![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![IT IT](http://a.fsdn.com/sd/topics/it_64.png)
One in 25 Search Results Risky 69
Ant writes "According to Ars Technica, security researcher Ben Edelman revisited his May 2006 report on the relative risk of search engine results. In the original report, Edelman found that 5 percent of the results provided by search engines were marked as either "red" or "yellow" by SiteAdvisor, indicating that they presented some risk to the user. Now, Edelman says that his new study has shown that only 4.4 percent of such sites are risky, representing a drop of 12 percent since May... ... The study found that not only can regular links found by search engines be dangerous, the sponsored links that appear in prominent positions in the results pages can also be harmful. In fact, in the May study, sponsored links were more than twice as likely to be linked to malware than non-sponsored links (8.5 vs. 3.1 percent)."
Troll (Score:1)
Re: (Score:3, Insightful)
Re: (Score:1)
Re:Troll (Score:5, Insightful)
Because IE 7 runs only on Windows.
Hence, it can be assumed that if you can run IE 7 then perhaps there are security problems involved.
If you run OS X or Linux, you can be assured that chances are those links are fairly safe as far as browser hacks and probability that someone decided to make a hack that affects both Firefox and Linux or Mac combination.
And yes I'm being a bit facetiously, but the grandparent isn't much as a troll but speaking a bit over zealously. Chances IE7 will have more problems than Firefox on any system because of its integration into the OS. Vista handles this a bit better than earlier operating systems, but it still has issues.
Re: (Score:2)
every time I see a windows machine just crawling, it is loaded with spyware in IE
I have seen it way too many times.
in firefox you have extension makers who do things like rewriting amazon links, and a few others, but due to the nature of those they are fairly easy to disable.
not to mention, you can build a site with firefox on linux (which I use) or OSX (what the rest of the office uses) and it is great, then you test it on IE and find out that IE has some idiocy coded in to not be standa
Re: (Score:2)
It has terrible ancestry, but if the sandboxing works there should be fewer problems.
All browsers should be sandboxed: a huge complex program that takes massive amounts of untrusted input from multiple unknown sources, some of it guaranteed to be malicious?
Re: (Score:1)
Attackers are finding that it's easier to attack apps that are used with common file formats (Word doc, Excel spreadsheet, PDF, video, etc.) than to try to compromise the browser. Combine that with new morphing-code toolkits and pretty much anybody who wants to can create stuff that gets past any signature- or behavior-b
Re: (Score:1)
In related news... (Score:5, Funny)
Seen that here too. (Score:5, Funny)
Re: (Score:2, Funny)
Actual study link (Score:5, Informative)
Re: (Score:1, Informative)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2, Interesting)
4.4/5 =
A drop of 12 percent would mean we now have -7 percent of something which isn't possible.
Re: (Score:1, Insightful)
google is the culprit.. (Score:4, Insightful)
Or does google happen like all of these link farms, more advertisements and clicking = more profit for google? or id googles search algorithm to , shall i say, stupid? to distinguish the good guys (sites) from the bad...
Re:google is the culprit.. (Score:4, Interesting)
If anyone has the resources to do something like this on a massive scale it's Google; but I can understand why they don't. To me this is akin to the argument that ISPs should cut off users with obviously infected boxes. Hell, ISPs could block sites using the same method you want Google to employ. Sure it would be helpful to the public at large but dealing with the customer service issues and false positives would be a real headache! Try explaining to Aunt Tillie why she can't get to knitting.com anymore because there is a trojan on her box spamming thousands of people everyday.
Re: (Score:2, Insightful)
No they would'nt. All they would need is a small honeynet to detect this and flag legitimate sites installing spyware. Trust me, they have more than enough resources to do that no problem.
As far as the sueing thing goes. People on search engines have NO legal grounds to sue google, period.
Re:google is the culprit.. (Score:4, Insightful)
Nobody would be helped (especially not the 99% of users that would click anyhow) and Google would spend a lot of money for nothing.
Re: (Score:2)
Re: (Score:1)
"It's not 'malware,' it's 'personalized marketing.'"
Re: (Score:3, Interesting)
If you perform a risky search (My best shot was "vista serial crack") and then click on a shady link...google will send you to this page [google.com] before allowing you to proceed onto your destination.
Re: (Score:1)
Re: (Score:3, Interesting)
You can get the siteadvisor [siteadvisor.com] extension for Firefox. It does exactly that and also notifies you if you browse there through other means.
Re: (Score:1)
Joe sixpack on the other hand would never use anything but IE and google, so one of these two things must change. And google is by far the easiest one of them to keep updated.
Risky to who? (Score:2)
Additional risks aren't mentioned... (Score:2)
On the internet... (Score:2)
Re: (Score:2)
shutting down malware, virus, spam sites . . . . . (Score:2, Insightful)
Re:shutting down malware, virus, spam sites . . . (Score:5, Informative)
My solution is to use a custom hosts file. http://www.mvps.org/winhelp2002/hosts.htm [mvps.org] publishes a nice one. Whenever I click on a lick in a web search list and I immediately get a "link not found" then I can pretty sure I didn't really want to go there in the first place. A lot of advertisements show up as "404's" as well.
"Risk" is bogus (was: Re:shutting down malware... (Score:2)
You shouldn't have to avoid sites entirely because of the kind of so-called "risk" that Edelman refers to.
Just ask, what does this "risk" consist of, exactly? If you read Edelman's articles carefully, or watch his videos, you'll find that the supposed hazards always involve (a) clicking "OK" when a page offers to download or run some software (b) using a browser with ActiveX, VBScript, Java or other random-code-execution turned on or (c) some combination - plus using a root account.
If your software is
The risk is not bogus (Score:3, Informative)
In any event, the piece at issue in the original post considers many kinds of risks -- not just exploits, but also run-of-the-mill scams, like "free" ringtones that aren't. You may not regard such sites as "risky" or harmful, but there are plenty of others who do, because they don't like the prospect of being ripped off.
Re: (Score:2)
* User installs some software and it turns out to be trojaned, or different than it purported to be in some way that's undesirable to the user.
* Exploits that rely on user having ActiveX enabled (with or without confirmation, warnings etc.)
* Exploits that rely on unpatched defects in other (non-browser) applications such as Windows Media Player initiating network connections.
* Z
SiteAdvisor = form spammer (Score:2, Interesting)
Re: (Score:1)
Hmmm... (Score:2)
1 in 25... (Score:1)
Re: (Score:1)
Trust (Score:2, Insightful)
Well, if this search engine places this site in this special spot, it must mean that this site is trustworthy.
They payed to be in that spot ?
Well, if they're able to pay for that spot, they must be trustworthy.
What do you mean where did they get the money to pay for that spot ?
How should I know ?
SiteAdvisor and Google (Score:1)
So, perhaps the question others have asked should be re-stated as "Why don't Google offer a site advisory service as part of their engine?" Perhaps because third-parties do so already? Google is, after all, primarily a search engine, albeit a distorted one due to proliferating sponsored links. OK,
elementary science education for all? (Score:5, Insightful)
Sorry, but I am detecting crap. The process of measuring something in real life has inheret errors built into it. I doubt Dr. Edelman can measure the fraction of dangerous search results so accurately so that decimal digits have any meaning. Given that his methodology is to perform particular searches, for example, it's not obvious that his search pattern exactly represents that of a typical user, that his definition of a dangerous site is accurate, or how big are the fluctuations in search result placement in the search engines. Actually, I doubt you can even define the parameter he's measuring accurately enough for the difference between 4.4% and 5% to make sense. Very telling is that at not point does the study [siteadvisor.com] bother to address the error bars of the methodology. This indicates that no-one has any idea what the results actually mean, and that we should treat them with grave suspicion.
Specifically, the implicit claim in the article that the difference between 4.4% and 5% is statistically significant [wikipedia.org] is bougs. The real byline is "fraction of dangerous websites remains unchanged". The two numbers are clearly equal within any reasonable error of measurement. Note that Dr. Edelman's study does not actually make this comparison.
Re: (Score:3, Insightful)
Riskiness of my searches (Score:1)
Re: (Score:2)
Re: (Score:2)
Uh oh (Score:2, Funny)
Um (Score:1)
hmmm....little math problem there (Score:1)
Wikipedia: bad shopping experience (Score:2)
You get what you asked for (Score:3)
(1) That means that many of the sites you find by typing "sex", "porn" or "Brittney Spears" are dangerous. "Thank you!"
(2) I would appreaciate a study that will show me how dangerous are the searches that are useful to me, that is searches not for the popular keywords, but, in opposite, on words and phrases that represent some notions, phenomena, concepts that I do not know.
(3) How the presented statistics differ by the category? For example, I would like to see separate results for searches categorized under "Entertainment" and "Science".