'Search engines should do more to fight malware'

Posted by   Virus Bulletin on   Mar 4, 2008

85% of users think that search engines should be doing more.

According to a recent poll, 85% of visitors to the VB website think that search engines should be doing more to fight malware, but experts say the matter is more complicated than that.

A recent paper by researchers at Google revealed that more than 1.3% of Google search results now contain at least one malware-serving website - a number that has quadrupled in the past nine months. Translated into actual searches this means that millions of people are being presented with links to malware-serving websites every day.

Randy Abrams, director of technical education at Eset, says that anything that search engine companies can do to prevent links to malicious websites from being displayed is beneficial, but warns that it is far from an easy task. He reminds us of last year's malware attack on the Miami Dolphins website just prior to the Super Bowl: "to block search results to that site," he says, "might have been perceived as a bad thing by many people."

Besides raising issues over freedom of speech, Abrams foresees another side effect of blocking sites: a new kind of DoS attack, where a website is infected with malware by a competitor or someone with a grudge, thus causing it to disappear from search engine results.

Martin Overton, an independent researcher and regular contributor to Virus Bulletin, agrees with VB poll respondents that search engines aren't doing enough. However, he points out that it is not easy to determine exactly what should be blocked from search results: "[Should you block] just malware, hacking tools and exploit code, or do you include porn, gambling, racial and religious abuse, and many other 'bad' things too?"

Tools such as SiteAdvisor and the others that warn about malicious or infected sites are probably a better idea, according to Overton, but he warns that they can be used as a crutch and are often used as a form of authorisation tool: "The user thinks 'If my toolbar/anti-malware says it is safe, then I'll trust it, and if I get infected, hacked or phished, then it isn't my fault.'"

So what's the answer? Abrams believes user education is important - and that blocking websites from search engine results might not be helpful: "[Blocking infected sites] does not educate people who desperately need to know more, and doesn't improve the security of software." Meanwhile, Overton suggests turning off all scripting and plugins in your browser, but says that this could cause problems with the functioning of many websites. "As with most things, he says, "minimising the risks will require a mix of technologies and education as well as good security policies and procedures - and a common-sense application of them all."

Google was not available for comment.

Posted on 03 March 2008 by Virus Bulletin

twitter.png
fb.png
linkedin.png
googleplus.png
reddit.png

 

Latest posts:

More on the Moose botnet at Botconf

At Botconf 2016 this week, GoSecure researchers Masarah Paquet-Clouston and Olivier Bilodeau presented their research on the Moose botnet - something Olivier Bilodeau previously spoke about at VB2015.

VB2016 paper: Defeating sandbox evasion: how to increase successful emulation rate in your virtualized environment

Today, we publish the VB2016 paper and presentation (recording) by Check Point Software researchers Alexander Chailytko and Stanislav Skuratovich, which focuses on the techniques used by malware to detect virtual environments, and provides detailed…

VB2016 paper: Mobile applications: a backdoor into the Internet of Things?

While the Internet of Things blossoms with newly connected objects every day, the security and privacy of these objects is often overlooked, making the IoT a major security concern. Unfortunately, reverse-engineering so-called smart devices is not an…

VB2016 paper: Wave your false flags! Deception tactics muddying attribution in targeted attacks

Today, we publish the VB2016 paper and presentation (recording) by Kaspersky Lab researchers Juan Andrés Guerrero-Saade and Brian Bartholomew, in which they look at some of the deception tactics used in targeted attacks.

Throwback Thursday: The Politics of Anti-Virus

President-elect of the United States Donald Trump made a number of promises about cybersecurity during his electoral campaign. What comes of those pledges remains to be seen, but one thing is certain: there will be a team of hard-working, dedicated…