines are a reflection of the content and information that is available on the Internet."

He went on to say that Google uses both algorithmic and manual techniques to detect such scams and removes entries when they're detected. But it's not unusual for the bad guys to find new ways to slip malicious pages into Google, he added, making for a never-ending game of cat and mouse.

Members of Microsoft's security team are actively working to remove the malicious links, according to one of them who asked not to be named because he wasn't authorized to speak to reporters. Among the actions taken, the team added ads-t.ru to a list of sites to flag, so results that contain that address should contain a warning as soon as Bing recrawls the pages.

Representatives of Yahoo didn't respond to emails seeking comment. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.