Slashdot Log In
Google Goofs On Firefox's Anti-Phishing List
Posted by
timothy
on Sun Sep 21, 2008 02:13 PM
from the unless-you-like-it-that-way dept.
from the unless-you-like-it-that-way dept.
Stephen writes "While phishing is a problem, giving one company the power to block any site that it wishes at the browser level never seemed like a good idea. Today Google blocked a host of legitimate web sites by listing mine.nu. mine.nu is available as a dynamic dns domain and anybody can claim a sub domain. All sub-domains are blocked regardless of whether phishing actually occurs on the sub-domain or not. Several Linux enthusiast sites are caught up in the net including Hostfile Ad Blocking and Berry Linux Bootable CD."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Good idea? (Score:5, Interesting)
While phishing is a problem, giving one company the power to block any site that it wishes at the browser level never seemed like a good idea
Actually, giving a single company this kind of authority is usually not a bad idea. Spamhaus and email, for example.
The issue is about trust. Even with this goofup, I trust google ( although their response to this could change that ). Hell, I trust MS here too, to a limited extent.
Re:Trust (Score:5, Insightful)
Parent
Re:Trust (Score:5, Insightful)
We need to educate users to check the URL before entering anything. Any time you rely on a technological solution to a social problem you end up with woes.
Parent
Re:Trust (Score:5, Insightful)
It's just not going to happen. We like to think that "everyone" is capable of understanding what is going on when they browse the web, but that's wishful thinking.
It will be a LONG time until you can ever hope that the general public is as smart as the malicious few out there. Until then technology solutions will continue to be needed, desired and our best bet in combating this. Hell, they always will.
Parent
Re: (Score:2)
My position is that dynamic DNS services have nothing to do with phishing and scamming. Since either way, the URL is phony, there's not much practical difference between running a fake hotmail site at http://h0tm4il.mine.ru/ [h0tm4il.mine.ru] rather than at http://24.64.197.48./ [64.197.48] There aren't many people out there who would be fooled by one but not the other.
Re: (Score:3, Funny)
Re: (Score:2)
Re:Trust (Score:5, Insightful)
I just had that driven home for me the other day. In my off time, I am a youth soccer coach. The website for our league has been fine for several years. Last week I visited it and got the malware warning from FireFox. I checked with the webmaster and sure enough, they had gotten hit with a SQL injection attack and had indeed gotten malware of some sort hosted on the site.
So, FWT may be a false positive - but it is at leat possible that they also got successfully attacked.
We really don't have a good system to evaluate trust on the fly due to the dynamic nature of internet content. A page that was fine 20 minutes ago may attack you now.
Parent
Re: (Score:2)
Actually, giving a single company this kind of authority is usually not a bad idea. Spamhaus and email, for example.
I respectfully disagree. Giving a single, unaccountable group the effective power to completely kill some domain's e-mail is a bad idea, too. It's far too easy to game any one blacklist, and it's far too hard to get a domain that was added incorrectly (or that has been taken over by someone new who has no connection to the previous registrant) removed from the list again. I don't believe any sysadmin worth their salt filters based only on input from a single blacklist.
Get a real domain then. (Score:5, Insightful)
Granted, I can see there are opportunities for abuse here, but if the owners of dynamic dns domains don't properly police their "customers" and spammers and/or other malicious websites start using it, then Google has every right to blacklist the entire domain. Of course, it's arguable exactly how much can be done to prevent it, but if you're really concerned about not getting your site blocked, go ahead and blow the $7 a year on your own domain, or use a smaller ddns service that can actually pay attention to the nature of the hosts it's serving.
As far as having any one third party responsible for maintaining a blacklist, exactly how else do you intend to do it? You can always create your own blacklist, but that would first require you to "enjoy" the sites you would prefer get blocked automatically. You'll just have to trust someone to make that reasonable decision for you. Sure, there will be some mistakes, but that's the price you pay for protection.
-Restil
Re:Get a real domain then. (Score:4, Interesting)
Countries have been banned from sites, email, IRC channels and so on with this argument.
Just so you know, some ISPs have defacto monopolies in their countries, and everyone there get the same domain. Any idiot that say 'let ban *.il, or *.es, because I got 10 spam messages from there' should be fired on the spot.
In fact, if he works at google whoever hired him should be fired, too.
Parent
Re:Get a real domain then. (Score:5, Informative)
I don't get why you are getting annoyed that I (and probably many others) do things like this?
Parent
Re: (Score:2)
Until you happen to admin a major mail provider I couldn't care less.
Re: (Score:3, Informative)
Sorry dude. I block whole netblocks that I/we don't have any business with, and that fill up my logs with annoying connection attempts, and portscans, etc. I'll show you my method for blocking about 80% of probes, scans, password guessing bots, etc:
I don't get why you are getting annoyed that I (and probably many others) do things like this?
Your rule blocks most Australian IP addresses, for starters.
Re: (Score:3, Informative)
Well...
wget -o /dev/null -O - http://www.iana.org/assignments/ipv4-address-space/ [iana.org]
He's asking IANA for the netblocks... (click the link to see what does get returned)
grep whois.apnic.net
administerd by APNIC (Asia-Pacific)
grep ALLOCATED
currently in use (not legacy ones)
cut -d " " -f 1
culling everything from each line except the IP/mask (the first item)
xargs
and strips the carriage ret
Split it off (Score:2)
If people thing this is a useful service, split it off, or ask someone like Spamhaus to do it,and add it some more checks and balances.
Better yet, release the code to the web service, and allow any sysadmin to host the server side portion themselves, of course with the ability to update from a central list, and accept 0% - 100% of a given list as they see fit.
I hate that Google can do this (Score:4, Informative)
In my mind giving this power to Google is the most objectionable thing related to the company. I know somebody who has had his legitimate business ruined because Google mistakenly added his site to this list. Why? Because it was hosted on the same physical server as a truly objectionable web site.
People need to stop childishly sneering at Windows users and take their focus away from Microsoft. The terrible Goliath is clearly Google now. Even when it's not being evil it causes trouble just by being *clumsy*.
Re:I hate that Google can do this (Score:4, Insightful)
Google doesn't filter based on IP addresses, but hostnames and URLs.
If you don't like it, don't use it. It's not like you don't have any alternatives.
Parent
Re:I hate that Google can do this (Score:4, Insightful)
What? How can you misunderstand everything quite so much?
No, Google doesn't filter by IP address. But because the site was hosted on the same server as a bad site it added a URL block for the innocent too. Do you see?
Secondly, the issue isn't about me using Firefox/Google. It's about customers who did and were told that the site they had browsed to was malicious. The business lost a valuable customer this way and folded.
Parent
Re:I hate that Google can do this (Score:4, Insightful)
Doesn't sound like a very professional business if it was using the same domain that the bad site was on. Considering one can get a .com for 6USD a year, there really is no excuse.
This company obviously wasn't doing very well to begin with, or did things properly to begin with either - This is not surprising.
You are not going to convince me that they couldn't of done anything to change the outcome, even when they became aware of the situation.
What I do find interesting is the fact you claim Google did this, when the anti-phishing filter in the most popular browser, IE is ran by Microsoft. The most popular search engine is Yahoo! - which does not using any phishing data from Google.
Parent
Re: (Score:2)
But how can what you're saying be true if Google blocks by domain name, not IP address? Why would Google care whether your friend's site was on the same physical server if it doesn't look at IP addresses and your friend's site had its own domain?
Re: (Score:3, Informative)
I would assume the original AC is lying because Google's practices on filtering bad sites were disclosed long ago on http://www.stopbadware.org/ [stopbadware.org]
Re: (Score:2)
Google does not match by IP addresses and in this case, this would be the only way they could 'detect' the same site being used on the same machine.
No.
Re: (Score:2)
A attack on my character, how sweet of you.
Incorrect, a site was flagged by some users as being "bad".
After Google confirms this, they would of added /A/ URL to the blocklist, be it some wildcard matching or such. Such as they did with mine.nu. where they blacklisted "http*://*.mine.nu/*" - Impossible to bl
Re: (Score:2)
Again, Google does not filter by IP addresses. Which, as the mentioned comment describes, is the only way for one to identify it being on the same machine. This does not invalidate anything I have said so far.
I suspect you knew you
Re: (Score:2, Redundant)
I don't take any credence from a brand new Slashdot account. I know it's you, Mr. AC.
http://d.furaffinity.net/art/pinkuh/1190
Re: (Score:2)
On a shared host it is not uncommon to have multiple domain names resolving to the same IP Address. Most web servers, like Apache, can be configured to run multiple domains. Many hosts will not give you a unique IP unless you pay extra or buy space on some variant of dedicated servers. Yahoo's [yahoo.com] hosting service, for example, does not appear to advertise a unique IP. Reseller hosting is pretty much guaranteed not to give you a unique IP.
Regardless of whether the IPs were unique however, Google could still tie
first time (Score:5, Interesting)
Re: (Score:2)
What makes you think that Google will change their minds? They have automated the collection of information.
Google information for jumpbump.mine.nu:
"Of the 4329 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 09/21/2008, and suspicious content was never found on this site within the past 90 days.
Malicious software includes 7523 scripting exploit(s), 2911 trojan(s). S
Everybody makes mistakes, false positives (Score:5, Insightful)
Any maintained blacklist of any reasonable size is going to end up with false positives. It's one of those things you just have to accept. People notice and report it, the entry gets removed, and we move on.
Re: (Score:2, Informative)
Any maintained blacklist of any reasonable size is going to end up with false positives. It's one of those things you just have to accept. People notice and report it, the entry gets removed, and we move on.
*If* the entry gets removed.
Anti-Phishing makes Firefox slow (Score:4, Interesting)
Note that the anti-phishing feature makes Firefox slow [opensuse.org] over time.
This was a dumb idea anyway (Score:5, Interesting)
Putting anti-phishing filters into browsers just shifts the responsibility of good security practices from the user to some blacklisting company. What incentive is there to be weary about suspicious sites if you can count on the almighty Google to hold your hand while you browse the Web? This makes about as much sense as someone installing parental controls in their machine and declaring that their Internet connection is now "kid-friendly."
I've never had these filters turned on, and I've never exposed my financial data to others by accident. Usually this has something to do with me hovering the mouse over links and checking the URL in the status bar.
Some pain needs to be applied (Score:5, Interesting)
If you're serious about blocking phishing sites, you have to accept some collateral damage. Blocking by URL stopped working last year; most attacks have unique URLs now. Many have unique subdomains. So you have to block at the second-level domain level to be effective.
We publish a list of major domains being exploited by phishing scams. [sitetruth.com] Today, there are 46 domains listed. eBay, for example, is on the list, because eBay has an open redirector exploit. [ebay.com] Click on that URL. It says "ebay.com", right? It looks like eBay, right? It's not.
On the other hand, "tinyurl.com", which used to be popular with phishers, has been able to get off the blacklist by cracking down on misuse of their service. It's possible to do redirection competently.
When we started our list last year, it had about 175 exploited domains. After some serious nagging and an article in The Register, we're down to 46. And only 11 have been on the list for more than three months; the others come and go as exploits are reported and holes plugged. So this is a problem that can be solved.
I'm glad to see Google taking a hard line on this. It's necessary that sites that do redirection feel the pain when they accept redirects to hostile sites. Google can apply much more pain that we can. Few sites will want to be on Google's blacklist for long.
Firefox's anti-* shouldn't be enabled by default (Score:5, Interesting)
This is something that strikes me as the first time Firefox really pushed something out by default that shouldn't be. Just for one example, people who are on LTSP networks, say, 200 users, will ALL download anti-phishing, anti-malware blacklists from Google, each in their own home directory. There's no way that I know of, anyway, to share this data - SQLite seems to make it impossible. That's the first mistake in creating a compatible, light web browser.
The second mistake is enabling website blocking based on 3rd party blacklists by default. This is basically Microsoft UI thinking - "You *need* this because you don't know any better." Screw that. I mean, make it a checkbox on setup - "Use Google-provided anti-malware blacklists" Simple as that. I spent weeks trying to find out why, after just a few Firefox instances were launched on an LTSP server, none more would load - part of this was because every user logging in was trying to download the anti-malware stuff from Google, saturating the line, and preventing Firefox from loading for the first time.
I hope the Firefox devs will take all scenarios into account when making changes. It seems lame that every user needs all of the stuff in places.sqlite. And even if you argue with that, at the LEAST make it cross-DB compatible, so you can put everyone's in a nice big central MySQL database.
Re: (Score:3, Insightful)
"There's no way that I know of, anyway, to share this data - SQLite seems to make it impossible."
Well, I doubt it's SQLite that makes it impossible, it's more that you don't want ordinary users writing to a single shared blacklist. Because if a user can download and write good data to it, they can write bad data to it.
Suddenly all it takes is for one user to click on the dancing bunnies, and they're running a daemon without knowing it that writes bad data to the blacklist, monitors the list for changes, and
Never ascribe to malice ... (Score:4, Insightful)
Never ascribe to malice what can be equally ascribed to incompetence.
The corollary of this is, of course, that you should still be wary of single points of failure, even if you do not believe they will fail you on purpose.
Oh no, someone made a mistake! (Score:3, Insightful)
Why was this blocked? (Score:4, Informative)
Safe Browsing
Diagnostic page for mine.nu/
What is the current listing status for mine.nu/?
Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 3 time(s) over the past 90 days.
What happened when Google visited this site?
Of the 4329 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 09/21/2008, and suspicious content was never found on this site within the past 90 days.
Malicious software includes 7523 scripting exploit(s), 2911 trojan(s). Successful infection resulted in an average of 0 new processes on the target machine.
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, mine.nu/ appeared to function as an intermediary for the infection of 183 site(s) including culportal.info, mipt.ru, baikal-discovery.ru.
Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 932 domain(s), including bernard-becker.com, mipt.ru, dhammasara.com.
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Next steps:
* Return to the previous page.
* If you are the owner of this web site, you can request a review of your site using Google Webmaster Tools. More information about the review process is available in Google's Webmaster Help Center.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
"It's not out of the ordinary for a network administrator to ban an entire domain to help secure his network."
Yes. I think this has a lot to do with Sturgeon's law: network administrators are not an exception for the 90% law.
Re: (Score:2, Informative)
Some years back "general network administration" made it impossible for me to see mail that came from Asia. That caused huge problems for me. The fuckwit that did this made the same argument you just did. If you are going to accept that sort of power you should learn the maxim "first, do no harm."
Re: (Score:2)
Exactly. If blocking and accepting collateral damage is to be your policy, where do you stop? Blocking whole countries? Whole ISPs? Filtering all content using protocols like Usenet or BitTorrent because some of it is probably inappropriate?
Re: (Score:2)
Re: (Score:3, Interesting)
Having a distributed system where individuals are responsible for rating resources (other individuals, websites, basically _anything_ with a unique ID or URI) would go a long way not just to combat phishing and malware, but other sorts of scams, trolls, etc. I call that system a "reputation system."
We need a system where I can rate a site as vapid (ie, experts-exchange is a waste of my time in search results) and then people who choose to subscribe to my ratings will see those sites may not be worth their
Re:Not google's fault (Score:5, Informative)
Um, no. The list is supplied by Google. When Firefox blocks a site, press the 'Why was this site blocked?' button to see Google's warning about it (http://safebrowsing.clients.google.com/safebrowsing/diagnostic?client=Firefox&hl=en-US&site=http://mine.nu/ [google.com] in this case).
Parent
Re: (Score:2)
Re: (Score:2)
Except that none of us use IE, so they could very well block the same domains in IE7's phishing filter and we'd never know it.
Re: (Score:2)
Except that none of us use IE, so they could very well block the same domains in IE7's phishing filter and we'd never know it.
While you may not use IE, some of us do. Just use the right tool for the right job.
Case and point: My online college coursework sometimes disappears if submitted using FF3. Using IE8 beta does not (and it worked fine under IE7 as well).
Yet another case and point: Flash videos under Ubuntu 8.04 with FF3 crash the browser every 4th video. FF3 under windows works without a hitch.