Malware hides from search engines

    Date26 Apr 2010
    Posted ByAnthony Pell
    Criminals are increasingly attempting to conceal malware embedded in hacked websites from search engines such as Yahoo! and Google. Their aim is to prevent browsers which use technology such as Google's Safe Browsing API from sounding the alarm when a user visits a hacked website. Google's Safe Browsing API allows client applications to query Google's phishing and malware blacklist. Firefox and Google Chrome both make use of the API, which is based on Google searches of websites for suspicious code. If a Google search bot reaches one of these sites that conceal malware, it is recognised and simply fed harmless code. Web applications can identify visits from Google from the IP address and from the user agent (googlebot, yahoo) and can then use this information to control optional redirects to other pages. This can be achieved with just a few lines of code inserted into a hacked PHP web application. Fraudsters often use compromised websites, but also sometimes use special blog software.
    You are not authorised to post comments.

    LinuxSecurity Poll

    Has your email account ever been pwned in a data breach?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.