Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Google's Research on Malware Distribution

Soulskill posted more than 6 years ago | from the making-a-mountain-out-of-a-really-big-piece-of-rock dept.

Security 83

GSGKT writes "Google's Anti-Malware Team has made available some of their research data on malware distribution mechanisms while the research paper[PDF] is under peer review. Among their conclusions are that the majority of malware distribution sites are hosted in China, and that 1.3% of Google searches return at least one link to a malicious site. The lead author, Niels Provos, wrote, 'It has been over a year and a half since we started to identify web pages that infect vulnerable hosts via drive-by downloads, i.e. web pages that attempt to exploit their visitors by installing and running malware automatically. During that time we have investigated billions of URLs and found more than three million unique URLs on over 180,000 web sites automatically installing malware. During the course of our research, we have investigated not only the prevalence of drive-by downloads but also how users are being exposed to malware and how it is being distributed.'"

cancel ×

83 comments

Sorry! There are no comments related to the filter you selected.

Fristy prosty (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#22457138)

I claimed it, wicked.

Use the Preview Button! Check those URLs!

Customize Posting Preferences

Thank you for an threadjack this easy. (1)

Corwn of Amber (802933) | more than 6 years ago | (#22461878)

If I gathered this right, then Google can parse the content behind the links they serve, to the point of ientifying the drive-bys? Okay, so why not block them at that point? And why not throw enough CPU power to parse the results before they're returned, so as to protect the users? Yeah, tag this "whatcouldpossiblygowrong".

What, then, about a browser that can identify a drive-by, by pre-parsing the content behind the links it shows. Heuristics would do that Real Well, too; I can think of a zillion methods to do Just That off the top of my head. "If it ends up writing to disk, don't." How hard is THAT?
"Yes but it uses vulnerabilities..." Yes, and? Run the browser in a VM, then, and meta-parse if it ever tries to write to a part of the disk that it should not access.
"That would be slow..." Well, seeing how many people use Azureus, a program's performance does not affect adoption. (Not that a browser in Java would be a good idea, unless you've got an FPGA wired to run Java bytecode natively. "Java sucks because Java is slow. Java is not for the desktop, because it is too slow. The desktop needs zero latency, never wait. Java can't be fast enough unless you've got an FPGA wired to run Java bytecode natively." (Repeat until you got it through your head. Azureus is painful to use even with a Raptor HD and a Q6600@3GHz and DDR3@1333MHz, and there exists nothing faster as of now. No, not the dual quad-core Xeon systems, they're stuck with DDR2@667MHz.)

I can't even begin to understand how it is possible that browsers suck that much at security. All the problems they have are long-solved, or can all be solved in under five seconds by thinking about them. Let's fix the whole lot of them right now, mkay?

-What does a browser do?
-"Send request, get reply, render."

So how is it possible that the *browser* can register system-wide extensions? THAT does not parse in MY brain. Speaking of IE, just a thought : IE could render URLs in a definable way in the address bar. Now who could have ever been stupid enough to think that was a good idea? "IE : the browser with phishing support".

And if Firefox is not more secure, then how? Why? Did Netscape suck that much? (Yes, I know : "yes".) Just re-write the whole thing from scratch then, it's not as if it was hard. "Send request, get reply, render."

Re:Thank you for an threadjack this easy. (1)

keithius (804090) | more than 6 years ago | (#22462394)

<snip>
What, then, about a browser that can identify a drive-by, by pre-parsing the content behind the links it shows. Heuristics would do that Real Well, too; I can think of a zillion methods to do Just That off the top of my head. "If it ends up writing to disk, don't." How hard is THAT?
<snip>

Harder than you'd think. I'm sorry to have to point this out, but security is not easy, no matter how much we'd like to think it is.

Re:Thank you for an threadjack this easy. (1)

Corwn of Amber (802933) | more than 6 years ago | (#22462586)

Security begins by looking at the application, get requirements and translate thm to code. The only network I/O a browser has to do is "send request, get reply". That problem is solved. Then, "render". Okay, parse the response and translate to screen. Solved. What security problems again?

Odd number presentation (1, Interesting)

Anonymous Coward | more than 6 years ago | (#22457146)

During that time we have investigated billions of URLs and found more than three million unique URLs on over 180,000 web sites automatically installing malware 180,000 out of billions doesn't seem like a lot to me.

Read it again (4, Insightful)

EmbeddedJanitor (597831) | more than 6 years ago | (#22457242)

There are three million bad URLs being served off 180,000 web sites.

Three million out of billions is not bad, assuming randomness (only, say 1 in 1000 chance of using a bad URL), but it is a lot worse than 180k out of billions.

However not all URLs are used equally. Bad URLs linked to some popular pron site, for instance, will get hit a lot more than Joe Sixpack's facebook site.

Re:Read it again (2, Insightful)

Anonymous Coward | more than 6 years ago | (#22458046)

Also, it would likely be inaccurate to assume uniform randomness for the appearance of those pages in search results. They are likely optimized to turn up for very popular queries with every SEO [wikipedia.org] trick available. So it's still 3 million out of billions, but those 3 million likely get significantly more than traffic than an average page.

GOOGLE IS MALWARE! (1)

Mr.Ballmer (1241256) | more than 6 years ago | (#22459650)

Errant Reports of MS Bowing to Google! . :-( For the life of me I have no idea where people get some of this stuff being passed off as tech-journalism today. "Microsoft Changes Code to Accommodate Google" - What a bunch of BS! We are nearing the release of Vista sp1 and as usual are doing hundreds of things to improve our flagship product, BUT, one thing we are not doing is changing even one line of code to accommodate that bloated crapware put out by Google! NEVER! If those guys can't write apps that take full advantage of our state of the art OS, so be it! We are not responsible for their incompetence, period! I am sooo angry right now that I have to stop and take another Valium ahead of schedule. http://fakesteveballmer.blogspot.com/ [blogspot.com]

Re:Read it again (1)

Raphael Emportu (1143977) | more than 6 years ago | (#22460342)

How does that insight fit into '1.3% of Google searches'? I find 1.3% a disturbing figure considering that a lot of people don't even know to handle a back and forward or even a stop button on there browser. More and more people connect without much more knowledge then starting up a browser screen and surfing from google or the (TRUE) history bar. So instead of responding to this kind of news from our own Geeky horizon we should try to keep an eye on the whole picture here. In this case the fact that criminals are trying to hijack the net.

And what platform does the malware run on? (1)

Anonymous Coward | more than 6 years ago | (#22457152)

As if we need to ask.

Re:And what platform does the malware run on? (5, Interesting)

grcumb (781340) | more than 6 years ago | (#22457308)

I found it quite interesting that the methodology of the research doesn't even bother to check sites with Mac OS X or Linux operating systems. But on the server side, Apache websites running outdated versions of PHP were singled out for comment.

In all there were twice as many compromised IIS servers as Apache, but fully 50% of all compromised Apache servers were running some version of PHP.

It was also interesting to note that computer-related websites ranked second only to social networking sites as most likely to be compromised with redirections to malware sites. Seems we might want to tone down our holier-than-thou rhetoric. 8^)

Re:And what platform does the malware run on? (2, Informative)

mrxak (727974) | more than 6 years ago | (#22457912)

There's a lot more servers out there running old versions of PHP than the very latest.

Re:And what platform does the malware run on? (1, Insightful)

smitty_one_each (243267) | more than 6 years ago | (#22457514)

x86

Re:And what platform does the malware run on? (0, Offtopic)

dwater (72834) | more than 6 years ago | (#22458308)

how did this get modded 'insightful'?

It's at most 'funny'. Clearly the gp meant one of the various 'Microsoft' operating systems as a platform, so the parent deliberately misunderstood it...

I don't get 'insightful' anywhere in that.

Re:And what platform does the malware run on? (0)

Anonymous Coward | more than 6 years ago | (#22458568)

You don't get karma for +1 Funny posts, so the moderator may have wanted to ensure that karma was added for P.
P does, in fact, provide a succinct spanking of GP for attempting a snarky little swipe at Redmond, while using a vague term like 'platform', which can indeed refer to hardware as well as software.
Real hacker pros a) don't waste a lot of time on /., and b) don't waste time belittling others' work in general, as they kind of all live in glass houses
http://lwn.net/SubscriberLink/268783/587af90fbc1b0132/ [lwn.net]

Re:And what OS does the malware run on? (0)

Anonymous Coward | more than 6 years ago | (#22459332)

Your code sucks. May I suggest a language other than Visual Basic.

What exactly does a real hacker do?

Now then... (4, Funny)

Bluewraith (1226564) | more than 6 years ago | (#22457156)

Where is the page listing each of the bad sites? I'd like to get started on my Virus Aquarium [xkcd.com]

Re:Now then... (0)

Anonymous Coward | more than 6 years ago | (#22457904)

just get peer-guardian 2, export the bad website list, exit peer guardian and copy/paste the ip address.

most malware sites will still work with just the ip address, since they're usually configured to load the malware page for all requests.

Running automatically on what platforms? (0)

Anonymous Coward | more than 6 years ago | (#22457158)

If I build an OS that self-destructs if it encounters <html>, is 99.9% of the web malware now?

Google itself? (3, Interesting)

XanC (644172) | more than 6 years ago | (#22457174)

Did Google consider itself to be a source of malware? http://blog.opendns.com/2007/05/22/google-turns-the-page/ [opendns.com]

Re:Google itself? (1)

maxume (22995) | more than 6 years ago | (#22457688)

Did you read the article? What Google and Dell are doing is irritating, but the article goes from 'the program has an obscure, confusing name' directly to 'it is hard to uninstall'. If there is an uninstall entry, it isn't hard to uninstall, and if it uninstalls properly, then it isn't misbehaving.

It's certainly crapware, but I'm not real sure it is malware, and there is some sort of useful difference there(I guess, crapware is software that behaves reasonably and is installed with no consideration towards the end user, and malware is software that is actively hostile to the end user).

Re:Google itself? (2, Interesting)

_merlin (160982) | more than 6 years ago | (#22457730)

I'd say it falls into the same category as WGA: borderline malware. The name "Browser Error Redirector" doesn't make its purpose clear to a non-technical user; it sends information to a third party without user confirmation; it is installed without user consent. The information it sends to a third party may be innocuous, and it may be possible to uninstall, but it's still far from respectable.

Re:Google itself? (3, Insightful)

moderatorrater (1095745) | more than 6 years ago | (#22457948)

The name "Browser Error Redirector" doesn't make its purpose clear to a non-technical user
I would argue that there is no way to make its purpose clear to the non-technical user without using at least a full sentence, probably a paragraph. For those who are familiar with the concept of error page redirection in the first place, it's a very adequate description, very honest and the first thing I would suspect once I realized there was a problem. If it had been "Browser Helper" or "DNS Accelerator" or "Bonzai Buddy" then arguing that the name wasn't clear would be applicable; as it is, it's a specific name for a specific condition that doesn't hide what it is.

Re:Google itself? (1)

martin-boundary (547041) | more than 6 years ago | (#22458138)

I would argue that there is no way to make its purpose clear to the non-technical user without using at least a full sentence, probably a paragraph.
They why don't they do it? It's easy to add a long descriptive paragraph in the control panel's ad/remove list. Case closed.

I don't agree that "redirector" more or less on its own is an apt description however, because the ultimate purpose is to show ads to web surfers, and redirection is a generic mechanism.

Any apt description should have to include the word "advertisement" in a prominent way. How about "advert redirector", or some such?

Re:Google itself? (2, Interesting)

moderatorrater (1095745) | more than 6 years ago | (#22458060)

I read that article, and honestly, it comes off as someone trying to sound smart who really isn't. "Spyware" (used in the article) isn't the term for something that changes the behavior of the computer; it would be applicable if the software reports back to google about the browsing habits, but this isn't what's described in the article. It should be considered "malware" or "adware."

Further, the argument about the name seems frivolous. Expecting a non-technical user to even realize that their error pages are being changed in the first place is stretching it; to suggest that the program could somehow name itself in such a way that a non-technical user would know what it did is ridiculous. If you know about the problem, the name is as good as any I could come up with, and certainly better than anything that could properly be called "spyware".

Finally, the article would be 1/3 the length, but he's too busy talking about how he's so morally superior. Granted, OpenDNS is an awesome service that I recommend wide and far, but the fact that he's fixing the problem is enough to show most people that.

4chan's take on this (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#22457366)

MALWARE: DO NOT WANT

I CAN HAS SAFE WEB?

Lameness filter encountered. Post aborted!
Reason: Don't use so many caps. It's like YELLING.

Maybe Goole should delist a few sites. (4, Interesting)

budgenator (254554) | more than 6 years ago | (#22457378)

It occurred to me that if Google started desisting sites that tried to implant malware into visitors computers, then webmasters would be much more diligent about keeping the crap off their sites, or at least keep a few more hapless victims out of harm's way.

Re:They already show a warning. (1, Informative)

Anonymous Coward | more than 6 years ago | (#22457454)

I have seen search results on Google that show a warning that the site is known to contain malware. Perhaps they just censor the listings outright in other countries though.

Re:Maybe Goole should delist a few sites. (1)

ddrichardson (869910) | more than 6 years ago | (#22457526)

They have an initiative already with StopBadware [stopbadware.org] , there's a quick article [lifehacker.com] here.

Re:Maybe Goole should delist a few sites. (1)

dwater (72834) | more than 6 years ago | (#22457844)

Did you notice that it says that most offending sites are hosted in China?

I think this is kind of interesting. Who hosts sites *in China* that are meant for viewers outside of China? I guess there might be some sites, but not many, I think.

Also, very few Chinese people use Google, so if Google started taking out 'offending' sites from it's search results then very few people would be affected.

In fact, it seems to me that only good can come if they do so. Very few people use Google to find sites hosted in China and so they might as well take the results out anyway.
 
...but, IMO, it would have very little effect on those who host the sites because Google isn't that important in China.

If there *are* sites in China meant for viewers elsewhere (where Google is actually used a lot), then what you suggest might work.

Re:Maybe Goole should delist a few sites. (1)

Antique Geekmeister (740220) | more than 6 years ago | (#22458048)

If Google were willing to lose China as a market, they'd have refused to cooperate with Chinese censorship of Google results.

The China sites doubtless includes lots of rootkitted servers, and an active market in rootkitting people's computers and selling their time for spamming and other illegal activities.

Re:Maybe Goole should delist a few sites. (1)

dwater (72834) | more than 6 years ago | (#22458134)

Eh?

Their Chinese search web site already returns different results to their US one.

I guess my point is that they can still list infected sites in the results on their Chinese search engine, but remove them from everyone else's, and by doing so they'd not affect too many people in a negative way but have a more significant impact in a positive way.

This still supposes that:

1) the sites in question are hosted in China for a Chinese audience,
2) visitors from outside China are there by accident because the sites were listed in the (non-Chinese) Google search results.

That first one might not be true, since hosting servers in China is very cheap, so perhaps some entities host sites in China intended for non-Chinese audience in order to cut costs.

Re:Maybe Goole should delist a few sites. (1)

Antique Geekmeister (740220) | more than 6 years ago | (#22458288)

China remains one of the largest providers of email spam and fraudulent miracle cures and scams worldwide. As such a contributing host, and with Chinese legal authority poorly educated and frankly uninterested in punishing web and email fraud, it remains an email and webhost fraud hotspot. So you've left out this:

3) The sites in question are hosted in China, by Chinese crackers and fraudsters, to defraud anyone with money or computer resources tricked into visiting the site, no matter where it is hosted.

This works because Chinese law enforcement is even more behind the times dealing with computer fraud than the USA.

Re:Maybe Goole should delist a few sites. (0)

dwater (72834) | more than 6 years ago | (#22458374)

sorry, but I can't understand your point....care to elabourate?

Re:Maybe Goole should delist a few sites. (1)

Anne Thwacks (531696) | more than 6 years ago | (#22460608)

This works because Chinese law enforcement is even more behind the times dealing with computer fraud than the USA.

This shows you have no idea whatever.

Almost every single example of the products/services/scams being served sends the money via a US based credit card company to a US based criminal. By far the majority of procuts or serveces promoted by these methods are not even available to anyone outside America. In simple terms: both supply and demand are American. China, and other countries are only involved because they have been botnetted by American crime. If the American justice system did anything at all to stop this, the problem would go away

Re:Maybe Goole should delist a few sites. (1)

Antique Geekmeister (740220) | more than 6 years ago | (#22460676)

Where are you getting the claim that the fraudsters are mostly American? There's plenty of market for such frauds. The Americans are the logical victims of such fraud?

I agree that the American prosecution efforts are pitiful, and would help reduce the problem massively. But have you ever tried to track a spammer or fraudster overseas to their hosting website and get anything done about it? The US ISP's are at least somewhat responsive to outright fraud accusations with proof provided.

And unfortunately, the Americans have tried to do "anything at all". What they've tried has been mis-aimed, such as the CAN-SPAM act.

Re:Maybe Goole should delist a few sites. (2, Interesting)

budgenator (254554) | more than 6 years ago | (#22458294)

That first one might not be true, since hosting servers in China is very cheap, so perhaps some entities host sites in China intended for non-Chinese audience in order to cut costs.
I remember years ago that hosts used to have a "no porn" in there service agreements, for fear that their IP block might get blacklisted, Now we often run into the same thing due to virtual hosting, blocking one IP address might knock a 100 websites off the internet. Of course with China some of it may be the government trying to implant surveillance Trojans

Re:Maybe Goole should delist a few sites. (-1, Troll)

Anonymous Coward | more than 6 years ago | (#22458888)

Mod parent interesting. FFS mods.

*Lots* of Chinese websites are for foreign viewers (1)

billstewart (78916) | more than 6 years ago | (#22459496)

Sites written in the Chinese language are, of course, mostly written for viewers who read Chinese, including in China and the widespread overseas Chinese populations.


But there's a huge business of websites in China that are used by spammers, phishers, and other parasites, because the Internet means that you can connect to anywhere in the world for the cost of a few hundred milliseconds, and China not only as a large technically skilled population, a lot of infrastructure, and an imbalance in bandwidth usage, and it also has a regulatory attitude that doesn't care too much what you do to make money selling foreigners what they want. (And DNS doesn't care what language your sysadmins speak - you can be a .com or .biz anywhere.) So if foreigners want somewhere to host a website selling Nigerian Herbal Fake Viagra, the Chinese regulators don't mind all that much, and if the hosting customers want to advertise their products by sending spam with URLs that have obfuscated names in them and end up in China, the Chinese regulators don't mind all that much either. They get really grumpy if you're selling information about Falun Gong or overthrowing Communism, and kind of grumpy if there's pornography, at least if the text and filenames are in Chinese, and once in a while they'll react to trade pressure about pirated music or software, but basically if you want to host a website with malware, the best places in the world to do it are usually either China or Russia.

Re:*Lots* of Chinese websites are for foreign view (1)

dwater (72834) | more than 6 years ago | (#22459646)

er, ok.
Nothing of *value* then. Certainly nothing that would stop me wanting to have their results filtered from my google search results.
I guess I was talking about sites that had legitamate content but which had been poisoned by various malware or whatever.

Re:Maybe Goole should delist a few sites. (3, Insightful)

moderatorrater (1095745) | more than 6 years ago | (#22458122)

The problem with that is the number of sites that happen to host malware without meaning to. Too often the malware comes through advertising services or sneak through in user generated content that would be fine if not for a browser vulnerability. Google does a lot as it is, outright blocking the sites goes too far (unless that's the only thing that the site is made for, which is rare and would probably mean that the site is ranked low in the first place).

Re:Maybe Goole should delist a few sites. (1)

Sancho (17056) | more than 6 years ago | (#22458376)

then webmasters would be much more diligent about keeping the crap off their sites, or at least keep a few more hapless victims out of harm's way.
What is it the kids say these days? Reading comprehension for the win? I'd love to see more due diligence on the part of web admins, but the only way to really get that is to hit them where it hurts.

Actually they do add a warning for infected sites (5, Informative)

Slur (61510) | more than 6 years ago | (#22458330)

One site I work on got hit by a PHPBB SQL injection attack and had a tiny iframe inserted into the forum header that pointed to a well-known malware site, hightstats.net (and if you're curious the malicious script is in the strong/044 folder). Google picked up on the iframe's contents being a malicious script and added the malware warning to the search results pertaining to the forums section of our website.

I just wonder how it is that hightstats.net can still be in existence when it contains known malicious stuff that hackers are inserting into unwary websites?!

Re:Actually they do add a warning for infected sit (1)

budgenator (254554) | more than 6 years ago | (#22459072)

maybe every time a look at a phishing site out of curiosity I'll tell them my email address is qwerty@highstats.net.

Re:Maybe Goole should delist a few sites. (1)

hesaigo999ca (786966) | more than 6 years ago | (#22462604)

I agree, if the site's owner was unable to know themsleves they had malware from third party cross scripting techniques, this would be a great way for them to be advised.

What do you mean I am blocked, why....oooh! ok i'll fix it up for you, and then you unblock me...thanks google, you saved the day.

zero script policy for serious web use (3, Interesting)

Anonymous Coward | more than 6 years ago | (#22457382)

The problem is with the client software. I can understand the danger of sites that try to fool you into downloading and running an application, or infected media that harnesses an exploit in an application - but automatically infecting the machine just by visiting the site is beyond belief. There's a serious problem with what the "web" has become, forced upon us by reckless and naive developers. The WWW and HTML was never meant to be something that runs active code on the client. Period. Most of us realise there is no way this problem can ever be solved without revising exactly what a browser is supposed to be, as long as browsers will run code instead of interpreting data there will always be malicious sites set up to exploit this.

I have to observe a cast iron policy in my work. It means that quite a few sites on the internet are unavailable, but since they are mostly entertainment based it isn't a serious loss. No Javascript, no ActiveX, no Macromedia Flash. My activities are limited to viewing HTML and PDFs, even animated GIFs are blocked. In many years we have had no malware incidents (that I know of). Sometimes it's absolutely necessary to view a site containing potentially insecure content, so there is a "dirty machine" which is not allowed to connect to anything else and is wiped and reinstalled weekly.

The problem is that even serious academic and scientific sites (that should know better) are starting to add Flash plugins and heavy scripting, so it's getting hard for conscientious users to maintain security even where they want to. Insecure technology is being forced upon us by the site developers.

It would be nice if Google could display whether a site needs JavaScript, Flash or whatever and be able to search for HTML only content. The difficult way is to use Google Cache in text only mode of course.

Re:zero script policy for serious web use (1, Funny)

dwater (72834) | more than 6 years ago | (#22458058)

> No Javascript, no ActiveX, no Macromedia Flash.

You work at heaven.com?

Cool!

I want to work there too :)

On the other hand, I use NoScript, and it can be annoying sometimes...

I like your idea of Google displaying the technologies used on the pages they list :)

Re:zero script policy for serious web use (0)

Anonymous Coward | more than 6 years ago | (#22459966)

I guess you haven't seen PDF exploit [computerworld.com] .

I know this may be hard for you to understand, but there is no such thing as "safe data". Even straight ASCII text can be malicious if the parser has a bug in it. If your browser has a bug that causes it to crash when parsing some HTML, there's a possible exploit from an HTML page with no media or special programming features whatsoever.

dom

Re:zero script policy for serious web use (1)

IamTheRealMike (537420) | more than 6 years ago | (#22461670)

It's got nothing to do with active code. It's to do with browsers being large, complex applications. Breaking large parts of the web by stopping scripting reduces the surface area for attack but does not eliminate it. There have been too many image decoder or URL exploits for anybody to believe that.

In many years we have had no malware incidents (that I know of)

Modern virus scanners have an observed 80% miss rate.

Search engine ranking (0, Insightful)

Anonymous Coward | more than 6 years ago | (#22457396)

H1 = Very important
H2 = Pretty important
H3 = Important
H4 = Less important, but still important
H5 = Less important
H6 = Even less important

JavaScript (yes) = Punish website
JavaScript (no) = Reward website
JavaScript OnLoad = Double punish website

HTML/XHTML compliance = Reward website
HTML/XHTML not compliance = Punish website

RSS feed = Reward website

Hyperlinks that contain more than 10 words = Punish website
Hyperlink directly after hyperlink = Punish website

ActiveX = Punish website
RealAudio = Punish website
QuickTime = Punish website

Ogg Vorbis = Reward website
FLAC = Reward website

Re:Search engine ranking (5, Insightful)

calebt3 (1098475) | more than 6 years ago | (#22457442)

Searchers won't use your engine if it does not give them what they want.

Be careful what you ask for (2, Interesting)

davidwr (791652) | more than 6 years ago | (#22457458)

You'll start seeing people use H1 for everything. If you are lucky they'll override it with a style sheet so it doesn't look obnoxious.

I wonder if Google has ever considered a moderation system, allowing logged-in Google users to rank the results of their searches on a random and infrequent basis. It would be easy enough to have the "click here to open" link change to a "click here to open, and open survey in new tab/window" if the user said they were willing to moderate search results.

If a page got a bad "reputation" for a given search, its rank would go down for that particular search.
If a page got a bad "reputation" as a malware haven, link farm, or other abusive page, that page would be punished.
If a page got flagged as "illegal content" Google would drop the comment with a note saying "We are not the police, but please contact your local or national police. Click here for a list of national police web sites worldwide."
If a page got flagged as a copyright violation, Google would drop the comment with a note saying "We are not in the business of enforcing private court actions. To find a copyright attorney, click here."

Re:Be careful what you ask for (3, Interesting)

onepoint (301486) | more than 6 years ago | (#22458282)

they have the vote for this on the tool bar. Which to my knowledge works rather well if you are a heavy user and consistently vote pages for which you do a search. I do about 40 to 80 search per day and I am sure that I vote on 90% of it, I have come back to the same topics to search and have seen changes which were major improvements ( lag time about 4 to 6 weeks )

Re:Search engine ranking (1)

_merlin (160982) | more than 6 years ago | (#22457888)

How is this a good idea? Sure, having headings suggests that the author may have gone to some trouble to structure the page, but it's no real indicator of quality. A script can easily crank out reasonable-looking headings. Same goes for HTML/XHTML compliance.

Punishing JavaScript will punish everyone using Ruby on Rails, Wordpress, or anything else that does AJAX stuff. Sure, JavaScript can be used to do bad things, but a lot of UI enhancement and "Web 2.0" stuff depends on it.

RSS feed? Only relevant for blogs/news/comics/etc. RSS feeds are not relevant or useful for reference material, or other relatively static content. And once again, they can be cranked out by a script. All those "TPG Feed" meta-porn sites have RSS feeds. That doesn't give any indication of quality.

Hyperlink directly after hyperlink will penalise all the sidebars on Slashdot, and on blogs. Penalising multi-word hyperlinks will penalise tables of contents in books and research papers.

As to your format snobbery, I have a default installation of Firefox on a Windows machine here at work. I have a default installation of Firefox on a Mac at home. Neither of them can play FLAC or Ogg/Vorbis. Why not reward standard formats like MPEG and 3GP? FLAC and Ogg/Vorbis may not be patent-encumbered, but they are developed in a closed way, by single entities. Real standards should be controlled by real standards bodies.

Re:Search engine ranking (1)

Sancho (17056) | more than 6 years ago | (#22458404)

Punishing JavaScript will punish everyone using Ruby on Rails, Wordpress, or anything else that does AJAX stuff. Sure, JavaScript can be used to do bad things, but a lot of UI enhancement and "Web 2.0" stuff depends on it.
Any website which requires JavaScript should be punished. Sites which degrade gracefully should not be. This would be a difficult thing to determine, however.

Re:Search engine ranking (3, Informative)

darthflo (1095225) | more than 6 years ago | (#22461630)

The GoogleBot doesn't execute JavaScript. Google listing any content from a given site means it does, to a certain point, degrade gracefully.

Also, what's your problem with JavaScript? If you ever used the Google front page (instead of your browser's quick search function or /search?q=your+query), you probably didn't mind not having to click into that textbox, now did you? JavaScript can cause some problems, but implemented sensibly (by the browser devs) it is no security threat and used responsibly (by web devs) has great benefits.

Re:Search engine ranking (1)

Sancho (17056) | more than 6 years ago | (#22463396)

The GoogleBot doesn't execute JavaScript. Google listing any content from a given site means it does, to a certain point, degrade gracefully.
I browse with Javascript off. I've noticed many pages (indexed from Google) which have Javascript-requirements for navigation. Usually, it's a menu bar which doesn't degrade (something I can't understand, as it's got to be easy to do.)

Also, what's your problem with JavaScript? If you ever used the Google front page (instead of your browser's quick search function or /search?q=your+query), you probably didn't mind not having to click into that textbox, now did you? JavaScript can cause some problems, but implemented sensibly (by the browser devs) it is no security threat and used responsibly (by web devs) has great benefits.
With Javascript, you can do a lot of neat things, sure (though I almost always use my browser's box to search Google, so I never see the home page.) It's mostly a security thing. Your assertion that sensibly-implemented Javascript is no security threat hasn't really been tested, as there hasn't been a sensible implementation yet. People don't understand security, cross-site security, etc. and until they do, I'm going to err on the side of caution.

Besides, my mobile phone doesn't handle Javascript very well at all. Sites which don't degrade nicely aren't viewable on my phone, so it would be nice if Google didn't return those queries (particularly when I'm using Google from my phone.)

Of course, there are also problems with the design of Javascript (such as the lack of threading) but that's not a reason to avoid its use--just a reason to dislike it.

Re:Search engine ranking (1)

darthflo (1095225) | more than 6 years ago | (#22464050)

Your assertion that sensibly-implemented Javascript is no security threat hasn't really been tested, as there hasn't been a sensible implementation yet.
As strange as this may sound, IE7's JavaScript implementation does not seem to have any known security flaws. Firefox, Safari and Opera seem to all be plagued by recent problems.
Anyways, JavaScript may not be the biggest of the web's security problems. Cross-site-scripting can be accomplished almost as easy with pure html (e.g. instead of redirecting victims, a full-screen IFrame is laid over the whole affected page. Additional benefit: address bar still shows the correct domain); CSRF is a bit more limited (to GET requests, to be precise) but certainly still possible.

such as the lack of threading
I hope you're kidding. We're talking about a language to enhance the web surfing experience, not the language you're going to write your next huge application in. Also, JavaScript does provide enough possibility of asynchronous operations; Prototype.js and the like make them easy to use. Adding a threading framework could very well introduce huge gaps between browsers. Again.

Re:Search engine ranking (1)

FireFury03 (653718) | more than 6 years ago | (#22460860)

JavaScript (yes) = Punish website
JavaScript (no) = Reward website
JavaScript OnLoad = Double punish website


This seems pretty silly - just because a website uses javascript doesn't mean it *requires* it. Well designed web sites work just fine without JS but if you have it then they give you an enhanced experience.

HTML/XHTML compliance = Reward website
HTML/XHTML not compliance = Punish website


Sadly Google doesn't properly support XHTML, so if you are punished anyway for using XHTML (why?!)

RSS feed = Reward website

RSS feeds are not appropriate for all websites - rewarding people for using inappropriate technologies is silly.

so how about releasing this data? (0, Interesting)

Anonymous Coward | more than 6 years ago | (#22457472)

I wonder if there are plans to release this data to the general public. Someone could then write a pretty useful Firefox extensions that would warn or prevent people from even going to these sites.

Re:so how about releasing this data? (1)

martin-boundary (547041) | more than 6 years ago | (#22457638)

That's a stupid idea. It's been tried before against spam, look up DNSBL [wikipedia.org] .

Malware is MS's fault really (1, Insightful)

Anonymous Coward | more than 6 years ago | (#22457508)

Well its in Google's best interest to fight this, as Malware has the potential to affect their business.

Really, as much as I am not a MS basher, malware is almost entirely Microsoft's fault. If they had paid attention back in the day to security, we wouldn't have the steaming swamp of malware we have now.

The only serious way to fight malware is to reduce the potential infection hosts.

fighting this is just like fighting any sort of sickness or plague. If you have enough immunized hosts, they the issue won't be as bad.

Re:Malware is MS's fault really (1)

moderatorrater (1095745) | more than 6 years ago | (#22458192)

That's a nice theory, but you can't argue that Microsoft is the most popular vendor for a lot of software and is, therefore, the biggest target. While Microsoft seems to have a bigger security problem than other vendors, there's no way to tell if other vendors and products would fail miserably given the same scrutiny.

Re:Malware is MS's fault really (1)

darthflo (1095225) | more than 6 years ago | (#22461706)

In other news Ford is blamed for the United States' foreign policy (If they hadn't built that stupid model T, nobody would be driving cars today not burning all the oil not making raiding middle eastern countries for their oil necessary) while Xerox is being accused for global warming as a whole (THEY started all that copying and printing. If it weren't for them, we wouldn't have had to chop down rainforests for paper which in turn would have photosynthized all that CO2 back to O2.)

Please, get a grip. Microsoft has done their share of bad design decisions (ActiveX, anyone?), but they're not the only ones. After having grown to about a quarter of IE's market share, Mozilla Firefox is already surpassing it on vulnerabilities. As they grow more popular and/or feature-rich all bigger projects are broken.

Fact: "I took drugs, had homo sex with Obama" (-1, Troll)

Anonymous Coward | more than 6 years ago | (#22457532)

Read all about druggy Barack Hussein Obamba, the Muslim queer. [worldnetdaily.com]

Dismal antivirus performance (1)

0x15 (852429) | more than 6 years ago | (#22457660)

It's a shame that Google chose to not identify the three AV vendors it tested. Their ability to protect against malware ranged from bad (~80%) to abysmal (~20%). To identify them would have been a public service for us and a motivation for them.

Google Malware team. (2, Interesting)

csk_1975 (721546) | more than 6 years ago | (#22457812)

Having first been unable to use google translate and now google search due to the "Error- Your request appears to be virus related please scan your computer for malware" I do wonder how sound any google analysis of malware is. If they have problems distinguishing between my computer that is not malware infected and the transparent port 80 proxy for my home cable ISP which is shared by 100,000s of computers some of which are obviously malware infected, then what hope a useful analysis of the much more devious and murky world of drive-by installers?

Anonymous peer review? (1)

prxp (1023979) | more than 6 years ago | (#22458314)

Usually, good conferences and journals have an anonymous peer review process. I find if very odd that google researchers chose to publicize their paper before the peer review process is done. That is at least lack of decorum, IMO.

Aha, I see the problem here (1)

Profane MuthaFucka (574406) | more than 6 years ago | (#22458456)

Chinese firewall installed upside down!

Nice plug for Google: (2, Interesting)

olddoc (152678) | more than 6 years ago | (#22458512)

The underlying problem is that advertising space is often syndicated to other parties who are not known to the web site owner. Although non-syndicated advertising networks such as Google Adwords are not affected...

Did you catch the above line in their article?

Key points to take from the paper (4, Informative)

The Master Control P (655590) | more than 6 years ago | (#22458578)

2/3 of all malware distribution sites & sites that link to them are hosted in China.
The next worst offender is the US with 1/6.
About 3.5M websites attempt to send you to exploits from 180K distribution sites.
63% of the 180K malicious sites are IIS, 33% are Apache, and a handful are other.
80% of malware from not in ads (e.g. iframes) was within 4 redirects of the malware distributor.
80% of malware from ads was more than 4 redirects from the distributor.
3/4 of distribution sites and 1/2 of landing sites are in 2 blocks occupying 6.5% of IP4.
Among drive-by downloads, 1/2 alter your startup, 1/3 attack your security, 1/4 corrupt your preferences, and 7% install BHOs.
87% of outbound connections the malware initiates are HTTP, 8.3% are IRC.
The three AV engines tested against malware retrieved by the study had detection rates of about 35, 50, and 70%.

The part I find scariest is the 3.5M malware fronts. I mean, there are only about 70M active hosts on the entire Internet - that's 5 percent! Since I think that trying to make programmers these days write secure code is a lost cause, we should focus on breaking up the software monoculture. This kind of shit really starts to lose it's efficacy if only 1/4 or 1/5 attempts even attack the right browser...

Re:Key points to take from the paper (1)

quux4 (932150) | more than 6 years ago | (#22460012)

The part I find scariest is the 3.5M malware fronts.

Recheck the paper. There were 3.5M bad urls, which through a series of redirects, pointed to only 9340 malware distribution sites (see Table 1, page 8) hosted on systems in only 500 autonomous systems. This is a solvable problem: 500 hosting companies (or their customers) are the source of it all.

Re:Key points to take from the paper (0)

Anonymous Coward | more than 6 years ago | (#22460112)

A monoculture may make things easy for the malware authors, but a "polyculture" would not make things that much harder for them. Look back at the old days of home computers: a given program might have to be ported to 8 or more different platforms (MS MultiPlan ran on CP/M, DOS, Xenix, C64, TI, Radio Shack, Apple II, and Mac). Back then programs were mostly hand-coded assembly, there was almost no similarity between different platforms, and the population of users was very small. In other words, if it is necessary to support different platforms to make a profit, it is certainly possible.

Right now Windows has 90%+ of the users, so the opportunity cost of writing malware for an alternative platform is very high. If there were 10 platforms all with 10% of the market, the malware authors would just be forced to make multiplatform malware. This may seem hard, but a given script kiddie doesn't have to write 10 different exploits, he just has to download 10 different exploits and figure out how to combine them.

dom

Quick summary (1)

Duncan3 (10537) | more than 6 years ago | (#22458986)

ICANN allows the sites (typos and fronting).
IE, Outlook, and most other web/email clients take you to them happily.
And Google funds the whole ecosystem with their ads.

Maybe Google should look in a mirror once in a while. Becasue in the mirror it doesnt say "do no evil" it says "be a greedy profit hungry corporation or get sued by the shareholders and goto jail"

This can be fixed, but impacts ad revenue model (3, Informative)

Animats (122034) | more than 6 years ago | (#22459760)

The paper points out that most of the attacks involve redirection of some portion of page content. That's a useful piece of information, because, other than for advertising purposes, redirection of IFRAME items and images is quite rare. A useful blocking strategy would be to block all redirects below the top level page. Many ads will disappear; no great loss.

Checking for hostile full web pages is already being done. McAfee SiteAdvisor was the first to do that, then Google copied them. Our "bottom feeder filter", SiteTruth [sitetruth.com] , does some of that too, although it throws out far more sites than McAfee or Google do, just by insisting that some identifiable business stand behind any page that looks commercial.

Google's revenue model depends, to some extent, on those "bottom feeder" sites: all those anonymous "landing pages", "directory pages", "made for AdWords pages", and similar junk. Those things bring in substantial AdWords revenue, although they don't usually generate much in the way of sales for advertisers. Throwing them out of the "Google Content Network" would cut Google's ad income. This is where "don't be evil" collides with Google's profitability.

This looks like a solveable problem, but the solution will come from the security companies, not the search companies. The search companies can't afford to fix it.

The choke point: distribution sites (2, Interesting)

quux4 (932150) | more than 6 years ago | (#22459940)

In the 10 months of data the researchers used, Google found 9,340 distribution sites. The other 180,000 sites simply redirect you to the the distribution site, which is where you download the malware.

It gets better - those 9340 distribution sites are under the aegis of only 500 autonomous systems. [wikipedia.org] Which means Google could send their list to those 500 AS's - and each would have (on average) around 20 malware sites to clean up. After this, Google could keep notifying AS's of the distribution sites found (less than a thousand a month).

Looks like a very measurable and approacheable problem now! I can't wait for Google's spam report. (They are working on one, aren't they?)

Bulletin Boards (1)

tonynz (1238218) | more than 6 years ago | (#22460314)

A potential vector for redirects to malware sites lies in bogus registrations on bulletin boards. A board of which I'm a member has seen a large number of such registrations purporting to originate in England, with links to sites in eastern Europe. Redirection? Walks like a duck ...

MD5? (1)

c0d3r (156687) | more than 6 years ago | (#22460732)

Shouldn't a centralized spider md5 (or the like) legit binaries with a central CA like authority to verify and identify these exploiters?

M

outdated (1)

tobto (1241450) | more than 6 years ago | (#22461096)

that because of outdated LAMP configs

1,3%? (1)

uxbn_kuribo (1146975) | more than 6 years ago | (#22462352)

I'd have thought it'd be way higher than that.* *if the anti-malware companies are to be believed** ** Some of them can't be believed because their anti-malware contains malware.

Google has Adverts from Malware companies (0)

Anonymous Coward | more than 6 years ago | (#22466298)

When Google is profiting from taking adverts from Malware distributors their credibility on the issue gone - unless they reverse direction.

Re:Google has Adverts from Malware companies (1)

Old.UNIX.Nut (306040) | more than 6 years ago | (#22466330)

Google should but red warning besides results (1)

Yoshimetso (1240968) | more than 6 years ago | (#22473434)

I think since Google has the technology to discover and index malware distributing sites, and they should provide a new feature which will put a small red warning beside malicious results. Like McAfee SiteAdvisor service dose. This will decrease the number of infected machines in the Internet, and this is very easy to be noticed by novice users. ExtremeSecurity Blog Admin http://extremesecurity.blogspot.com/ [blogspot.com]
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?