Slashdot Mirror
Inside Google's Anti-Malware Operation
Trailrunner7 writes "A Google malware researcher gave a rare peek inside the company's massive anti-malware and anti-phishing efforts at the SecTor conference here, and the data the company has gathered shows that the attackers who make it their business to infect sites and exploit users are adapting their tactics very quickly and creatively to combat the efforts of Google and others. While Google is still a relative newcomer to the public security scene, the company has deployed a number of services and technologies recently that are designed to identify phishing sites, as well as sites serving malware, and prevent users from finding them. The tools include the Google SafeBrowsing API and a handful of services that are available to help site owners and network administrators find and eliminate malware and the attendant bugs from their sites. Fabrice Jaubert, of Google's anti-malware team, said the company has had good luck identifying and weeding out malicious sites of late. Still, as much as 1.5 percent of all search result pages on Google include links to at least one malware-distribution site, he said."
Seriously, don't. I learned my lesson the hard way :/
I like this approach and also as usual, they offer you a way to go "there" anyway which saves you from false positives, never seen one though.
Also I like the alerts in the Webmaster tools as they send you an e-mail if you site gets infected, never happened to me but pretty sure is a good tool when you handle a lot of sites. I mean, how many webmasters actively run malware tools in their website?
TFA: "...Google uses a huge number of virtual machines running completely unpatched versions of Windows and Internet Explorer that they point at potentially malicious URLs." ouch.
I'm sure the hardware behind this site is much less complex than the google operation and yet fights malware better. Just another example of the huge costs that Windows shitty security is putting on the rest of computing world. Why won't that joke of an OS die already?
Monstar L
..to the actual slides, position paper, video, or whatever, so we can get some of the meat?
"To find malware-distribution sites, Google uses a huge number of virtual machines running completely unpatched versions of Windows and Internet Explorer that they point at potentially malicious URLs."
If I were a MS employee, that sentence would make me cringe with shame.
Yandex (the leading Russian search engine) uses this approach to mark infected pages officially since March 2010. Prooflink (in Russian): http://company.yandex.ru/news/press_releases/2010/0301/index.xml . So, Google is not the first to announce this strategy.
I can still find microsoft.com :(
"Still, as much as 1.5 percent of all search result pages on Google include links to at least one malware-distribution site, he said."
If they get good enough at finding malware, malware writers will have no choice but build custom targeted attacks that work against them.
ics
From TFA:
"We don't understand all the details of this. We focus on the technical," Jaubert said. "There's monetization aspects that we don't have visibility into."
1. Set up VMs to collect malware data
2. Focus on the technical details
3. ???
4. Profit!!
I don't get spam in gmail (it's all in the spam folder) and Google protects me from getting malware. Am I to presume that since they know so much that they are the ones creating the world's spam and malware? dun dun dunn~
Because only Google should be able to collect and process an unholy amount of information about you, the average Internet user, without your (informed) consent.
Google logs and tracking cookies are, in terms of aggregate harm, the most harmful things you'll enjoy when browsing the web.
And do they run FF, Chrome, Opera, etc. looking for vulns in them as well? Can you imagine what would happen if this "huge number of virtual machines" actually got pwned? Now there's a massive spambot or DDOS! Would google spam-block its self?
Chaos maximizes locally around me.
Or it is just a social service :-/
This suggests that Google will actively filter out sites that spread malware or are phishing? I'm sure Google will do a fine job at it and odds are I would leave such a feature on, but shouldn't there be an option to turn it off? I would feel way better about a search engine if I knew I could turn all its censoring features off. It's the same with SafeSearch, I have it turned to moderate, but I like the fact that I can opt to turn it off.
That a google search for malwarebytes has AntiMalwre Pro (see http://www.2-spyware.com/remove-antimalware-pro.html) as the top, sponsored hit.
Start worrying
I wonder Google does not have some simple way for those of us who are savvy enough to recognise span or malware sites to indicate so in the search results. Those results so indicated could be have their page ranking reduced or be hidden until they were checked.
I realize this could be abused and have no idea what the signal to noise ratio would be but it would be interesting to see how this worked..
N.B. this user is far too lazy to write a witty and intelligent sig.
doing what Microsoft should be doing!!
What we need is a google proxy to surf through that would automatically strip malware.
What could go wrong?
Seriously, this Flash / Adobe stuff is crazy. Just browsing a mainstream site with bad adverts can compromise your box these days.
To find malware-distribution sites, Google uses a huge number of virtual machines running completely unpatched versions of Windows and Internet Explorer that they point at potentially malicious URLs.
Windows IS useful! Time to go cash in on some bets.
I bet you were expecting a goatse link here (obvious or disguised). Sorry to disappoint.
...making sure that the infrastructure for malware is friendly & thriving:
Argh.
I've got a buddy from Bluecoat. They regularly search for these sites, and he says their company regularly reports malware sites to Google. He said there was a time when their software blocked Google because it wouldn't clean up its act. Things have changed.
http://www.beanleafpress.com
I sincerely hope Google continues to improve its services in a similar fashion. Although I know Google is funded primarily by advertisement fees, it certainly feels like I'm getting something great for free. I just hope that Google continues to receive heavy competition on all fronts, preventing them from ever achieving a complete monopoly. Lack of competition is the enemy of innovation.
Do your browsing from a Ubuntu Live USB device. Lubuntu is a lighter desktop then either KDE or Gnome ..
Insert excuses why not to here:
As this click-and-get-infected malware runs on Windows, what's the annual balance-sheet liability to businesses from Microsoft Malware.
"every Linux customer basically has an undisclosed balance-sheet liability", Steve Ballmer link
From the article:
It would be nice if people would call this stuff Windows malware if it does not do anything to normal computers. Please Call out Windows, people.
Friends don't help friends install M$ junk.
i think google has to work on get rid of the huge amount of false positives. i remember at one point even opengl.org was blacklisted
This is all nice and great, but it is quite pathetic that they can't fix all the spam in Google gropus, and isn't like it is rocket science, when exactly the same message with the same spam-link gets posed to hundreds of groups.
"When in doubt, use brute force." Ken Thompson
I find it ironic that at the end of this article on sneaky web malware, there is a link to email a shortened URL.
There's been considerable improvement. Google still has some holes in dealing with "malware", phishing, etc. But these are mostly obscure tricks used to get around Google's malware reporting. You can report the sites below over and over, but nothing happens, because Google's reporting system doesn't understand that these Google features are exploitable.
I'm pleased to notice that, at last, Google is no longer running ads for software for spamming Craigslist. Search for "craigslist auto poster tool". There used to be ads for programs for spamming Craigslist, and some of them even accepted payment through Google Checkout. (That last could lead to legal problems, since Google was not only advertising an legally questionable product, but taking a cut of the revenue.) That seems to have stopped. There are still ads for offshored services which manually spam Craigslist.
Got Seals? SAS? or other retired special services men and women? It seems like they are a solution looking for a problem. It's hard to write malicious code with broken fingers, hands and arms. Oh wait, my bad for wanting to hurt the bad guys, because destroying peoples data and life histories are really just playful hi jinx.
User maintains more than a dozen sockpuppet accounts on Slashdot.
If you want something done right...? :) Hey, let me know too.
"Those who consume the bulk of goods are those who make them. We must never forget this secret of our prosperity."