Google sharpens malware alerts
558823
(InfoWorld) - Google Inc. has enhanced the way it notifies webmasters that their sites contain malware, improving on a service the Mountain View, California, company launched in November of last year in a partnership with The Stop Badware Coalition . Google has begun providing more detailed alerts and to send these notifications via e-mail to webmasters, according to a posting Monday on an official Google blog. Previously, Google only informed webmasters that their sites had been identified as having malware and made generic suggestions for fixing the problem. Now, the company also points webmasters to specific offending pages from their sites that Google has determined contain malicious components. "This can be helpful when the malicious content is hard to find," the posting reads. "By providing example URLs, webmasters are one step closer to diagnosing the problem and ultimately re-securing their sites." Before, Google notified webmasters by placing a note in the site's summary page in Google's Webmaster Tools site , but now it is sending the alert via e-mail as well. Google flags Web sites according to guidelines set by The Stop Badware Coalition. Webmasters who feel their sites have been incorrectly flagged as having malware need to contact the coalition and request a review. In August, and also in conjunction with The Stop Badware Coalition, Google started displaying malware alerts for users of its search engine. When users attempt to click over to a Web site considered to be potentially dangerous, Google shows an alert page that informs them of the possible risk and gives them the option to click back to the results page or continue on to the questionable Web site. However, these alerts sometimes anger webmasters who are convinced their sites don't contain malware. The Stop Badware Coalition is a nonprofit organization led by Harvard University and the University of Oxford and backed by Google, Lenovo Group Ltd. and Sun Microsystems Inc. A study published in May of last year by security vendor McAfee Inc.'s SiteAdvisor unit found that U.S. Internet users land on malicious Web sites about 285 million times per month by clicking on search results from the five major search engines, which are operated by Google, Yahoo Inc., Microsoft Corp.'s MSN unit, IAC/InterActiveCorp's Ask.com and Time Warner Inc.'s AOL LLC. Malicious Web sites are those that download spyware and adware to visitors' PCs, exploit security vulnerabilities and attempt to scam users and include them in spam lists, among other dangers. Â
734135
Google's search appliances could expose Web sites that use the products to information-stealing phishing attacks.
241820
Also: Hackers rig Google to deliver malware. See what people are saying on News.com Extra.
405864
Google Inc., the search engine whose clean, minimalist home page was a stark contrast to the link-laden Web portals of the late 1990s, made a tiny tweak to its site last week that may have much bigger repercussions.
1146
There is some confusion about threats posed by the new search tool. Google says common sense is enough of a patch. By Thomas Claburn.
440097
Misdirection ruse Security researchers have identified a Trojan that hijacks Google text advertisements, replacing them with "ads" from a different provider that are likely to be laced with spyware.â¦
373163
Websense warns of a Skype worm on the loose; Opera adds a security alert layer to its browser.
116333
Google acted quickly to block Santy.A, a worm that targeted the company&#39;s popular Internet search engine. Antivirus experts say this threat has passed, but predict that it may be just
348448
Google has responded to calls from antivirus firms to stop the spread of an Internet worm that was using the search engine&#39;s technology to spread among online bulletin boards.
224949
A bug in the Google Toolbar could allow criminals to steal data or install malicious software on a system, a security researcher warns.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
598555
People who use public or workplace computers for e-mail, instant messaging and Web searching have a new security risk to worry about: Google&#39;s free new tool that indexes a PC&#39;s contents for quickly locating data.
736801
Google Inc.  said on Monday it has fixed a software flaw that could allow hackers to view information contained on personal computers running the No. 1 search engine's desktop search software.
701997
Beta search app creates vulnerabilities that may threaten your data's security.
435651
Click-fraud menace spreads using IM Virus writers have crafted a malware threat that serves up expensive Google AdSense web pages related to mesothelioma, a rare cancer caused by exposure to asbestos.â¦
86071
The changes are in response to a complaint by Google that a feature of the operating system is anticompetitive.
734719
(InfoWorld) - Google quickly patched what security researchers identified Wednesday was a potentially serious cross-site scripting flaw in its popular desktop search and widget application that could leave users vulnerable to outside attack. In a report, researchers at application security software maker Watchfire, based in Waltham, Mass., detailed an existing attack designed to exploit the Google Desktop flaw. Watchfire said the cross-site scripting threat -- which it described as a parasitic virus -- could allow attackers to steal information from affected PCs and track end users' Web browsing habits. Cross-site scripting (XSS) threats typically take advantage of security vulnerabilities in legitimate Web pages to inject malicious content into the browsers of people visiting the URLs or to redirect them to fraudulent sites used in phishing attacks. Like many other XSS threats, the attack currently leveled at Google Desktop uses JavaScript code to deliver its payload. Watchfire experts said the Google Desktop XSS problem was very dangerous for a number of reasons. Among the more serious characteristics is the malicious program's ability to affect clusters of computers connected by Google Desktop's information sharing capabilities. This could allow attackers to spread the attack to new machines or simply steal data from multiple PCs linked by the application. Most enterprises have invested significant amounts of time and money installing security applications to protect against the loss of sensitive data over the last several years, but a Google Desktop attack would circumvent many of those systems, leaving information on corporate desktops running the program open for potential theft. "This attack is almost undetectable, it won't get picked up by any anti-virus system or firewall, and it can be used in a lot of different ways to harm end users," said the director of security research at Watchfire, Danny Allen. "It allows someone using the attack to control all the applications on a computer or access the network to which an affected machine is attached, and it is almost impossible to get rid of." As part of a demonstration of the exploit, Allen showed off how the program could be used to change the version number in the Google Desktop application itself. Doing so could allow attackers to fool users of the desktop search program into believing they have a version of the software that has been fixed for security reasons, when in fact they are still potentially vulnerable. "Some IT security people have dismissed the impact of [cross-site scripting] attacks to a certain extent, but we wanted to highlight the potential damage that something like this could deliver," Allen said. Media representatives at Google said that after Watchfire informed the company of the attack, engineers at the search giant created a patch for the issue that was automatically distributed to Google Desktop users. Google said it has also added a new set of security features to the latest iteration of the product to prevent similar attacks in the future. On Feb. 9, Google launched its newest version of the desktop search program, labeled Desktop 3 Beta. Company representatives said that they have not received any reports of the vulnerability being exploited on end-users' machines. Watchfire researchers said the new security patch appears to fix the flaw and prevent XSS attacks on users of Google Desktop whose systems have been updated. Security analysts considering the problem said it highlighted the need for businesses to look carefully at programs such as Google Desktop that straddle the line between personal and professional PC usage. Although the application may be very useful, and most often gets pulled into the corporate environment by people who use it at home, Google is not a maker of business-grade software and doesn't follow the same security processes as large manufacturers of such products, said John Pescatore, analyst at Gartner. Unlike Microsoft, Oracle, or Sun Microsystems, Google does not publish regular security bulletins or even offer specific details of issues it has already fixed, Pescatore said. This reason, along with the data security issues that can be introduced when Google Desktop isn't configured to bar users from inadvertently sharing search information with outsiders, poses serious questions for corporate IT administrators who must decide whether to allow people to use it in the office, according to the analyst. "The major concern is that while Google isn't an enterprise software vendor, programs it makes, including Google Desktop, are ending up on a lot of enterprise desktops," Pescatore said. "Google doesn't expose how it does patches like Microsoft, so how does an enterprise even know if their users are working with the version that has been fixed?" As malware writers and phishing scheme operators continue to hone their attacks to steal smaller amounts of valuable data from pools of targeted users, and move further away from the massive worm viruses of years past, the IT world will see more XSS threats. "There will be more funded cyber-crime attacks aimed at specific companies and groups of users, and the size of the threats is such, by design, that they won't land on the six o'clock news," Pescatore said. "The perpetrators will continue to increase the volume of these types of threats, and cross-site scripting and targeted phishing will likely be among their favorite formats for doing so." The bug, which was made public Wednesday by Watchfire, has now been fixed. While Google is automatically delivering a patch, Google Desktop users who want to be sure they are running the latest version of the software can download it here. Users should be running version 5.0.701.30540 or later, said Google Spokesman Barry Schnitt. Google was first notified of the problem on Jan. 4 and produced its fix on Feb. 1, a Watchfire spokesman said Wednesday. In addition to its bug fix, Google has added, "another layer of security checks to the latest version of Google Desktop to protect users from similar vulnerabilities in the future," Schnitt said. "We have received no reports that this vulnerability was exploited.â Robert McMillan of IDG News Service contributed to this report.