Click to Massive Malware Attacks

[Humpty]

A large-scale, coordinated campaign to steer users toward malware-spewing Web sites from Google search results is under way, security researchers said Tuesday.

 

Users searching Google with any of hundreds of legitimate phrases -- from the technical "how to cisco router vpn dial in" to the heart-tugging "how to teach a dog to play fetch" -- will see links near the top of the results listings that lead directly to malicious sites hosting a mountain of malware. "This is huge," said Alex Eckelberry, Sunbelt Software's CEO. "So far we've found 27 different domains, each with up to 1,499 [malicious] pages. That's 40,000 possible pages."

PC World Article

[Sockdown]

Wow! Very interesting. Thanx for the info Humpty. Gonna be careful now and verify the url before pressing the link

[lotse]

Very interesting. Thanks.

 

Here is the the link to the sunbelt blog the article mentions, with screen shoots of what to expect. Funny how they use IE for some screenshots and Firefox for others. Maybe they're just making a point.

 

http://sunbeltblog.blogspot.com/2007/11/br...of-malware.html

[q231]

what the...i was almost a victim of this malware attack when im searching sound effects

[tommyk]

Wouldn't McAfee SiteAdvisor help with this?

[Humpty]

Wouldn't McAfee SiteAdvisor help with this?

Don't know but have read that Google are on to it and have deleted most of those sites.

Google nixes malware attack

 

The Saga May Continue

Another round of bogus malware touting sites may be headed toward Google’s search results again, according to the researcher tracking the issue.

 

Earlier today, Sunbelt Software reported that Google had eradicated the malware scourge hampering search results. That move had apparently closed the loop on a rash of malware in Google’s results from Monday and Tuesday.

 

In an update, however, Sunbelt argues that there are indications that another round of sites are being registered with the .cn domain. The catch this go around: There are two types of fake sites being registered–and that could mean there are two groups involved.

 

It appears the first round of sites come from the same bunch from the prior attack. Now there’s another group involved. Check out this screen from Sunbelt (there are more on the Sunbelt blog).

[JDPower]

Wouldn't McAfee SiteAdvisor help with this?

It would help as I doubt these sites would be green marked sites. I've added a filter to Customize Google on my system to hide these sites which seems to work (it doesn't block them but makes the filtered results smaller and faded). It's not perfect but makes any .cn results obvious and easier to avoid. For anyone that's interested the filter I've used is: http://*.cn/*

 

And thanks for the updates on this one Humpty.