Google Wants You to Report Malware

darthcamaro writes "As part of its ongoing effort to keep a clean index Google is soliciting the help of web browsers to let them know when we find malware in the index. Celebrated Google hacker Johnny Long thinks it's a good idea, though he told the site Internet News that he doesn't think it'll stop real hackers. From the article: 'Most in search of malware for offensive use know the good stuff — it ain't distributed through public Web ... It's distributed through dark Web servers, peer-to-peer networks, IRC channels, torrents and the like. Google's efforts will not affect how skilled hackers get access to malware.'"

Comments

Not affect how skilled hackers get malware

[nurb432]

Nor should it. Google is now telling me what is moral and immoral and wanting to restrict access on their concepts of right and wrong? Who died and made them king?

Either they are a public company that should be considered a 'common carrier' or the aren't, which is it to be?

Re:Not affect how skilled hackers get malware

[webmaster404]

But for the Windows user, it could cut down MASSIVLY on the ammount of malware they get.

Re:Not affect how skilled hackers get malware

[calebt3]

Great. Once again we geeks are being called to defend the n00bs from their own stupidity pro-bono.

Re:Not affect how skilled hackers get malware

[fenodyree]

Google is definitively not a common carrier
They do not transport goods/data, they merely search them. As a public company they can drop any search results they disagree with or that make them look bad, etc...

For Evil or Good, Google can do what it pleases with its search results.

Re:Not affect how skilled hackers get malware

[nurb432]

If they are not a common carrier and actively filter results, then they need to be held legally liable for any results that are inappropriate/illegal.

Cant have it both ways.

Re:Not affect how skilled hackers get malware

[wizardforce]

it isn't the noobs that worry me, it's when people like you think that malware only affects the noobs and not the servers they will later attack. storm botnet ring a bell? preventing the noobs from inadvertantly joining spam botnets is in our best interests.

Re:Not affect how skilled hackers get malware

[quanticle]

This isn't about that. Google already has a service that reports and detects sites that try to phish your personal information or try to install malware on your machine. No, this effort is to try to purge the Google index of sites that sell malware creation and deployment toolkits to black-hats. IMHO, the original poster is correct. This wouldn't make it much more difficult for script-kiddies and black-hats to get their hands on malware kits, while making it more difficult for white-hats to find information about these programs.

Re:Not affect how skilled hackers get malware

[calebt3]

Touché

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

What about the cookie DoubleClick uses? Hmm, i think Google need to be quite careful with how they define Malware.

Re:Not affect how skilled hackers get malware

[a whoabot]

How so? Is linking to something that is illegal, illegal? Doesn't sound necessary.

Re:Not affect how skilled hackers get malware

[nurb432]

Personally, i feel that if they filter ONE item, EVER, then it blows the entire idea of them not being liable for future content. They really shouldn't be in the business of deciding what is ok and what isn't ok. Just report the links as is, and collect their revenue leaving it up to us to decide what is right and wrong.

Re:Not affect how skilled hackers get malware

[Impeesa]

Google doesn't provide access, it only indexes (wow, that sounds familiar), so the common carrier argument is totally unrelated. In this case, it's more like a phone book refusing to list crack dealers in the yellow pages, and requesting that people report any crack dealer listings that happen to slip in somehow.

Re:Not affect how skilled hackers get malware

[timmarhy]

why are you attempting to confuse the issue with common carrier status, because they are a search site, NOT an isp or teleco.

The whole legal liability of search results has been done to death already, google are totally in the right here.

Re:Not affect how skilled hackers get malware

[maxume]

You are being oddly pedantic; Google returns search results in what is essentially an arbitrary order; changing that order based on the presence of malware isn't filtering, at least not anymore than the initial search result is filtering.

And really, if you don't think that being able to advertise that their searches are 'safe' has the potential to effect revenue, I don't know where to start.

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

Personally, i feel that if they filter ONE item, EVER, then it blows the entire idea of them not being liable for future content. They really shouldn't be in the business of deciding what is ok and what isn't ok. Just report the links as is, and collect their revenue leaving it up to us to decide what is right and wrong.

Do you even understand the concept of a search engine? Please tell me what "content" Google provides. Also, wtf do you mean by "as is"? They wrote the search algorithm. So they should be held "liable" for changing their own algorithm???

Re:Not affect how skilled hackers get malware

[timmarhy]

no noob, the flaw in your logic is that google don't HAVE to list malware sites if they don't want to. it's their service, if what you are searching for (malware) isn't listed how is that a liability for them? Are you one of these people that think the internets is google?

Re:Not affect how skilled hackers get malware

[ozbird]

Not knowing how to spell/spell-check doesn't make you stupid. Ignorant, yes; stupid, not necessarily.

Re:Not affect how skilled hackers get malware

[nurb432]

No, they are company that must abide by local laws and international treaties. They can NOT just do whatever they feel like. Nor can you. You may think you can, but if you violate the law in doing 'what ever you feel like' you get tossed in jail ( if you get caught )

I will say it again, for the last time:. If they filter once, they should be liable for any future result. if they filter 'malware' results, but allow KP results, they should be put out of business. You cant selectively decide what you want to let thru then claim protection on the basis that you cant control illegal content.

its pretty black and white.

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

Funny you mention that, I just reported microsoft.com. How's that for massively cutting down the amount of malware?

Re:Not affect how skilled hackers get malware

[maxume]

Google already selectively decides what it wants to let through. They call it 'Pagerank'. I've heard dirty rumors that different people get different results for the same search, and that sometimes, the number of results printed on the result page doesn't match up with the actual number of results available. Also, I've heard that they have removed stuff based on DMCA takedown notices.

If you have a problem with Google doing this, you have a problem with what Google was doing yesterday.

Re:Not affect how skilled hackers get malware

[hedwards]

I will say it again, for the last time:. If they filter once, they should be liable for any future result. if they filter 'malware' results, but allow KP results, they should be put out of business. You cant selectively decide what you want to let thru then claim protection on the basis that you cant control illegal content. Why? Your argument makes abolutely no sense whatsoever. Of course they can filter one thing out, they could manually do it without any additional technolgy, by having a temp or intern manually typing in regexes. If they could be held liable for not getting all the kiddie porn off their results, they already would.

Regardless of your opinion, it is far easier to remove malware than it is to remove kiddie porn. For starters identifying kiddie porn requires in many instances knowing the age of the participants, while it is reasonable to assume that a 3 or 4 year old isn't 18, when you start talking about 14 or 15 year olds, it isn't necessarily an easy determination to make in large quantities. With malware, it is relatively straightforward to determine what if anything its doing. Some adult women are the same proportions as teenage girls.

The other thing is that there will always be malware, child porn and various other types of bad stuff on the net, the initiative here is to try and limit it. Google isn't going be able to stop linking to enough sites to stop it, but hopefully hit enough of them that people don't casually run into it.

Re:Not affect how skilled hackers get malware

[darkpixel2k]

As a public company they can drop any search results they disagree with...

I could give a shit about the windows malware that's out there. I don't run Windows and a good portion of my client base either doesn't run windows or doesn't have access to the net. But what I really wish google would fucking drop from their index is experts-exchange and tech-republic.

The last damn thing I want any of my search results to return is "Hey--here's the answer you're looking for. The solution is to...[PAY US FOR A FUCKING SUBSCRIPTION PLEASE]"

Re:Not affect how skilled hackers get malware

[lostfayth]

To add to your point, even the companies that produce pornography cannot tell sometimes.

I hate to give a wikipedia link, but I'm too lazy to find something better at the moment: http://en.wikipedia.org/wiki/Traci_Lords

Re:Not affect how skilled hackers get malware

[gniv]

The answers are there, in fact, but they are all the way at the bottom of the page. (I'm not condoning their behavior, just spreading the word).

For example, scroll down on this page: http://www.experts-exchange.com/Programming/Languages/Scripting/Shell/Batch/Q_22848900.html

Re:Not affect how skilled hackers get malware

[techno-vampire]

Yes, we're being asked to help protect noobs who don't know any better. It's just the same as protecting children who haven't learned better, or do you object to that too?

Re:Not affect how skilled hackers get malware

[DutchSter]

This isn't about that. Google already has a service that reports and detects sites that try to phish your personal information or try to install malware on your machine. No, this effort is to try to purge the Google index of sites that sell malware creation and deployment toolkits to black-hats. IMHO, the original poster is correct. This wouldn't make it much more difficult for script-kiddies and black-hats to get their hands on malware kits, while making it more difficult for white-hats to find information about these programs.

Not to drift too far off topic but I've never been very impressed with the Google phishing site service. On the one hand they say that solicit feedback from the user community as to what is a web forgery I don't know that they ever listen. I deal with phishing sites as part of my job and I've had situations where at least 10 or 12 customers have told us that they submitted the page to Google's Web Forgery report page but it never gets flagged. The only time I've ever seen them flag a site is when one of the major anti-phishing players classifies it as such. I've done some experiments where I've watched phishing sites stay online for a while. It seems that without fail within an hour of a major vendor like Symantec announcing the forgery Google will flag it. Otherwise users can spam the Google report link for a week and it'll never get flagged.

With this new service it makes me wonder if they have any plans to actually respond to user input or if the user input will be up only for good PR. Will all the accepted submissions come from professional security firms who have a vested interest in knowing about malware leaving your more casual security researcher unable to a) effectively report malware pages and b) learn about new threats once the big players have done their research and told Google to de-index the page.

Now I understand that if you get a report from Symantec the credibility is very high as opposed to web-based reports from anybody who can read squiggly letters in a box, but it does make me wonder if the public submission forms are just for show so people can feel like they're doing a good thing.

Re:Not affect how skilled hackers get malware

[calebt3]

Children might actually be willing to listen and learn. Some people can be quite dense and unyielding in subjects they are unfamiliar with. I'm fine with helping n00bs, but sometimes it is a long, uphill battle

Re:Not affect how skilled hackers get malware

[darkpixel2k]

Yeah--so I clicked on the 'Related Solutions' button and picked the first result--one about if statements in batch files.
It asks me to sign up to see the answer.

They have a few pages that are free, but most require a subscription.

Re:Not affect how skilled hackers get malware

[mikael]

Trying doing a google image search for "prayer beads", "brake pads" or "adsorption". None of these keywords will show up any pictures with Google because they both contain the substring "ads".

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

The CustomizeGoogle plugin for firefox lets you do exactly this (and many other useful things).

Re:Not affect how skilled hackers get malware

[nizcolas]

So why not just report the sites to Symantec?

Re:Not affect how skilled hackers get malware

[thePsychologist]

Don't like some of the search results? Create your custom google search page then. Just write up a quick page in HTML that posts to the google search form and then just add the string -whatever (google has domain specifiers) with the page. So when you type "pointers" in your page it will submit to the google search:

pointers -site:tech-republic, etc.

Not hard

Re:Not affect how skilled hackers get malware

[Albio]

Whenever I end up at Experts-Exchange, I've found that the bottom of the page contains replies and solutions.

[Question]
[HEY! BUY A SUBSCRIPTION!]
[scroll scroll scroll]
[Answers]

Re:Not affect how skilled hackers get malware

[cheater512]

Knowing Google, they will probably use a purely statistical analysis and user reports would be factored in.

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

Simply hit "Cached" - the reason google can index it is presumably because they allow the googlebot user agent through, so looking at the cache will show the answers. Alternativley you can figure out the string it allows, but even then they may have IP blocks of Googles asscioated.

YMMV

Re:Not affect how skilled hackers get malware

[SnowZero]

None of these keywords will show up any pictures with Google Yes they do.

Re:Not affect how skilled hackers get malware

[pipatron]

Is linking to something that is illegal, illegal?

Did you miss the raid on The Pirate Bay and Oink?

Re:Not affect how skilled hackers get malware

[PhireN]

You probably have a problem with your ad filter settings (adblock or whatever).
but don't feel bad, your not the only person, http://worsethanfailure.com/Articles/The_Great_Google_Banner_Ad_Conspiracy_.aspx

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

You can get access to experts-exchange by giving the right answer to some unresponded question.

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

What about the cookie DoubleClick uses? Hmm, i think Google need to be quite careful with how they define Malware.

Malware is software with malicious intentions. Since a cookie is a piece of data not a piece of software, it cannot be malware, no matter what the intention is.

Re:Not affect how skilled hackers get malware

[Angry Black Man]

They already filter many search strings related to finding credit card numbers or social security numbers. Search strings like:

"visa 4356000000000000..4356999999999999" ; which normally could be used to turn up a list of visa credit card numbers. Something similar can be done with social security numbers, although I dont remember the exact number range.

Re:Not affect how skilled hackers get malware

[mikael]

My mistake - our ad-blocker was set up to block all sites with *ads* in the string - that was supposed to block advert related sites, not syllable related images.

Re:Not affect how skilled hackers get malware

[rdebath]

It's a little more specific than that, the first page you go to from Google (referer id) will have the solution right at the end of the page. After that they've left a grubby little cookie on your machine which they use to screw with their pages.

This means they get around Google's rules about the page served to the googlebot must be the same as the one served to the users. Still if enough people complain Google may decide that they're still breaking the rules.

BTW: If you make your agent the googlebot and disable cookies for experts exchange you can see all the pages.

Re:Not affect how skilled hackers get malware

[penix1]

I see the point the OP is making though. He is making the slippery slope argument (not very effectively though) that once you filter for one item, the avalanche will tumble on you to filter any item made by any group.

Personally, I think they should have a similar rating system to /. not the page rank crap they currently have which is set by Google. Let the users decide if some link is crap and rate it as such and display the total score possible with user comment tags. I can't tell you how many times I hit dead links, keyword-whoring links, other search engine links, etc.. There is no filter like those that use the service.

Re:Not affect how skilled hackers get malware

[Web Goddess]

Mod parent dumb. Google a common carrier? heh.

Re:Not affect how skilled hackers get malware

[stephanruby]

But what I really wish google would fucking drop from their index is experts-exchange and tech-republic. The last damn thing I want any of my search results to return is "Hey--here's the answer you're looking for. The solution is to...[PAY US FOR A FUCKING SUBSCRIPTION PLEASE]"

I completely agree. Google has become lazy, or just too arrogant (just like Altavista had when Google started offering better results than it did). Try this CustomizeGoogle firefox extension. This little extension has saved me hours of frustration. And to the other posters, yes I realize the answer can often be found all the way at the bottom, but the answer is not always there and even if it was, it interrupts my flow of scanning multiple results at the same time when I scroll through my opened tabs.

If it wasn't for the CustomizeGoogle extension, I would have switched search engines long ago.

Re:Not affect how skilled hackers get malware

[falsified]

True, but why not just have Google refer all reported sites over to Symantec instead? Symantec probably gets fewer reports of these sites because reporting sites would involve wading through their app (Maybe the newer versions are better, but it always seemed odd that whatever sits in the system tray won't actually get you to anything administrative)

There's probably a way to report a site through symantec.com, but the site's also relatively hard to get into (compared to Google, I mean) if you're not planning on buying anything today.

Re:Not affect how skilled hackers get malware

[Anonymous Coward]

Why does everyone on /. bitch about expert's exchange? Use the Google cache and scroll to the bottom. The full fucking page is there, no need to buy anything.

Am I the ONLY person to figure this out? I figured it out when Expert Exchange started requiring payment and Google started offering the cache.

Jesus H Fucking Christ.

I think it's about malware in use not distribution

[Anonymous Coward]

Obviously hackers don't look for their tools on Google. But if regular people get to websites through Google's index, Google does not want them to get infected by web-borne malware.

That's not the point, you dolts!

[Wog]

'Most in search of malware for offensive use know the good stuff -- it ain't distributed through public Web ... It's distributed through dark Web servers, peer-to-peer networks, IRC channels, torrents and the like. Google's efforts will not affect how skilled hackers get access to malware.'

I imagine the idea is that people who are making (ahem) innocent searches will not be so prone to stumble across a malicious page with the latest unpatched IE/Firefox/Whatever exploit.

Re:That's not the point, you dolts!

[bagsc]

"Most in search of malware for offensive use know the good stuff"

For those of you native English speakers who also had to read this five times to understood what it meant, I shall clarify:

most - adj. Used here as a noun. Also used as an adverb.
search - v. Used here as a noun
offensive - adj. Noun if you read too much Iraq news like me.
use - v. Used here as a noun
good - adj. Typically used to describe desirable qualities for humanity. Used here to denote desirable qualities for bad people.

Three levels of prepositions in a clause - "in * of * for *" is confusing. So is using two present tense verbs, "use know," back to back.

You're welcome.

Re:That's not the point, you dolts!

[bladesjester]

Criticizing the sentence and then showing your lack of expertise in the language? :P

"Use" is not a verb in this sentence. Use as in "I have found a use for this" is a noun.

"Offensive" is used as an adjective describing "use"

"Good" is used to describe "stuff" and in this context it means "good at what it was meant to do". It isn't confusing at all.

It isn't three levels of prepositional phrases. It's three prepositional phrases back to back (which is also not uncommon). "in search" (preposition, object) "of malware" (preposition, object) "for offensive use" (preposition adjective object).

also

Most (people - understood. common in English)

You're welcome

Re:That's not the point, you dolts!

[Actually, I do RTFA]

I know someone already called you out on this, but incorrectly. Hence, I shall also attempt to explain:

• Most: A plural pronoun, in addition to an adjective.
• Search: In addition to a verb, a noun meaning the act of searching.
• Offensive: An adjective to describe "use" (see below).
• Use: Noun, a method of employing something. Ironically, Merriam-Webster lists this usage as more common than "use" as a verb.
• Good: Pejorative use of the adjective.

Also, apparently the nesting of prepositional phrases was confusing. "Use" was the end of the third prepositional phase (in addition to being a noun). If you are a native English speaker, my question is how many years did you spend reading and writing some other language before learning to communicate verbally?

Re:That's not the point, you dolts!

[Actually, I do RTFA]

You can see my response to the grandparent pointing out his errors, including "most" being a plural pronoun (not merely common venacular). However, the prepositional phrases, while not confusing in the slightest, were nested. "For offensive use" was clearly an adjective describing malware in "of malware". "Of malware for offensive use" is a prepositional phrase used as an adjective to describe the search in "in search". "In search of malware for offensive use" is a prepositional phrase used as an ajective to describe "most". There was no prepositional phrase "in search" or "of malware" in the sentence.

You can be an ass, but you have to be correct.

Re:That's not the point, you dolts!

[bladesjester]

Actually, "most" could be interpreted two ways. One is as a plural pronoun, however the other is as an adjective for the understood subject "people" (understood in the same way that "you" is in the sentence "Do the dishes"). Both would be acceptable.

Additionally, the prepositional phrases are not nested, and all three are indeed prepositional phrases. The first is used as an adjective, and the last two as adverbs. Prepositional phrases are categorized as a sequence of preposition [adjectives] subject.

I could repeat your advice about being an ass, but that would be tacky.

Re:That's not the point, you dolts!

[bladesjester]

preposition [adjectives] object rather.

(this is what I get for multitasking)

Re:That's not the point, you dolts!

[Actually, I do RTFA]

Actually, "most" could be interpreted two ways. One is as a plural pronoun, however the other is as an adjective for the understood subject "people" (understood in the same way that "you" is in the sentence "Do the dishes"). Both would be acceptable.

You only get an implied subject in your example because it is a command (most languages have a special conjugation for the command form of a verb, not so in English.) I am hard-pressed to think of an example of syntax that would allow you to modify this subject. There is no "implied subject" in normal usage. Instead, there is a pronoun that is acceptable.

The first is used as an adjective, and the last two as adverbs.

Let us examine this:

• Most in search of malware for offensive use know the good stuff.
• Most of malware for offensive use know the good stuff.
• Most in search for offensive use know the good stuff.
• Most for offensive use know the good stuff.

Yeah, that makes a lot of sense once we remove the phrases that the nested prepositional phrases modify.

And it would be tacky to call me incorrect when I'm not... </snide self-congratulations>

Re:That's not the point, you dolts!

[bladesjester]

The understood subject of "people" can exist because "Most" can be treated as an adjective in this instance. "Most" describes some group of things (depending on the subject of the sentence, it could have been people, puppies, killer robots, flying spaghetti monsters, etc etc etc). It isn't restricted to declarative sentences.

"Yeah, that makes a lot of sense once we remove the phrases that the nested prepositional phrases modify."

You really seem to be having a problem understanding the following.

1) A prepositional phrase is a group of words in the form of [preposition][optional adjectives][object]. The object comes last. In order for there to be nesting, it would have to be done *in the place where the adjectives are expected*.
2) There are 3 prepositional phrases.
2a) One is used as an adjective.
2b) Two are used as adverbs.
3) Adverbs describe verbs, adjectives, and other adverbs.
4) There is no nesting.

"Most in search of malware for offensive use know the good stuff."

Breaking the sentence down, you get the following

[subject] [prepositional phrase used as an adjective] [prepositional phrase used as an adverb] [prepositional phrase used as an adverb] [verb] [adjective] [object].

Now, treating the prepositional phrases as the part of speech they are used as, you get:

[subject] [adjective] [adverb] [adverb] [verb] [adjective] [object].

Taking the adjective out of the sentence leaves two adverbs that don't have a real use. It doesn't work even if prepositional phrases *weren't* involved. You're trying to prove an incorrect conclusion using an equally incorrect argument.

Your self-congratulations are misplaced.

Re:That's not the point, you dolts!

[bladesjester]

"isn't restricted to declarative sentences"

Commands rather. (Again multi-tasking bites me in the rear as I try to arrange thoughts).

While it's true that it's most common in commands, it is by no means restricted to them.

The article author and submitter aren't too bright

[sirwired]

The point of this is not to keep hackers from finding malware, it is to keep Google search users from getting infected through poisoned search results.

Duh.

SirWired

"will not affect how skilled hackers get access.."

[cynicsreport]

Obviously, by definition, skilled hackers can get the tools they need without google's help (or despite google's measures).
I think this is a great move by Google anyway. The hackers I find annoying are the 'script kiddies'; these kids (or immature adults) can too easily find programs that waste my bandwidth, hitting my server to find obvious holes, looking for very outdated software; in general, banging their heads against my firewall. If a 'real' hacker wants to waste his time, he could probably find some exploits even for updated and patched server software. But I know there are bigger fish to fry (ie banks, microsoft, cnn, etc).
While I do keep my software patched and updated, not everyone does. So, some kid can easily search google for a program to take advantage, without even knowing what he's doing. It's too easy; it's giving him the tools on a silver platter.

He appears to have misfired or gone way off course

[bogaboga]

Celebrated Google hacker Johnny Long thinks it's a good idea, though he told the site Internet News that he doesn't think it'll stop real hackers.

Who told Johnny Long that the purpose of this development was to "stop real hackers?" I am speculating now that one of the purposes of this development is to mitigate the damage these hackers create.

In my opinion, hackers are more like terrorists. They are motivated by sadism and determined at their craft.

Just malware?

[rhizome]

I'm not a religious man, but I pray for the day Google allows you to blacklist certain domains globally (for your cookie or login). Malware sites sure, but link farms and pay-forums and gopher indexes and yadda yadda clog up so much, I'm thinking this feature would be akin to a Do-Not-Call list for the web.

Re:Just malware?

[Feyr]

hell yeah! i'd blacklist that shit site called expert-exchange.com, it's ALWAYS in my search results

Re:Just malware?

[musakko]

Amen!! %#&%$%n' Expert-exchange is right up there every time I google any technical/coding problem, no matter how obscure..

Re:Just malware?

[lantastik]

You can already do this with your hosts file. Put the offending host in your hosts file and set the IP address to the loopback address or to 0.0.0.0. If you are talking about blacklisting from search results, now yes, that would awesome.

Re:Just malware?

[noidentity]

We could call this crap the malweb, and malwebsites. I get those so often in my searches I usually just give up.

Re:Just malware?

[nullbort]

The CustomizeGoogle extension for Firefox allows you to blacklist sites from search results.

Re:Just malware?

[rhizome]

Amen!! %#&%$%n' Expert-exchange is right up there every time I google any technical/coding problem, no matter how obscure..

Little-known fact: the experts-exchange answers are at the bottom of the page. They just insert those fake greyed out boxes to throw you off.

Re:Just malware?

[Feyr]

na they used to be available, but not anymore. you can't read the answers without paying

Re:Just malware?

[Anonymous Coward]

Little-known fact: the experts-exchange answers are at the bottom of the page. I wish people would stop saying that. EE changes this constantly. Sometimes you can see the answers at the bottom of the page. sometime you can't. Sometimes you can view the cached version of the page to get the answer sometimes you can't. Even when they do show you the answer, sometimes the next question you view you cannot see the answer unless you find the cookie that EE puts on your computer and delete it.

Re:Just malware?

[rhizome]

Yes, OK guys. I get it, it's not like that anymore.

Re:Dear Google,

[Anonymous Coward]

You forgot to mention, to type "free" anything, then click "I'm feeling lucky"... Boom - malware.

DTTP?

[BorgCopyeditor]

'Most in search of malware for offensive use know the good stuff -- it ain't distributed through public Web ... It's distributed through dark Web servers

Well, then, they should just block the ports typically associated with the DarkText Transfer Protocol.

Re:DTTP?

[BorgCopyeditor]

Or they could look for the directives commonly associated with DTTP and not found among HTTP's GET and POST, namely, PURLOIN and FOIST.

Assertive Action

[Anonymous Coward]

Google has just de-listed Windows Vista, per user advice.

Different goals

[kabloom]

I think Johnny Long and Google have different goals. I think Google wants to protect users from unsuspectingly visiting sites that will exploit browser bugs (i.e. the sites themselves are malware, no user would search for it explicitly), while Johnny Long thinks this is about preventing the spread of rootkits and the like (which people would search for explicitly).

What else is new?

[no-body]

Ghee - if you have the time and...

- get a phising email for your paypal account
- get a dubious email from your bank asking to reenter your credentials ....

don't you go to those sites and feed them expired credit card numbers, wrong information and then report them anyway?

It's great that Google provides resources for to accomodate reporting but hardly any exciting at all.

To get so worked up about it by branding it as inefficient or thinking the Big Brother tries to tell you what is right or wrong surely is an overreaction!

Just because "Google" is doing something. Get a life & give it a break!

don't stop with just malware

[Adult film producer]

let users flag all of those websites that only have indexes of other websites, link farms or whatever they're call... and please let me flag those "ask the expert" pages as spam.

Re:don't stop with just malware

[techno-vampire]

et users flag all of those websites that only have indexes of other websites...

Yes, and the moment they do that, all the trolls and script kiddies out there would be listing Google itself, because what is it except an index of other sites?

Re:don't stop with just malware

[AlXtreme]

But then Google wouldn't be able to show you all their Adwords on those websites (and the ones they link to).

Why do you think Google isn't doing anything against link-farming? Because they merely have to act ignorant and rake in the cash. Vote with your feet and use a different search engine (or meta-searchengine like clusty), diversity is good.

Who needs Google?

[PPH]

In Soviet Russia, plug an unprotected Windows system into the InterWeb and malware finds you!

Re:Who needs Google?

[FudRucker]

mod parent up!!! i can not count the time i was annoyed by URLs disguised as something else like a fake dictionary that is just a page full of spammed URLs or other similar deceptions...

Re:Who needs Google?

[Anonymous Coward]

no, no...too complex, keep it simple:

In Soviet Russia, malware reports YOU to Google!

Re:Who needs Google?

[FudRucker]

Oops http://it.slashdot.org/comments.pl?sid=376955&cid=21548151

really?

[Anonymous Coward]

RTFA.

As its main topic it addresses the infection of computers through websites found via Google searching. The discovery of malware by Google searching is added as an ancillary point. And I quote:

"Long thinks Google's new reporting initiative is a great idea.

'Google's had this unofficial 'do no evil' motto, and this effort supports that," Long told InternetNews.com. "Lots of browser-targeted intrusions originate from traditional Web surfing sessions, and most folks use Google as their Internet surfing origination point. A Google-based security wedge against malware is a terrific idea, and it should cut down the numbers of these types of infections significantly.' "

Perhaps the submitter chose a poor quote from the article...however the article itself is mostly on point and valid.

Generalized IP blacklisting

[drDugan]

What would be more helpful is if someone set up a distributed, fully automated IP address blacklist system and web servers and intrusion software could simply log IP address "hate" a-al a system like this http://savingtheinternetwithhate.com/

I'd love to be able to get a daily list of IP addresses that have been community-logged with reputations as having "bad behavior" (like worm propigation, scanning for website or ssh weaknesses, DOS attacks, open relays, etc) to feed to a firewalls, ssh and web server, etc. and drop their connection attempts to the floor. Efforts like this for spam and email have been fairly successful when done well, albeit sometimes controversial.

Such a project would be incredibly difficult to maintain, because crackers and others would attack it directly - yet could have a lot of value in stopping rouge behavior online.

Re:Generalized IP blacklisting

[mathfeel]

saving-the-internet-with-hate?? This is so going to get Dave Chapelle's "Playa Hater of the Year"...

Re:Generalized IP blacklisting

[pauhana]

PeerGuardian 2 is a fairly simple blocklist system: http://phoenixlabs.org/pg2/ and bluetack.co.uk has lists.

Re:Generalized IP blacklisting

[Anonymous Coward]

What's your problem against red?

ISR

[SeaFox]

In Soviet Russia, malware reports YOU!

Re:ISR

[Anonymous Coward]

We'll have this in Germany too: the Bundestrojaner, courtesy of Schäuble.

Ah, btw: for the second ref you might need the Google cache. Go figure.

Thanks, I'll be here all evening. Have some salmon.

and?

[thyrf]

I doubt google are trying to stop hackers getting at materials. What they are doing though, is stopping you average Mr. Joe Bloggs from being suckered in to download malware from a site found from a google search.

Small security firms?

[palegray.net]

I wonder if this system will affect listings in Google for small security firms who publish "proof of concept" demonstrations of new exploits. Could this lead to an unintentional (?) block of such firms' research products?

Re:Small security firms?

[checkitout]

I sincerely hope not. However, I suspect that if it's automated in any fashion, some sites will get wrongly tagged. The general public doesn't know the difference.

Re:Small security firms?

[Anonymous Coward]

I hope so... such sites lead to negative day exploits, where multiple black hat hacker groups gain knowledge of the exploit long before the appropriate entities can issue a patch. The patching authorities are therefore forced to rush a patch out before adequate testing, resulting in greater harm. Such small "security firms" do more harm than good to the computing environment.

Re:Small security firms?

[palegray.net]

If my guess is right, the scans are almost certain to be almost completely automated, at least for the "first stage." Then again, Google has some incredibly smart people working for them, and my hope is that secondary analysis of the results would prevent inappropriate blocking of benign sites.

Re:i am suprised

[Anonymous Coward]

or reported google for pawning off spyware as ads and free web apps?

Any improvement is good.

[palegray.net]

Quoth the poster: "Google's efforts will not affect how skilled hackers get access to malware."

It may not stop skilled crackers from gaining access to rootkit builders, trojan generators, etc, but if implemented properly it will definitely help identify sites actively hosting pages designed to exploit things like browser vulnerabilities to compromise user machines. Less fodder for the botnets is a good thing in my book.

Dear Google,

[iminplaya]

Sony, the RIAA, the MPAA, the FBI, the CIA, the NSA all produce malware. Please block access to their sites.

Re:Dear Google,

[Dunbal]

Not to mention Comcast. Sending RST commands at will is pretty much malware in my book.

Re:The article author and submitter aren't too bri

[Technician]

The point of this is not to keep hackers from finding malware, it is to keep Google search users from getting infected through poisoned search results.

Duh.

This is exactly what ScrubIT has been doing for a long time now. Instead of search results, it is DNS, which blocks malware sites. It has a function to submit sites to be added to the blacklist.

Many think ScrubIT as a filtered DNS service is just a porn filter to protect the kids. It's much more than that. It kills phishing and malware sites also. The only things it doesn't are sites that provide the IP address instead of using DNS. I've been very happy with it, except lately, it has had a couple outages. I'm on Comcast, so maybe they are blocking an alternate DNS server.

http://www.scrubit.com/

Does anyone else use ScrubIT and noticed any outages in the last couple weeks?

Full Disclosure

[checkitout]

I really fear for how this will affect full disclosure security sites. These sites are vital and used by security professionals world-wide.

Are they going to ignore sites safely hosting exploit code, or just those attempting to actively use it against the browser? Let's hope it's only the latter.

Re:whoever modded you up is retarted

[Anonymous Coward]

Do you mean "retarded" or "tarted up again?"

Dark Web Servers?

[hyperm0g]

Ooh sounds so scary!!

Re:Dark Web Servers?

[Anonymous Coward]

No, not scary.

"Dark Web Servers" usually refers to those servers that aren't indexed (see: robots.txt).

Most of the Malware sites I've seen are "Dark" in that they specifically tell search engines not to look for them.

Re:He appears to have misfired or gone way off cou

[DaveAtFraud]

In my opinion, hackers are more like terrorists. They are motivated by sadism and determined at their craft.

This may have been true some time ago. The folks who create and spread malware these days are motivated by simple greed. Botnets and such are big business. So is the information harvested from unsuspecting users through key loggers. Terrorists tend to be ideologically motivated regardless of whether the ideology is religion, politics or whatever.

Change the economics of web sites hosting malware and that infect unsuspecting users and the effort will go in a different direction. Consider the expense these people went to to create false results through Google by having a bunch of fake sites set up to point to the malware host. This isn't necessarily expense in the sense of money changing hands but more likely effort that was channelled to creating the falsified results. How many bots had to be created to get Google to point to the malware web host?

Cheers,
Dave

Gmail?

[Anonymous Coward]

What with all the spying it does it seems worthy of the malware title...

MOD PARENT UP

[crowbarsarefornerdyg]

I wholeheartedly agree with you, especially if it's a fairly obscure BSOD code and they're 2 of 10 results.

Comment removed

[account_deleted]

Comment removed based on user account deletion

So, MS fanboys, step right up! :-)

[Anonymous Coward]

Sorry, can't help you. I use linux...

Re:whoever modded you up is retarted

[calebt3]

Shut up or I will DDoS your city.

Terrorism and k1dd13 pr0n too?

[Anonymous Coward]

Are they going to drive terrorism-web-sites and kiddie porn sites off the public web too, or will they leave it up to The Law Of Darwin and its enforcers at Interpol to take care of these sites?

There are already systems like this.

[Animats]

McAfee's SiteAdvisor already looks for malware available from web pages, downloading everything that might be a threat and running it in a virtual Windows machine with Internet Explorer. SiteAdvisor does the work themselves; they're not trying to get people to work for them for free. Google already had something like that, although not as good. Allowing users to add to the machine-generated lists is useful, but not a big deal.

Besides, why work for Google for free? If you're going to report phishing sites, report them to PhishTank, where the list is open and free. Harmful software should be reported to StopBadware, which, again, has public data.

Remember Google's scheme for getting people to photograph businesses and send the pictures to Google? Whatever happened to that?

Re:He appears to have misfired or gone way off cou

[Anonymous Coward]

hackers are more like terrorists. They are motivated by sadism Yes, that's right, idiot. Mandela was motivated by sadism. The pIRA's campaign on the mainland was staged in the name of sadism. Attacks in the aftermath of the Boston Tea Party were arranged to satisfy sadist urges. Terrorism is a strategy, not an end; it's often adopted when your opponent's military is far stronger than your own and attacking it directly would lead to instant defeat.

Where your hackers are like terrorists is that both groups target unprepared "civilians" because it works. The above three campaigns, as part of larger battles, brought fairly successful conclusions for the terrorists. The attack in NY has led, via what could probably be described as the hoped-for response from the Dozing Giant, to a rise in violent Islamic fundamentalism - so that one appears on track too.

And, as with terror campaigns, no democracy has been successful at quashing hackers merely by hunting out individual perpetrators. You've got to deal with the set of circumstances that's producing the terrorists/hackers. In the hacker case, that's predominantly high-tech organised crime in ex-USSR and satellite states due to Yeltsin's legacy of corrupt government and workforce brimming with young, talented, unemployed men. You asked Mr. Gorbachev so politely to tear down this wall, he complied, now deal with what's spilled over from the other side.

(N.B. Paper beats stone, and dictionary beats jargon file. "Hackers" is the standard English term for what some people here call "crackers".)

No!

[bogaboga]

Terrorism is a strategy, not an end; it's often adopted when your opponent's military is far stronger than your own and attacking it directly would lead to instant defeat.

Terrorism as defined in the west, is not necessarily a strategy. It's fighting a "war" on your terms.

The west is right in saying that if the terrorists attacked directly, they would be defeated instantly but why would the west want the terrorists to attack directly - that is, on the west's terms?

As an opponent, I attack using a method that best suits me...a method that guarantees maximum headache to the adversary. That is what is at stake. You can call it terrorism but limit that to your definition not as a term that applies to every man, woman and child.

Re:I think it's about malware in use not distribut

[Dachannien]

Exactly. There was an incident this past week where numerous websites registered under the .cn TLD but hosted somewhere near Chicago were finding their way into many Google search results. The only purpose of the sites was to gain high pagerank and infect unfortunate clicker-onners with malware. The problem was discovered and reported by folks outside Google, so Google wants to make sure that people have a way to report such problems before they get out of hand.

Whether this is a losing battle or not is anybody's guess.

I know the largest malware site in the world

[Petronius]

it's at http://www.microsoft.com/

Re:Dear Google,

[Anonymous Coward]

damn, you're right

Killing the Servers - Not the Search Results

[Badmovies]

Stopping spurious search results is a good idea (I have mentioned scraper malware .cn domain sites before). However, a big problem is the hurdles you have to jump to shut down servers and home computers that are spewing spam and acting as a base of operations for malware. Say you find one, pin it down to the IP, then pin down the ISP/data center. Your next course of action is to submit a complaint to the abuse department. Then you wait for days. The server continues doing what it is doing. You submit another complaint, then place a phone call or login to the livechat for the provider. The person on the other end tells you to submit the complaint via the abuse email or webpage. "I have already done that, twice now." you tell them. "Well, that is what you need to do." comes back down the line. Finally, you give up - because trying to fix this issue is taking up too much time and the provider just doesn't care.

Filing a legitimate DMCA complaint actually works better than trying to shut down a malware server. I am talking about a provider in the US, but good providers in the UK and Europe seem to respond well to similar complaints. Within a few days, the infringing content is taken down. The reason is that there are laws saying a provider must take action to be protected. That I know of, nothing of the sort exists pertaining to malware/spam (if it does, nobody is paying attention). Good data centers and hosting companies will take action, but others could care less. Oh, and have fun trying to shut down a DSL/cable modem subscriber who is spewing spam.

Sooner or later, the Internet needs a watchdog group that can impose real penalties on ISPs that will force them to take action:

"This is WATCHDOG. I have a verified spam server in your data center at IP XXX.XXX.XXX.XXX. Please check the WATCHDOG website to verify and take action within the next 2 hours."
"Um, I don't know..."
"Failure to take action will result in your IP block being blacklisted until the server is taken offline."

Re:Dear Google,

[JewGold]

then click "I'm feeling lucky"

Should one consider that irony?

re: ...

[Adambomb]

CENTURION: What's this, then? 'Romanes Eunt Domus'? 'People called Romanes they go the house'?
BRIAN: It-- it says, 'Romans, go home'.
CENTURION: No, it doesn't. What's Latin for 'Roman'? Come on!
BRIAN: Aah!
CENTURION: Come on!
BRIAN: 'R-- Romanus'?
CENTURION: Goes like...?
BRIAN: 'Annus'?
CENTURION: Vocative plural of 'annus' is...?
BRIAN: Eh. 'Anni'?
CENTURION: 'Romani'. 'Eunt'? What is 'eunt'?
BRIAN: 'Go'. Let--
CENTURION: Conjugate the verb 'to go'.
BRIAN: Uh. 'Ire'. Uh, 'eo'. 'Is'. 'It'. 'Imus'. 'Itis'. 'Eunt'.
CENTURION: So 'eunt' is...?
BRIAN: Ah, huh, third person plural, uh, present indicative. Uh, 'they go'.
CENTURION: But 'Romans, go home' is an order, so you must use the...?
BRIAN: The... imperative!
CENTURION: Which is...?
BRIAN: Umm! Oh. Oh. Um, 'i'. 'I'!
CENTURION: How many Romans?
BRIAN: Ah! 'I'-- Plural. Plural. 'Ite'. 'Ite'.
CENTURION: 'Ite'.
BRIAN: Ah. Eh.
CENTURION: 'Domus'?
BRIAN: Eh.
CENTURION: Nominative?
BRIAN: Oh.
CENTURION: 'Go home'? This is motion towards. Isn't it, boy?
BRIAN: Ah. Ah, dative, sir! Ahh! No, not dative! Not the dative, sir! No! Ah! Oh, the... accusative! Accusative! Ah! 'Domum', sir! 'Ad domum'! Ah! Oooh! Ah!
CENTURION: Except that 'domus' takes the...?
BRIAN: The locative, sir!
CENTURION: Which is...?!
BRIAN: 'Domum'.
CENTURION: 'Domum'.
BRIAN: Aaah! Ah.
CENTURION: 'Um'. Understand?
BRIAN: Yes, sir.
CENTURION: Now, write it out a hundred times.
BRIAN: Yes, sir. Thank you, sir. Hail Caesar, sir.
CENTURION: Hail Caesar. If it's not done by sunrise, I'll cut your balls off.
BRIAN: Oh, thank you, sir. Thank you, sir. Hail Caesar and everything, sir! Oh. Mmm!

I have one for them...

[thekm]

http://www.microsoft.com/windows/products/windowsvista/default.mspx

From Chris Rock stand up...

[nerdyalien]

Once this massive exercise is done, when someone search for malware in google... suddenley a counselor shows up in the screen and say,

"Hey dork, don't download malware... download some pr0n"

Easy.

[crhylove]

If it's not open source, it's malware. If it is open source, it might still suck, though!

The death of a Giantoogle

[nbucking]

This censorship thing is going to bite them in the ass eventually. I mean why use a diluted source, when you can get a pure source else where? Some of us may want to find malware in order to experiment with it in order to get a better understanding.

Does this mean that in Soviet Russia....

[Anonymous Coward]

Google does NOT index you?

SiteAdvisor

[Lueseiseki]

I use McAfee SiteAdvisor, it's free and it warns you when you're headed to an malicious website and stuff.

re

[Endloser]

"Obviously hackers don't look for their tools on Google."

actually I believe that many hackers do find tools through Google...

Tools, active exploits, 0days, and much more can all be found just by searching for them. Try a search for "0day exploit". The second and third results (milw0rm and FrSIRT) are chock full of goodies.

If you have some time on your hands and run the right queries you can find forums that link to certain opensource bots. Mostly you can find SpyBot and RBot variants but there are some others out there.

As well, let me just mention that it is not hard to compile these and then make them undetectable to signature based AV's.

But the skilled hackers do know other avenues to get there malware. Many of them just develop there own from creating frankenstiens of legitimate applications.

Johnny Long - criminal intent

[Anonymous Coward]

Nice to see that the media likes to listen to such criminal punks as Johnny Long. Having had several websites defaced and redirected to his own website and others of a dubious nature I can only wonder if it's his methods for personal exposure at work, or some underline for plausible deniability.

Certainly not the best candiate for taking an opinion from on malware provention is someone who uses it themselves against others.

Please ignore

[Anonymous Coward]

I got annoyed at someone called atomikpsycho so it is time to send him to that website. I'd count him as malware :-)