Slashdot Log In
Google Wants You to Report Malware
Posted by
Zonk
on Sat Dec 01, 2007 06:37 PM
from the there's-a-propaganda-poster-in-this dept.
from the there's-a-propaganda-poster-in-this dept.
darthcamaro writes "As part of its ongoing effort to keep a clean index Google is soliciting the help of web browsers to let them know when we find malware in the index. Celebrated Google hacker Johnny Long thinks it's a good idea, though he told the site Internet News that he doesn't think it'll stop real hackers. From the article: 'Most in search of malware for offensive use know the good stuff — it ain't distributed through public Web ... It's distributed through dark Web servers, peer-to-peer networks, IRC channels, torrents and the like. Google's efforts will not affect how skilled hackers get access to malware.'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Not affect how skilled hackers get malware (Score:3, Interesting)
Either they are a public company that should be considered a 'common carrier' or the aren't, which is it to be?
Re:Not affect how skilled hackers get malware (Score:4, Interesting)
Parent
Re:Not affect how skilled hackers get malware (Score:5, Interesting)
This isn't about that. Google already has a service that reports and detects sites that try to phish your personal information or try to install malware on your machine. No, this effort is to try to purge the Google index of sites that sell malware creation and deployment toolkits to black-hats. IMHO, the original poster is correct. This wouldn't make it much more difficult for script-kiddies and black-hats to get their hands on malware kits, while making it more difficult for white-hats to find information about these programs.
Parent
Re:Not affect how skilled hackers get malware (Score:4, Informative)
Not to drift too far off topic but I've never been very impressed with the Google phishing site service. On the one hand they say that solicit feedback from the user community as to what is a web forgery I don't know that they ever listen. I deal with phishing sites as part of my job and I've had situations where at least 10 or 12 customers have told us that they submitted the page to Google's Web Forgery report page but it never gets flagged. The only time I've ever seen them flag a site is when one of the major anti-phishing players classifies it as such. I've done some experiments where I've watched phishing sites stay online for a while. It seems that without fail within an hour of a major vendor like Symantec announcing the forgery Google will flag it. Otherwise users can spam the Google report link for a week and it'll never get flagged.
With this new service it makes me wonder if they have any plans to actually respond to user input or if the user input will be up only for good PR. Will all the accepted submissions come from professional security firms who have a vested interest in knowing about malware leaving your more casual security researcher unable to a) effectively report malware pages and b) learn about new threats once the big players have done their research and told Google to de-index the page.
Now I understand that if you get a report from Symantec the credibility is very high as opposed to web-based reports from anybody who can read squiggly letters in a box, but it does make me wonder if the public submission forms are just for show so people can feel like they're doing a good thing.
Parent
Re:Not affect how skilled hackers get malware (Score:5, Insightful)
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:2)
Cant have it both ways.
Re: (Score:2)
Re:Not affect how skilled hackers get malware (Score:4, Interesting)
Parent
Re: (Score:3, Insightful)
And really, if you don't think that being able to advertise that their searches are 'safe' has the potential to effect revenue, I don't know where to start.
Re: (Score:3, Insightful)
If you have a problem with Google doing this, you have a problem with what Google was doing yesterday.
Re:Not affect how skilled hackers get malware (Score:5, Interesting)
Regardless of your opinion, it is far easier to remove malware than it is to remove kiddie porn. For starters identifying kiddie porn requires in many instances knowing the age of the participants, while it is reasonable to assume that a 3 or 4 year old isn't 18, when you start talking about 14 or 15 year olds, it isn't necessarily an easy determination to make in large quantities. With malware, it is relatively straightforward to determine what if anything its doing. Some adult women are the same proportions as teenage girls.
The other thing is that there will always be malware, child porn and various other types of bad stuff on the net, the initiative here is to try and limit it. Google isn't going be able to stop linking to enough sites to stop it, but hopefully hit enough of them that people don't casually run into it.
Parent
Re:Not affect how skilled hackers get malware (Score:5, Insightful)
I could give a shit about the windows malware that's out there. I don't run Windows and a good portion of my client base either doesn't run windows or doesn't have access to the net. But what I really wish google would fucking drop from their index is experts-exchange and tech-republic.
The last damn thing I want any of my search results to return is "Hey--here's the answer you're looking for. The solution is to...[PAY US FOR A FUCKING SUBSCRIPTION PLEASE]"
Parent
Re: (Score:3, Interesting)
None of these keywords will show up any pictures with Google
Yes [google.com] they [google.com] do [google.com].
I think it's about malware in use not distribution (Score:5, Informative)
That's not the point, you dolts! (Score:5, Informative)
I imagine the idea is that people who are making (ahem) innocent searches will not be so prone to stumble across a malicious page with the latest unpatched IE/Firefox/Whatever exploit.
Re: (Score:2, Troll)
"Use" is not a verb in this sentence. Use as in "I have found a use for this" is a noun.
"Offensive" is used as an adjective describing "use"
"Good" is used to describe "stuff" and in this context it means "good at what it was meant to do". It isn't confusing at all.
It isn't three levels of prepositional phrases. It's three prepositional phrases back to back (which is also not uncommon). "in search" (preposition, object) "
Re: (Score:2)
You can see my response to the grandparent pointing out his errors, including "most" being a plural pronoun (not merely common venacular). However, the prepositional phrases, while not confusing in the slightest, were nested. "For offensive use" was clearly an adjective describing malware in "of malware". "Of malware for offensive use" is a prepositional phrase used as an adjective to describe the search in "in search". "In search of malware for offensive use" is a prepositional phrase used as an ajecti
Re: (Score:2)
Additionally, the prepositional phrases are not nested, and all three are indeed prepositional phrases. The first is used as an adjective, and the last two as adverbs. Prepositional phrases are categorized as a sequence of preposition [adjectives] subject.
I
Re: (Score:2)
(this is what I get for multitasking)
Re: (Score:2)
I know someone already called you out on this, but incorrectly. Hence, I shall also attempt to explain:
Also, apparently the nesting of prepositional phrases was conf
The article author and submitter aren't too bright (Score:5, Informative)
Duh.
SirWired
Re:The article author and submitter aren't too bri (Score:2)
Duh.
This is exactly what ScrubIT has been doing for a long time now. Instead of search results, it is DNS, which blocks malware sites. It has a function to submit sites to be added to the blacklist.
Many think ScrubIT as a filtered DNS service is just a porn filter to protect the kids. It's much more than that. It kills phishing and malware sites also. Th
"will not affect how skilled hackers get access.." (Score:2, Insightful)
I think this is a great move by Google anyway. The hackers I find annoying are the 'script kiddies'; these kids (or immature adults) can too easily find programs that waste my bandwidth, hitting my server to find obvious holes, looking for very outdated software; in general, banging their heads against my firewall. If a 'real' hacker wants to waste his time, he could probably find som
He appears to have misfired or gone way off course (Score:2)
Who told Johnny Long that the purpose of this development was to "stop real hackers?" I am speculating now that one of the purposes of this development is to mitigate the damage these hackers create.
In my opinion, hackers are more like terrorists. They are motivated by sadism and determined at their craft.
Re:He appears to have misfired or gone way off cou (Score:3, Informative)
This may have been true some time ago. The folks who create and spread malware these days are motivated by simple greed. Botnets and such are big business. So is the information harvested from unsuspecting users through key loggers. Terrorists tend to be ideologically motivated regardless of whether the ideology is religion, politics or whatever.
Change the economics of web sites hosting malwar
No! (Score:2)
Terrorism is a strategy, not an end; it's often adopted when your opponent's military is far stronger than your own and attacking it directly would lead to instant defeat.
Terrorism as defined in the west, is not necessarily a strategy. It's fighting a "war" on your terms.
The west is right in saying that if the terrorists attacked directly, they would be defeated instantly but why would the west want the terrorists to attack directly - that is, on the west's terms?
As an opponent, I attack using a method that best suits me...a method that guarantees maximum headache to the adversary. That is what is at stake. You can call it terrorism but limit that to your definition not
Just malware? (Score:4, Interesting)
Re: (Score:2)
Re: (Score:2)
Little-known fact: the experts-exchange answers are at the bottom of the page. They just insert those fake greyed out boxes to throw you off.
Re: (Score:2, Informative)
DTTP? (Score:5, Funny)
'Most in search of malware for offensive use know the good stuff -- it ain't distributed through public Web ... It's distributed through dark Web servers
Well, then, they should just block the ports typically associated with the DarkText Transfer Protocol.
Different goals (Score:2)
What else is new? (Score:2)
- get a phising email for your paypal account
- get a dubious email from your bank asking to reenter your credentials
don't you go to those sites and feed them expired credit card numbers, wrong information and then report them anyway?
It's great that Google provides resources for to accomodate reporting but hardly any exciting at all.
To get so worked up about it by branding it as inefficient or thinking the Big Brother tries to tell you what is right or wrong surely is
don't stop with just malware (Score:4, Insightful)
Re: (Score:2)
Yes, and the moment they do that, all the trolls and script kiddies out there would be listing Google itself, because what is it except an index of other sites?
Re: (Score:3, Interesting)
Why do you think Google isn't doing anything against link-farming? Because they merely have to act ignorant and rake in the cash. Vote with your feet and use a different search engine (or meta-searchengine like clusty), diversity is good.
Generalized IP blacklisting (Score:2)
I'd love to be able to get a daily list of IP addresses that have been community-logged with reputations as having "bad behavior" (like worm propigation, scanning for website or ssh weaknesses, DOS attacks, open relays, etc) to feed to a firewalls, ssh and web server, e
ISR (Score:2)
Small security firms? (Score:2)
Re: (Score:2)
Re: (Score:2)
Any improvement is good. (Score:2)
It may not stop skilled crackers from gaining access to rootkit builders, trojan generators, etc, but if implemented properly it will definitely help identify sites actively hosting pages designed to exploit things like browser vulnerabilities to compromise user machines. Less fodder for the botnets is a good thing in my book.
Dear Google, (Score:4, Insightful)
Re: (Score:2)
Full Disclosure (Score:2)
Are they going to ignore sites safely hosting exploit code, or just those attempting to actively use it against the browser? Let's hope it's only the latter.
There are already systems like this. (Score:2)
McAfee's SiteAdvisor [siteadvisor.com] already looks for malware available from web pages, downloading everything that might be a threat and running it in a virtual Windows machine with Internet Explorer. SiteAdvisor does the work themselves; they're not trying to get people to work for them for free. Google already had something like that, although not as good. Allowing users to add to the machine-generated lists is useful, but not a big deal.
Besides, why work for Google for free? If you're going to report phishing si
Re: (Score:3, Funny)