Feeds

Scareware slingers stumped by Google secure search

Scam sites can't game search results

Protecting users from Firesheep and other Sidejacking attacks with SSL

Last month Google made secure search the default option for logged in users – mostly to improve privacy protection. But there is a beneficial side-effect - it is harder for fraudsters to manipulate the search engine rankings of scam sites.

Users signed into Google are now offered the ability to send search queries over secure (https) connections last. Search queries sent while using insecure networks, such as Wi-Fi hotspots, are no longer visible (and easily captured) by other users on the same network.

When secure search is used Google omits from the HTTP referrer header the search terms used to reach websites. This makes it harder for websites to see the Google search terms that directed surfers to their pages. Also it is harder to tune content without using Google's analytics service.

The change in the referrer header makes life much more difficult for black hat SEO operators, who strive to make scareware portals figure prominently in 'newsworthy' search results. These fraudsters commonly use link farms to manipulate search results.

Fraudsters typically set up multiple routes through to scam sites. Surfers who stray onto scareware sites are warned of non-existent security problems to coax them into paying for fake anti-virus software of little or no utility.

Black hats thwarted

The changes introduced by Google when it launched secure search will leave them clueless about which approaches are bringing in prospective marks and which have failed.

David Sancho, a senior threat researcher at Trend Micro, explains that it is very useful for black hat SEO-promoted sites to know which search term they have successfully hijacked, - information that Google's changes denies them.

"When these sites receive visits from search engine visitors, they will have no idea what search sent them there," Sancho writes. "They won’t have a clear idea which search terms work and which don’t, so they are essentially in the dark. This can have a lot of impact on the effectiveness of their poisoning activities. This is, of course, good for Google as their search lists are cleaner but it’s also good for all users because they’ll be less likely to click on bad links from Google."

Regular no-padlock HTTP searches remain unaltered. Search terms are only concealed where secure search is applied, which means surfers are already logged in to Google’s services.

"Given how many people already use Google Mail and Google+, this may not be such a big obstacle – but it still poses one," Sancho explains. "If people keep using regular no-padlock HTTP searches, they will keep disclosing their search terms and keeping things unchanged."

"The more people use HTTPS, the less information we’re giving the bad guys ... one more reason to use secure connections to do your web searching," he concludes.

Google introduced encrypted search last year but changes that came in last month that make it a default option for logged-in users will inevitably mean that it becomes more widely used, rather than the preserve of security-aware users who are unlikely to fall victim to scareware scams in the first place. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.