Hackers Are Using SEO To Rank Malicious PDFs On Search Engines, Research Finds 13
An anonymous reader quotes a report from VentureBeat: Today, researchers at security service edge provider, Netskope, published the Netskope Cloud and Threat Report: Global Cloud and Malware Trends, which found that phishing downloads rose 450% over the past 12 months, and highlighted that attackers are using search engine optimization (SEO) to rank malicious PDF files on search engines. The report's findings show that phishing attempts are constantly evolving, and attackers aren't just targeting employees through their email inboxes; they're also using popular search engines like Google and Bing. The increase in phishing attacks and the growing popularity of SEO techniques among cybercriminals highlights the need for enterprises to provide their employees with security awareness training so they're prepared to spot threats and not at risk of handing over sensitive information.
When it comes to defending against these SEO-driven attacks, [Ray Canzanese, director of Netskope's Threat Labs] highlights several methods that security teams can use to protect employees. One of the most effective is to use a solution that can decrypt and scan web traffic for malicious content. At the same time, security teams should encourage users to inspect all links they click on, and to exercise caution if the link takes them to an unfamiliar website. In the event an employee does click on a malicious PDF, they can expect to see a fake captcha at the top of the first page, followed by text on other pages. In these scenarios, users should close the file, delete it from the device and report it to the security team ASAP. Canzanese also notes that it's important for users to report malicious URLs that feature on popular search engines to help the provider unlist them from the site and prevent other users from falling victim to a scam.
When it comes to defending against these SEO-driven attacks, [Ray Canzanese, director of Netskope's Threat Labs] highlights several methods that security teams can use to protect employees. One of the most effective is to use a solution that can decrypt and scan web traffic for malicious content. At the same time, security teams should encourage users to inspect all links they click on, and to exercise caution if the link takes them to an unfamiliar website. In the event an employee does click on a malicious PDF, they can expect to see a fake captcha at the top of the first page, followed by text on other pages. In these scenarios, users should close the file, delete it from the device and report it to the security team ASAP. Canzanese also notes that it's important for users to report malicious URLs that feature on popular search engines to help the provider unlist them from the site and prevent other users from falling victim to a scam.
Web browsers as document viewers (Score:2, Insightful)
I remember the days of the IE argument, let us set a blank home page. The engineers' response was, why would you open a program that operates as a document viewer, without a document to view?
Finally they gave in, and "about:blank" was born.
MS Edge, last I read, does not respond to ESC as a command to stop loading a page. I don't want whatever homepage someone has set up, I don't want to wait for it to load, for you to parse it, for you to download the images, and especially not the scripts.
At one point, I
Re: (Score:3, Interesting)
[...] It's probably easier to render it to an image and do OCR rather than try to extract text. And it's downhill from there [...]
In order to fight SEO I once suggested this method: render the page, screenshot the entire thing, OCR it, compare the resulting text with the text from a "Save as text" or a "grab as googlebot" of the original page. The more different they are, the more you downrank the page.
Re: (Score:2)
That's actually a killer idea for a search engine.
Re:Web browsers as document viewers (Score:4, Insightful)
There are engineers and "engineers". The fake variant is unfortunately the prevalent one in the software space. A real engineer understands security, reliability and unintended consequences. The fake version does not.
As to PDF-viewers, it was pretty clear way back that eventually most documents need to be regarded as hostile. But the fake engineers never prepared for that because they simply did not see it. They instead added features, made things more interoperable and generally opened us up to attacks of all kinds. And that is the reason for the current mess we have.
Really? who wants this? (Score:4, Insightful)
We used to have automatic immunity to this (Score:4, Interesting)
They lost 99% of users... (Score:3)
Leave external docs external (Score:2)
Why is PDF so special? (Score:2)
At this point, HTML is a more complex language than PDF. What if malicious actors start using SEO to promote malicious or phishing HTML files? What to do then?
Anyway, little can be done except IT departments making sure that installed software opening both PDF and HTML has no known vulnerabilities, and employees being educated to not type their passwords in places which have no business asking for passwords. And NOT to "close PDF files where the first page contains fake captcha, and next pages contain text"
Re: (Score:2)
Neuter the PDFs? (Score:2)