Google to be Our Web-Based Anti-Virus Protector ? 171
cyberianpan writes "For some time now, searches have displayed 'this site may harm your computer' when Google has tagged a site as containing malware. Now the search engine giant is is further publicizing the level of infection in a paper titled: The Ghost In The Browser. For good reason, too: the company found that nearly 1 in ten sites (or about 450,000) are loaded with malicious software. Google is now promising to identify all web pages on the internet that could be malicious - with its powerful crawling abilities & data centers, the company is in an excellent position to do this. 'As well as characterizing the scale of the problem on the net, the Google study analyzed the main methods by which criminals inject malicious code on to innocent web pages. It found that the code was often contained in those parts of the website not designed or controlled by the website owner, such as banner adverts and widgets. Widgets are small programs that may, for example, display a calendar on a webpage or a web traffic counter. These are often downloaded form third party sites. The rise of web 2.0 and user-generated content gave criminals other channels, or vectors, of attack, it found.'"
Wouldn't good sites with bad ads or posts... (Score:5, Insightful)
Informing webmasters (Score:5, Insightful)
Re:aid and comfort to the enemy? Helping microsoft (Score:5, Insightful)
end-users, man (Score:4, Insightful)
Re:Informing webmasters (Score:3, Insightful)
Does it matter? (Score:5, Insightful)
I would hope that Google is looking at it more from the perspective of what is generally good for the betterment of the entire internet. Who cares if it directly benefits users of Microsoft product users more than Linux/OSX users? Bottom line, it is potentially one less infection, and one less pwned computer in a bot network. Less infections means less machines that are probing ports on random addresses, or used in brute force attacks, such as DoS attempts.
Don't get too tied up in the means, but rather what the potential end results, good or bad, might be.
10% number misleading (Score:5, Insightful)
Re:aid and comfort to the enemy? (Score:5, Insightful)
Do Linux or Apple users not mind all the spam to their inbox from hijacked machines?
Do Linux or Apple users not have to worry about some family member being taken in by a phishing scheme, hosted on a hijacked machine?
Do Linux or Apple users not mind tons of hijacked machines probing any SSH or other ports you might have open, looking for vulnerabilities or doing dictionary password attacks?
Less hijacked machines on the internet helps us all. Be you a Windows, Linux, Apple, BSD, or other user. Not caring about hijacked windows boxes because you are leet enough to use Linux is stupid.
Re:Wouldn't good sites with bad ads or posts... (Score:3, Insightful)
The answer to your first question is most likely yes.
What it would do, hopefully, is force companies in the business of serving up ads for pages to clean up their act, or find themselves going out of business. When word gets out that XYZ web ad agency's ads led Google to flag ABC company's web page as having malware, those looking to whore search rank positions will drop them like a bad habit.
Re:Pros and Cons (Score:3, Insightful)
A favor? Google has likely killed their company, or at least it's online portion. Remember the big debate about how certain companies weren't being seen on the front page of google searches a while ago? Remember how much less revenue those companies got? Think about it, if little old lady #13 wants to buy item xdfsd#14 from bigcompanyhere.com but Google tells her that it may contain scary Malware that could take over her computer how likely is she to buy item xdfsd#14 from bigcompanyhere.com? How likely is she to tell her friends not to buy item xdfsd#14 from bigcompanyhere.com? How likely is she to never shop on bigcompanyhere.com ever again even if they fix the minor problem that google flagged for them?
Any time a non-computer savy person sees this type of thing they're likely to avoid that site for a very long period of time. Sure, that'll make the companies more careful about what they put there, but it also gives Google even more control over the internet and internet based companies. I wouldn't be surprised if they (google) began offering "consulting" fees to remove the malware that google flagged from the companies site quickly, and how much of a leap is it from there to pure extortion?
Google controls a lot of the internet right now. Their job should not be to tell people where to search but rather to let them go where they want to go. This is a 'sounds like a good idea' idea but it could potentially be disastrous. Oh sure, what I layed out in my post is a pretty worst case scenario type thing, on the other hand how unlikely do you think it is? As for me, I'm expecting to see the 'Google Anti-Malware Division' started up pretty soon with their 'Low price of $100 to remove flagged malware from your site and get it back on the green list' within a year of this starting
What you suggest is wrong and immoral (Score:5, Insightful)
Since morality is defined by the desire to limit human suffering, protecting innocent people who don't know better from malware is always going to be for a greater good. People shouldn't have to get their OS reloaded every few months.
Not running your choice of OS doesn't make them bad, and is a startling simplistic world view. There's no "helping Microsoft" here; they are trying to protect all Internet users. Since those people are using Google search, it's really more like trying to serve their customers better. Since all their customers are Internet users; so ask yourself: what is concern #1 amongst Internet users?
Pardon my cynicism, but.... (Score:4, Insightful)
I am shocked, SHOCKED, to discover that a company that makes money selling ads on other websites would want to highlight malware-spouting ads by other companies.
Yes, I agree that identifying these ads is a Good Thing. No, I don't think publicly-traded Google's intentions are entirely noble.
Re:Only works through Goolge now... (Score:2, Insightful)
Great Idea - No False Sense of Security (Score:3, Insightful)
I see references to common things like widgets, but I don't see that as the most commonly attacked/exploited part of websites. Sure it's a real issue and is common (yes AdSense was hit with this kind of attack), but I hope they look for a lot more. One of the most common these days are the surprise addition to website sources of iframes with widths of 0. Or new and sudden references to
robots.txt (Score:2, Insightful)
Also, what about content that's delivered on pages that require you to login first (poral, message boards, etc..). These are areas a crawler is not going to get to and completely miss.
Going back to the fake login pages bit, unless Google can index every site every day these fake login pages will be up and down long before the crawler reaches them.
The speed with which web-based worms, fake logins, viruses, etc.. spread is probably far far greater than the cycle time for Google to crawl the malicious site in question.
Where I could see some real value here is in using Google to detect vulnerabilities in existing sites (publicly available documents with sensitive information like CCs, open directories with long lists of mp3s or large videos, simple phrases that indicate some web vandal has hit the site like "X was here" or "hacked/owned/pwnd by X" etc. Focus on giving web developers a tool to evaluate their own site from a security perspective rather than worrying about the end user. Google's infrastructure really isn't built to work like that.
Re:Pros and Cons (Score:4, Insightful)
minor problem my foot. Your notion that bigcompanyhere.com is entitled to grandma's money even if they're peddling spyware is ridiculous. Google gave grandma exactly what she wanted: a place to buy a widget without getting 0wn3d. The fact that they did no favors for bigcompanyhere.com is of no concern to her. Or me.
I would be very surprised indeed. They don't offer consulting fees to get you back on the gravy train after you got penaltyboxed for purveying spam links
Spyware central isn't where I want to go, even if they sell the cheapest RAM by four cents. Google, of course, is working for their shareholders and get paid by their advertisers, but they have a vested interest in keeping the searchers happy so the advertisers will keep paying them. The people whose sites are included in the results don't have some God given right to be on the first page so they can make money. Nevertheless, google has always tried to walk the tightrope between being overrun by crappy keyword farms and kicking out legitimate sites.
Re:aid and comfort to the enemy? (Score:2, Insightful)
I'm fairly indifferent to which platform I use as long as it functions well. I'm also not the norm, but am privy to using many a malware free Windows Machine.
The more Linux distros are out there, the larger the market share, the more malware will target it. If you think you will always have a highhorse to sit on just because you run Linux or Mac, then I'll be there when you fall and bust your ass on the first widespread linux or mac malware invasion to point and laugh at you.
Malware developers are out to accomplish a goal, to infect as many machines in as little time possible.
So what makes more sense: Target Windows boxes which have lots of readily available holes to squirm through and a whopping 95% (maybe? I don't know for sure) market share?
Or target Linux and Mac, which don't have as many widely publicized holes, and only a measly 5% market share?
Its a no brainer right? But if the tables were turned, and it was Linux with the 95% market share, your sure as hell gonna be the first targeted.
The point is, why not be pro-active, and send a message to malware authors that we don't want it, and we wont stand for it? By integrating virus protection into the very fabric of the net, we stand that much greater chance that the next big malware outbreak (Whether it targets linux or windows) will be easier to contain, and ultimately will take away that which the malware authors seek: Attention and Distribution.
Mitigating the damage is second best. (Score:3, Insightful)
What we need is for Internet Explorer to actually implement a real sandbox, and make all the attack vectors that involve ActiveX go away.