Slashdot Mirror
Google To Send Detailed Info About Hacked Web Sites
alphadogg writes "In an effort to promote the 'general health of the Web,' Google will send Webmasters snippets of malicious code in the hopes of getting infected Web sites cleaned up faster. The new information will appear as part of Google's Webmaster Tools, a suite of tools that provide data about a Web site, such as site visits. 'We understand the frustration of Webmasters whose sites have been compromised without their knowledge and who discover that their site has been flagged,' wrote Lucas Ballard on Google's online security blog. To Webmasters who are registered with Google, the company will send them an email notifying them of suspicious content along with a list of the affected pages. They'll also be able to see part of the malicious code." Another of the new Webmaster Tools is Fetch as Googlebot, which shows you a page as Google's crawler sees it. This should allow Webmasters to see malicious code that bad guys have hidden on their sites via "cloaking," among other benefits.
This is a great service. Google should set up an opt-in email notification as well.
It helps the webmasters build better sites and teaches them to check the Google website tools that allow them to groom their site for best indexing on Google. That's great.
Help stamp out iliturcy.
Google has a malware hosting problem of their own.
Google Spreadsheets can be abused to create phony login pages. Here's one for "Free Habbo credits", designed to collect Habbo logins. It's been reported via the usual "Google abuse" mechanism, repeatedly, and it's still up. It's been up since October 28, 2008.
We track major domains being exploited by active phishing scams. ("Major" here means only that it's in Open Directory, with about 1.5 million domains.) There are 39 exploited domains today. Only 7 have been on that list since 2008. The most abused site is Piczo.com, which is a hosting service/social network/shopping site for teenagers.
Just about everybody else has cleaned up their act. 18 months ago, that list had 174 entries, including Yahoo, eBay, Microsoft Live, and TinyURL. All those companies have become more aggressive about checking for phishing scams that were injected into their domain. Google's cluelessness in this area ought to be embarrassing to someone.
If Google's determination on whether a site has malicious content is based solely on crawling it, wouldn't a hacker be able to manipulate robots.txt to ignore the file with the malware? These tools would allow a hacker to test that theory out, by trying different things on his own sites and seeing what generates an email, instead of waiting around for Google to re-crawl them and having to check each one to see if it is filtered...
Default Apache e-mail is webmaster@localhost
Oh please.
Doctors do things for the common good as well. That doesn't mean they don't have bills to pay.
Do you or your partner snore? - Visit www.snoring.com.au
Just for info: M$ was something started my Microsoft themselves in MS BASIC.
Also, fail.
If you wanted to test out malicious code to see whether it was likely to be discovered, wouldn't this be a great tool to have?
If the pattern goes 9am, 10am, 11am, why isn't noon 12am?
Registered webmasters (registration is free) of infected sites do not need to specially enable the feature -- they will find links to it on the Webmaster Tools dashboard.
Google does not charge for Webmaster Tools.
It's an opt-in notification system - nobody's forcing you to do anything. Also, robots.txt has been around since long before google.
This happened to my site and the google webmaster tools were helpful but frustrating, it took 2 weeks of my site being banned in all major browsers before they officially sanctioned it OK. It did give me a list of all the URLS where there was problems, so it wasn't too hard to debug.
my band is more brutal techno punk than yours
Another of the new Webmaster Tools is Fetch as Googlebot, which shows you a page as Google's crawler sees it.
Heh, could find some use outside of the designed purpose then... A number of pay-to-view web forums allow the Googlebot to freely navigate it, but requires payment from users. Among other boards, those involving erotica. :p
Beware: In C++, your friends can see your privates!
The notifications are opt-in. That's what I meant.
And it's not like it's hard to set up. You should be thankful robots.txt is obeyed by most robots.
So many wow accounts are hacked from keyloggers that are installed just by visiting wow sites. Gold vendors, wow auction houses, and simple forums can cause you to lose your wow accounts...
What would be nice if google could make these sites it detects with googlebot available so developers could patch the holes in firefox.
Hi Mr. Murdoch!
$-$-$-$hillll.....
Google is not playing police, they merely tell searchers it's a bad idea to go there. If you don't want others to link to you, don't go on the intarwebs. Also getting indexed by google is only possible if you sign up.
Yes it's terrible, you have to type in "User-agent: *\n Disallow / " I can feel you pain.
If you are that paranoid, cut your network cable. It will ensure that those pesky googlebots stay away from your precious data.
If you put your data on public website, others are free to read that data.
Company? what the...
You obviously have no idea about the early days of the internet and HTTP. The whole point of HTTP was to publish documents, if you host something you are implicitly allowing other people to fetch a copy of it.
robots.txt came about in the very early days of HTTP. An enterprising hacker wrote a crawler to index the whole internet (which wasn't that big at the time). But his crawler got stuck fetching pages from one machine with dynamically generated pages. This obviously tied up the bandwidth, CPU and disk IO of the server which annoyed it's owner. So the 2 people had a polite conversation via email and the opt-out robots.txt was invented.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
A number of pay-to-view web forums allow the Googlebot to freely navigate it, but requires payment from users. Among other boards, those involving erotica.
This sort of cloaking is frustrating even for people who aren't porn fans. A lot of scholarly journals spam search engine result pages with their cloaked, noarchived pages <cough>elsevier and springerlink</cough>. Even more frustrating is that Google provides no way for users 1. to exclude noarchived pages from its results or 2. to report sites that violate Google's stated cloaking policy.
Who wants this service from Google? Any company starting to act like an internet police is a huge risk in future if not now, and it should be preemtively rejected by users. If people rely on this kind of services in future Google will list its do-s and don't-s. I didn't ask about their service, nor I would like to be informed by their *unknown* ways of analyzing my pages. And no I don't want to host a useless piece of text called robots.txt to get rid of google crawlers. Why in the hell I should say get away, while if I don't it means I welcome them.
Take your shitty attitude and get the hell out of my internets.
You put it on the internet.
If it's on the internet, it's public. Don't put anything private on the internet. Don't expect anything private put on the internet to remain private.
Information wants to be free. If you don't want your information to be free, keep it to your god damn self!
Finally had enough. Come see us over at https://soylentnews.org/
A friend of mine works at Bluecoat ( http://www.bluecoat.com/ if you care...) (they do internet security and filtering services). He says they regularly send reports to Google when they find that Google is compromised with malicious code... so its good to know Google's taking part in helping fix a problem they certainly deal with.
http://www.beanleafpress.com
Normally I would agree, but a lot of websites are run without the advanced knowledge for finding these "broken" pages.
This is basically a free antivirus for your website that is less annoying because you do not even have to run it on your server. I am not a fan of Google, as a company, but they have the information to track and protect users (such as with the Malicious website warning in Firefox), so why not go the extra step and inform the most likely ignorant (of the issue) webmaster of the injected malware.
If it was an opt-in service, then most people would remain ignorant to the problems on their site, and the problems for web users would still persist. I prefer someone else was doing this, or that it was a separate service, but I am not going to complain about getting it as it could do a lot for helping to clean up the internet.
My site was once getting hit really hard from some other web site with a hole on their feedback page. I tried to email their webmaster but my message got flagged as spam. I guess including IP addresses, multiple links, phrases like "spam", "execute script", "spambot", and "exploit" aren't looked kindly upon by the internet powers that be. I just blocked any connections coming from their IP, but I wish I could have gotten through to shut down the security exploit.
Reviewing just the first hour of video games.
Phishing types are already preparing false communications and false sites with such warnings "from google". There are certainly many mechanisms in existence to help authenticate that a communication is actually from google. Hopefully the use of such mechanisms is clever enough to avoid more contamination.
All the diagnosis information and messages are presented through the Google Webmaster Tools UI, not through email. There is an option in Webmaster Tools to forward messages to email, but this is opt-in.
You have a point though...there are lots of "from google" false emails floating around. As you know it's a tough problem to solve :/
Google finally fixed this. The offending page now reads "We're sorry. You can't access this spreadsheet because it is in violation of our Terms of service. If you feel this is in error, please contact us."
Sometimes you just have to use a big clue stick to get their attention. It took some help from The Register to get Yahoo, Microsoft, and eBay to clean up their acts.
Five more long-term exploited sites remain. A bit more nagging, and we'll have this cleaned up.
Once this is cleaned up, phishing blacklists that blacklist entire second-level domains will be effective. No more just blacklisting the URL.