Feeds

Google: Our rapid load won't give you anything nasty

You could get exploited without even saying yes

Internet Security Threat Report 2014

Google has downplayed concerns that refinements to its search technology could leave surfers more exposed to search engine manipulation attacks.

Google Inside Search aims to speed up web searches by pre-loading content from remote sites. The so-called Instant Pages technology only works with Google Chrome.

Miscreants often manipulate search engine results so that links to scareware portals and the like appear prominently in search results for newsworthy terms. These search engine poisoning tactics rely on establishing link farms after hacking into portions of popular websites, using search engines’ “sponsored” links to reference malicious sites and injecting HTML code, among other tricks.

Scareware affiliates normally rely on potential victims to click on links to malicious sites among search results before they are whisked away towards dangerous domains. However, the Instant Pages technology might remove this requirement, pre-fetching content from malicious websites and "creating a possibility that a user can be exploited by simply searching, without even clicking on a link," warns Dan Hubbard of Websense Security Labs.

Google maintains that is being careful to minimise the possibility of harmful content getting pre-fetched.

"We've thought hard about this issue, and we don't believe there is any additional risk to users," a Google spokesman explained.

"Sites marked as potentially harmful by our Safe Browsing technology will not be pre-rendered, nor will sites that Chrome detects as suspicious. We also exclude sites with SSL certificate issues and those that try to download files or display popup alerts."

Google added that search engine poisoning to promote scareware sites and the like is an industry-wide problem. ®

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.