Google results flog millions of compromised webpages

Top billing

Two ongoing scams are tricking Google and other search engines into prominently displaying millions of compromised webpages that attempt to hijack end users' computers or steal their credit card numbers, researchers said.

One of the attacks is being used to direct people searching the web to an online store hawking pirated copies of popular software titles. Plugging the phrase "cheap vista for students" into Google, for instance, returned more than 19 million results, many of which redirected users to a site called soft4pcs.com.

A separate attack is the work of a botnet dubbed ASProx, which injects malicious links into misconfigured ASP webpages. Users who enter a wide array of search queries, such as "used corvette parts", received results pointing to a page that redirected to ads-t.ru, which attempted to serve a hostile Adobe Flash file that installs malware.

Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, said here that Google was returning more than 3.2 million results that contained the malicious script and Bing showed 188 million. Those numbers were significantly smaller when we tried the same search about 10 hours after the blog item was published.

The attacks highlight the intricate role search engines, websites, domain name registrars, and webhosts play in enabling campaigns that have the potential to scam large numbers of people. Most of the compromised webpages appeared to be hosted by legitimate websites with administrators who simply weren't careful enough. Stanford University, and the official websites for the Webby Awards and 1980s musician Bryan Adams, were just some of those complicit.

But attackers wouldn't bother compromising those pages if Google and other search engines didn't feature them prominently in their results. In a blog post published Thursday, researcher Denis Sinegubko lays out in painstaking detail how the software pirates were able to gin Google's system. If he can figure it out, so should Google and even its much smaller competitors.

"We don't comment on individual sites, but there is nothing particularly new going on here as far as I can tell," a Google spokesman wrote in an email to The Register. "I think it's important to keep in mind that search engines are a reflection of the content and information that is available on the Internet."

He went on to say that Google uses both algorithmic and manual techniques to detect such scams and removes entries when they're detected. But it's not unusual for the bad guys to find new ways to slip malicious pages into Google, he added, making for a never-ending game of cat and mouse.

Members of Microsoft's security team are actively working to remove the malicious links, according to one of them who asked not to be named because he wasn't authorized to speak to reporters. Among the actions taken, the team added ads-t.ru to a list of sites to flag, so results that contain that address should contain a warning as soon as Bing recrawls the pages.

Representatives of Yahoo didn't respond to emails seeking comment. ®