Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Google Purges Thousands of Malware Sites

Posted by kdawson on Thu Nov 29, 2007 08:33 AM
from the just-in-time-for-holiday-shoppers dept.
Security Businesses Google The Internet
Stony Stevenson sends in word on the most massive "SEO poisoning" seen to date. The attack was directed at Google in particular and resulted in tens of thousands of Web pages hosting exploits showing up on the first page of Google searches for thousands of common terms (PDF). Sunbelt Software blogged about the attack on Monday after investigating it for months. By Wednesday Google had removed tens of thousands of malware-hosting pages from its index.
+ -
story

Related Stories

Submission: Google purges thousands of suspected malware sites by Stony Stevenson (954022)
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Google Purges Thousands of Malware Sites 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • BBC News piece (Score:5, Insightful)

    by MLCT (1148749) on Thursday November 29 2007, @08:35AM (#21517019)
    http://news.bbc.co.uk/1/hi/technology/7118452.stm [bbc.co.uk]

    The sites were targeting IE exploits.

    • Re:BBC News piece (Score:5, Informative)

      by TubeSteak (669689) on Thursday November 29 2007, @08:48AM (#21517137) Journal
      FTF Summary:

      Sunbelt Software blogged about the attack on Monday after investigating it for months.
      From Your BBC:

      "This was fairly epic," said Alex Eckelberry, head of Sunbelt Software - one of the firms that uncovered the attack.

      Mr Eckelberry said tens of thousands of domains, many based in China and only a couple of days old, were used in the vanguard of the attack.
      ...
      The booby-trapped websites were thought to be in operation for about 24 hours before Google began stripping them out of its search index.
      So which was it?
      Months of Google poisoning or just day(s)?

      • Re:BBC News piece (Score:5, Insightful)

        by Mike89 (1006497) on Thursday November 29 2007, @09:14AM (#21517391)
        They could've 'poisoned' Google for months (linked to domains that didn't exist yet), then set the domains up and waited a few days for Google to recrawl. Then again, I'd have thought pagerank would be age-based too. Those search requests are the kind that show up weird dodgy sites anyway (who searches any of those exact terms anyway?!)

      • Re:BBC News piece (Score:5, Informative)

        by Alexeck (864216) on Thursday November 29 2007, @10:05AM (#21518029)
        So which was it? Months of Google poisoning or just day(s)? It wasn't "months". I think that confusion came from a subsequent blog post we made where we talked about having tracked _comment spam_ bots for months. This attack was only a matter of days. A number of the domains involved, for example, were registered on the 24th or 25th of November. Alex Eckelberry Sunbelt
      • While I agree with the general point you were trying to make (that the victim shouldn't be blamed), I don't see any indications that the GP was in fact do so. He appears giving a purely factual statement about the software that is vulnerable to the attack, which I would have said is fairly basic information in a security/malware story. Arguably it's more surprising that the article summary didn't mention what was targeted...

        -Chris

      • Re: (Score:3, Insightful)

        by oliverthered (187439)
        If I buy crap poor quality tools/cars/housing etc... I expect to injure myself, why should there be any difference with operating systems.

        • Re:BBC News piece (Score:5, Insightful)

          by darthflo (1095225) on Thursday November 29 2007, @09:33AM (#21517597)
          Most users of Windows and IE don't make a conscious decision to do so. It comes preloaded with a computer they buy, they don't question it. Blaming those users for using "poor quality software" (I, for one, find Windows XP a rather pleasant os to work with; IE on the other hand...) would be like blaming any driver for using "poor quality airbags" that came with his car or "poor quality doors" that came with his house after a break-in.
          Not everybody is interested in knowing details about every single one of his possessions. You, me and the rest of the /. crowd cares about computers, but a majority of people (wild guess) probably cares as much about their inner workings as I care about the inner workings of my dishwasher. It's a tool ideally fulfilling one or more given tasks (e.g. "get stock quotes" or "clean my dirty dishes") and is to be professionally serviced upon failure to do so. Installing a more secure browser like Opera may be just as good an idea as adding multi-stage UltraSplash 3D cleaning rotors but as long as I can put dirty dishes in and get 'em out clean I wouldn't know why I should care.
          • Would be like blaming any driver for using "poor quality airbags" that came with his car or "poor quality
            doors" that came with his house after a break-in.

            Exactly, if I'm going to live in an area with a Highish level of crime I'm sure as hell going to make sure that my house has high security doors and windows, the 'idiots' who didn't will obviously get broken into when I don't and yes they could have prevented it so it's partly their fault, just like the police telling you not to leave laptops in the boot o
        • I use Linux. Its like walking in to someone's house and it promptly collapses on top of me.
          The idiots who use Windows affect me indirectly which is really annoying since their computers are sending me spam and brute forcing my servers.

          • Re:BBC News piece (Score:5, Informative)

            by jrp2 (458093) on Thursday November 29 2007, @10:36AM (#21518435) Homepage
            "The idiots who use Windows affect me indirectly which is really annoying since their computers are sending me spam and brute forcing my servers."

            The most common brute-force attack I see on my IPS are ssh brute-force attacks coming from *nix servers that have been compromised. From what I understand, those ssh brute force attacks are highly effective.

            I am no fan of Windows either, but I think that might be a stretch to blame Windows for the bulk of brute-force attacks.

            Spam, absolutely.
            • Most brute forces I see are just random guesses at default accounts.
              Its more expensive than a normal brute force so I assume its Windows boxes.

            • From what I understand, those ssh brute force attacks are highly effective.


              Maybe because the administrators of so many servers are morons. They either set stupid passwords for root, or allow their users to pick easy passwords.

              Disabling plain-text auth is also a very good idea. Disabling direct root login via ssh, even better.
        • If I misuse or use inappropriately tools/cars/housing etc... I expect to injure myself...

          Fixed it for you. The actual brand of tools/cars/housing should be irrelevant. Are you saying there is no way you could injure yourself by using "quality" tools, even by using them incorrectly? If so that is preposterous.
      • No sense in blaming victims, I agree.

        There's sometimes sense in telling people: "By doing X you can decrease the chance that you'll be a victim" though.
  • Sounds good, I'm glad someone is actively trying to make the internet a safer place for people in general, as well as cleaning up search pages for people who can spot malware sites from the search engine. This is also good for Google, thanks to their fantastic business model: "the more people who use the internet on a regular basis, the more money we make".

    • Re:Sounds Good To Me (Score:5, Informative)

      by Andrew Nagy (985144) on Thursday November 29 2007, @09:51AM (#21517841) Homepage Journal
      I'm probably too late on this discussion, but I thought something needed to be said. I work in online marketing (no, that doesn't mean I am a spammer) and I think this speaks volumes about what Google is hard-pressed to admit. The system can still be gamed. And it seems to me that no matter what Google does to improve their algorithm, the system will still be vulnerable to gaming.

      In part, I think this has to do with the oddness that is their ranking strategy. They want to find the most relevant sites for any given query. So they study online behavior and adjust their algorithm to reflect that behavior. At the same time, they publish "guidelines" on how webmasters should design their sites and link out/in. It seems like they're trying to influence how websites behave online and then say that they're picking up on the organic trends. But in the end, they generate the trends. And then they tell everyone how to do it. Because of this, the system will always be vulnerable.

      Until, that is, PigeonRank(TM) [google.com] is launched.
    • This just makes me wonder where the news item was when Google indexed all these sites in the first place.
    • Seeing as Google has been warn of poisoning before and refuses action, or that Google was long warned about proxy hacking and refused action, I'm not about to pat them on their back for not actually fixing their stuff and instead just trying trying to clean up the major incidents after a couple of days. If Microsoft acted like that, people would go into hysterics, let alone patting them on the back. And this comes from someone who loves Google and hates Microsoft.

  • all your base (Score:3, Interesting)

    by Kranfer (620510) on Thursday November 29 2007, @08:40AM (#21517061) Homepage Journal
    Yay! No more Malware, I always hated gettng horrible search results that hosted these things. I am glad that Google said to them, "All your base are belong to us" or maybe, "Resistance is Futile" is more along the lines I am looking for. When will their crawlers automatically disqualify ALL sites that contain malware though? That would be nifty.

    • Re:all your base (Score:5, Interesting)

      by sm62704 (957197) on Thursday November 29 2007, @08:56AM (#21517223) Journal
      When will their crawlers automatically disqualify ALL sites that contain malware though? That would be nifty.

      I don't think it would be possible. I linked to a turing test program I wrote called "art.exe" from my Artificial Insanity [mcgrew.info] page that I hosted on another site I owned (which I since have let lapse). The only way a crawler would know that this program was benign was because it isn't listed in any of the antivirus lists of viral signatures.

      What would be nice is if Google would have its crawlers automatically check pages as they crawled. If there were any known malwars the page would be blacklsted. But there's no way I can think of to flag malware that hasn't been identified as such by humans.

      -mcgrew

      PS:)downside would be that you couldn't find microsoft.com (Foghorn Leghorn says...)
      PPS: I've been mulling over rewriting the Artificial Insanity program in javascript. But I'm having a hard time finding the time.
      • So google decides that one of its competitors is malware and purges all existence of them...

        I'm thinking an independent body would be better deciding what is and what is not malware.

        • Re:all your base (Score:5, Insightful)

          by darthflo (1095225) on Thursday November 29 2007, @09:58AM (#21517931)
          Nothing (except antitrust law, maybe) stops Google from "forgetting to include" live.com in it's indexes now and this situation is quite unlikely to change in the near future. The only two reasons I think of as relevant to leave competitors in are the outrage from both the internet community and the "forgotten" competitor (perhaps culminating in lawsuits for anti-competitive behaviour, IANAL) and the desire for the own index to be perceived as fair and complete.

          An independent body deciding about the malness of any ware is, if a certain responsiveness could be guaranteed, a creepy idea. Forming such a commitee would very surely be a huge leap in the direction of an often-mentioned TCPA (Palladium, NGSCB, Donkey poop)-secured blacklist society. A small aristocraty of people in this decision commitee would become the target of a trillion-dollar industry and be able to decide exactly what piece of software is ran by anybody. On the other hand, allowing anybody to participate in these votes would guarantee this operation not to be effective because of the huge delay this would cause. The same goes for adding legal ways to fight a decision by this body - having one would cause the system to become as slow as many legal systems throughout the world are today, not having one would be a surefire way to cause dissatisfaction with lots and lots of developers (both natural and legal persons).
          Also, don't forget to take into account the current legal trouble e.g. encryption software is going through. I'm certain an independent body would decide similar to lawmakers throughout the world. Essentially, you could probably forget about running Linux (Open Source? That could run anything, including highly illegal tools like decss without any way to stop it), any cd/dvd copying software (It's fun to break the D-M-C-A (sung to the tune of YMCA)), nmap (Remember germany banning "Hacker tools"?) or anything else.

          Sorry for painting such a dystopian future, but letting any (independent, governmental or profit-oriented) body whatsoever decide what software's good and what's bad just isn't what you, me or most anybody else wants.

          • Re:all your base (Score:4, Interesting)

            by Nossie (753694) <IanHarvie&4Development,Net> on Thursday November 29 2007, @10:15AM (#21518169)
            I do agree... and maybe an independent body would just become corrupt like the rest of them BUT.

            In googles interest, they are a search engine and not a publisher and for that reason are not subject to the indexes of child porn and other illegal activity. Once google start going down the road of blocking spam and other malicious sites it could be suggested they lose the right of being an automatic aggregation engine.

            All the The pirate bay does is index pointer links, all google does is index pointer links -- one of them has a safe harbour in the US and the other does not. How long before Google itself loses its 'safe harbour' ?
        • Well, google does provide the blacklisted phishing sites for Firefox, but no one seems to be complaining...

      • Re: (Score:3, Interesting)

        by halcyon1234 (834388)
        Easy enough. Google has access to a massive amount of IP addresses and computer resources. All they need to do is set up a whole bunch of virtual machines that have no protection on them at all. Those virtual machines can start visiting indexed pages (using a rotating set of IP addresses so the target website doesn't know they're being "tested"). If a machine gets infected, it will be very easy to spot. Something will have installed on that machine. A rootkit or a adware install is fairly obvious, eve

    • Re: (Score:2, Interesting)

      by Mathinker (909784)
      > When will their crawlers automatically disqualify ALL sites that contain malware though?

      Not possible; even disregarding the problem that other posters have raised, that the automatic recognition of novel malware is more or less impossible, most of the black hats setting up these sites have started to get really sophisticated and the servers can return different web pages based on IP addresses, and often never serve up exploits more than once to any given IP address.

      Like everything in the security game,

  • They've also changed their PageRank for many sites (Score:5, Interesting)

    by garcia (6573) on Thursday November 29 2007, @08:40AM (#21517063) Homepage
    Recently (end of October) Google reordered some of their sites and dropped the PageRank on many (mine included) there was a blog post about it here [dailyblogtips.com]. My PageRank suffered immensely dropping from an overall high of 6/10 to the now 3/10. The most noticeable difference for me was that for the next two weeks (and the first time ever) I was no longer the #1 hit for: Bill Roehl, "Bill Roehl", or any variation thereof. Not only that but the first result from Google wasn't even for my root page, it was for some post I had underneath. I found that to be very odd.

    Now, while I was digging through the Google results to find out why this could have possibly happened (prior to reading the blog post linked above) I found tons of SEO spam sites that my site had been linked from. I had never seen that many junk results returned before and was surprised they were getting through. I was seriously concerned that they had something to do w/my ranking drop.

    At least Google is getting back on track dumping those bastards. While most people probably don't change their default settings to see anything more than the first 10 results, I am constantly looking through the first 100 on various searches and have seen more and more of that. I was wondering if some of the claims of Google's drop from #1 would imminent if something didn't change.

    • At least Google is getting back on track dumping those bastards. While most people probably don't change their default settings to see anything more than the first 10 results, I am constantly looking through the first 100 on various searches and have seen more and more of that. I was wondering if some of the claims of Google's drop from #1 would imminent if something didn't change.

      Well, they may be getting back at them, but...

      Ironically, Google itself refused to confirm or deny that it had cleansed its index of the more than 40,000 malware hosting sites, or even that they had existed. "Google takes the security of our users very seriously, especially when it comes to malware," a company spokeswoman said today in an e-mail. "In our search results, we try to warn users of potentially dangerous sites when we know of them. Sites that clearly exploit browser security holes to install software, such as malware, spyware, viruses, adware and Trojan horses, are in violation of the Google quality guidelines and may be removed from Google's index."

      What is Google afraid of? That their stock price will plunge if everyone finds out they were manipulated by malware sites?

    • I was no longer the #1 hit for: Bill Roehl, "Bill Roehl", or any variation thereof.
      Perhaps there is simply someone else who is better at being Bill Roehl than you. Don't fret, though. You can always go back to Bill Roehl School and brush up with some post-graduate Bill Roehl stuff.

      Personally, I'm comfortable with the fact that I'm only the second-best me [google.com] out there. Let that other fella have his glory, because I'm never going back to the Rob Vincent Academy. I'm not going into it here, but those bastards Rob, Rob, and Rob know why.
  • Google had removed tens of thousands of malware - hosting pages from its index.

    Wierd, usually it's tha pages that are hosting malware, rather than the other way around. OW! Stop hitting me!
  • .. do not look like random words from a generator. They look targetted too with all the references to Microsoft software, Cisco, VPN. But then .. "train a dog to fetch" and "go go go go go go go go go go go"? Anyone have any ideas as to why and how they made that list?
    • They seem to be targeting Accountants and DBAs who work from home today and will go back inside the corporate firewall tomorrow. Oh and dog trainers for some reason
    • I remember hearing something about the Windows random number generator...

  • And what's SEO? (Score:3, Informative)

    by allcar (1111567) on Thursday November 29 2007, @08:49AM (#21517151)
    For those of you, like me, who did not immediately recognise this TLA [wikipedia.org], it stands for Search Engine Optimization [wikipedia.org].

  • Censoring (Score:5, Funny)

    by Fredtalk (1105765) * on Thursday November 29 2007, @08:50AM (#21517161)
    Sounds like net censorship to me! What if I wanted to visit those malware sites?

  • A hidden gem (Score:5, Interesting)

    by dotancohen (1015143) on Thursday November 29 2007, @09:01AM (#21517255) Homepage
    The pdf contains a list of 2161 popular Google search terms. This is an SEO wet dream. Thanks!

  • Thousands of terms? (Score:3, Insightful)

    by peipas (809350) on Thursday November 29 2007, @09:05AM (#21517289)
    Is it just me or do the first five pages of "common terms" in the PDF contain the term Excel, and then the next four pages contain the term vpn? It seems to me there were two common terms in these first nine pages with random words tacked on.
  • tech support. Now what're we supposed to do over the holiday season? Boxshift?
  • From the summary: tens of thousands of Web pages hosting exploits showing up on the first page of Google searches for thousands of common terms

    So, how do you tell the difference between this and any normal Google results page?
  • ...if my eyes and brain RTFA correctly. I recognize Google is the big(gest) player, but it's not like the purveyors of fine malware focused exclusively on Google and Google alone. It's in TFA if you're willing to take a look-see.

  • Google still hasn't fixed their open redirector (Score:5, Informative)

    by Animats (122034) on Thursday November 29 2007, @12:57PM (#21520805) Homepage

    After reading this, I immediately checked to see if Google had fixed their open redirector. [google.com] No, they haven't, and there are six exploits of it listed in PhishTank. Google needs to turn that off. If they absolutely insist on having an open redirector, it needs its own subdomain, which is what Yahoo does. Then the subdomain can be blacklisted without collateral damage.

    Phishing via exploits of major sites is a big problem, but involves a small number of major sites. 168 major sites today. [sitetruth.com] The usual exploits are:

    • Phishing site web servers on DSL lines. Some ISPs are good at kicking these off, and some aren't as good. "bellsouth.net" has more entries in PhishTank than any other domain.
    • "Open redirectors", URLs that can be exploited to redirect to another site, like the Google URL above.
    • Web hosting services, especially free ones, sometimes find themselves hosting phishing sites.
    • "Web 2.0" sites which allow uploading of user content but don't check it for exploits. Photobucket is used by some phishers, who upload hostile ".swf" files.
    • Break-ins on legitimate sites, where, typically, some obscure page is hosting hostile content. When an ".edu" site shows up in our list, that's usually what happened.

    Out of 1.6 million domains in DMOZ, and over 10,000 phishes in PhishTank, only 168 domains are in both. So the number of sites that need to be fixed is small. In fact, some of those sites are already fixed, but the entries haven't been removed from PhishTank yet. (Hint: if you kill a hostile page on your domain, make it a 404 error; that gets the page out of PhishTank's "active and online" list automatically. Don't just change the content or redirect it somewhere else, or it stays in the tank until somebody rechecks it manually, which can take weeks.)

    For every site in the list, there's some competitor in the same business who isn't on the list. "Everybody has this problem" isn't a valid excuse any more. This is a useful point to make with management if you find your own company on the list.

    This list of 168 exploited sites is updated automatically every three hours. There's also a list of sites recently removed from PhishTank. "n-insanity.com", "tropmet.res.in", "wsjob.com" were dropped from the list today; they no longer have active, online entries in PhishTank. "gentlesource.com", "t35.com" (an eBay phish), "tilapia.com" (another eBay phish), and "uic.edu" (already fixed) were added; they just appeared in PhishTank. If you have any responsibility for a site on the list, please take steps to fix the problem. If you're not part of the solution, you're part of the problem.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.