Original URL: http://www.theregister.co.uk/2011/06/17/google_instants_search_engine_peril/

Google: Our rapid load won't give you anything nasty

You could get exploited without even saying yes

By John Leyden

Posted in Security, 17th June 2011 12:00 GMT

Google has downplayed concerns that refinements to its search technology could leave surfers more exposed to search engine manipulation attacks.

Google Inside Search aims to speed up web searches by pre-loading content from remote sites. The so-called Instant Pages technology only works with Google Chrome.

Miscreants often manipulate search engine results so that links to scareware portals and the like appear prominently in search results for newsworthy terms. These search engine poisoning tactics rely on establishing link farms after hacking into portions of popular websites, using search engines’ “sponsored” links to reference malicious sites and injecting HTML code, among other tricks.

Scareware affiliates normally rely on potential victims to click on links to malicious sites among search results before they are whisked away towards dangerous domains. However, the Instant Pages technology might remove this requirement, pre-fetching content from malicious websites and "creating a possibility that a user can be exploited by simply searching, without even clicking on a link," warns Dan Hubbard of Websense Security Labs.

Google maintains that is being careful to minimise the possibility of harmful content getting pre-fetched.

"We've thought hard about this issue, and we don't believe there is any additional risk to users," a Google spokesman explained.

"Sites marked as potentially harmful by our Safe Browsing technology will not be pre-rendered, nor will sites that Chrome detects as suspicious. We also exclude sites with SSL certificate issues and those that try to download files or display popup alerts."

Google added that search engine poisoning to promote scareware sites and the like is an industry-wide problem. ®