Fake YouTube page targets Chrome users

Fake YouTube pages are one of the favored ways attackers leverage to get users to click on malicious content. These fake pages often look the same, but the source code can reveal a new twist. This time, a recently encountered fake YouTube page host at http://facebook-java.com targets Google Chrome users only.

Fake YouTube page

We have found a many malicious sites that specifically target Internet Explorer or Firefox users, but not often Google Chrome users. In this example, any click on the fake video player or the fake ad attempts to install the following extension for Google Chrome: https://chrome.google.com/webstore/detail/nhmibhinlbilhaflldckbeokphjoifhi.

JavaScrip code that installs a Chrome extension

You may have noticed that the extension is hosted in the official Google Chrome store. Google disabled the installation of extensions for 3rd party sites in June 2012, and silent installs in late 2012.

The Chrome store page does not show any information about the extension:

Let's install the extension hosted at http://facebook-java.com/.

List of permissions requested by the extension

A new icon is added next to the URL bar:

The link redirects to http://www.getjava.net/. This shows the same page as facebook-java.com. It tries to install another extension from the Chrome store, but this one has already been removed.

getjava.net

Now that the extension has been installed, it is not possible to open Tools or Settings in Chrome. Instead, a tab opens to https://www.facebook.com/?get_cod whenever those functions are accessed. The corresponding code in the malicious extension shows how it is done:

Overrides any tab wit ha URL starting with chrome://

Thereafter, in every webpage viewed four different malicious scripts are inserted. The author uses the Google URL shortener to include the malicious JavaScript:

• http://goo.gl/9Ky9t => http://profonixcoder.com/yeni/pro.php
• http://goo.gl/gQhF6 => http://profonixcoder.com/yeni/twitter.php (down)
• http://goo.gl/t7snI => http://profonixcoder.com/yeni/youtube.php (down)
• http://goo.gl/jUEgY => http://profonixcoder.com/yeni/askfm.php (down)

Only the first script is available currently. It works on Facebook pages. It shares links using the user's account. By the name of the other files, we can assume they do something similar on YouTube, Twitter and Ask.fm

It looks like the author of this malicious extension doesn't have a high opinion of Google's security by using Google for hosting the extension and using their URL shortener to inject the malicious JavaScript.

Most common threats in top blacklisted sites

The vast majority of the most popular blacklisted websites contain a piece of malicious JavaScript inline. These sites were mostly hijacked by attackers and the malicious code can usually be linked to the Blackhole exploit kit.

Malicious code found on top blacklisted sites

I was surprised to find malicious Java applets in second place, having been found on 10% of the blocked sites. Malicious iFRAMEs were the third most prevalent infection and generally resulted from  mass SQL injection attacks. Only 2% of the sites are trying to foil users into downloading a malicious piece of code through a fake AV, Flash or codec page.

The scam and spam sites are mostly survey scams (the-rewardline.com, station-awardz-central.com, channelrewardscenter.org, etc.) and work-from-home scams (financereports.co). These sites have been blocked by Google Safe Browsing for months.

Since most the blocked sites are legitimate sites with high traffic, they quickly get cleaned up and removed from the Google blacklist. While the average number of days a top-site is blocked by Google is 7 days, the graph below shows that the vast majority are blocked for only a few days:

The number of top-domains blacklisted, can vary considerably on a daily basis, but the trend is upward - from an average of 400 sites in May to more than 1,000 in July.

Number of top-websites blacklisted daily by Google

Here are the top-ranked websites blacklisted by Google since May 2012:

Domain	Alexa rank	Country
blog.com	681	PT
fatakat.com	699	US
ziddu.com	878	GB
warez-bb.org	1,029	RU
vanguardngr.com	1,528	US
prlog.org	1,555	US
damnlol.com	1,949	US
arabseed.com	2,002	US
h33t.com	2,213	CA
geo.tv	2,606	GB

Small or big, popular or not, all websites are under attack. No domain can be fully trusted and you never know if attackers managed to breach the protections of the website that you're currently on.

Redis back-end for Net::Google::SafeBrowsing2

I started working on Net::Google::SafeBrowsing2, a Perl library for Google Safe Browsing v2, about a year ago and released it last November.

This library can use many back-ends for storage. In addition to Sqlite, MySQL and Postgres (added by a contributor), you can now use Redis, a fast key-value store, as a back-end for Google Safe Browsing with Net::Google::SafeBrowsing2::Redis (source available on github). This storage speeds up updates by a factor of 10 over the SQL back-ends.

Upgrade Net::Google::SafeBrowsing2
Numerous fixes and improvements went into the Net::Google::SafeBrowsing2 in the past few weeks, so make sure you are running the latest version.

I have also introduced a new import/export feature that makes it easy to switch from one back-end to another. You can easily switch from the MySQL back-end to the Redis back-end, for example:

my $mysql = Net::Google::SafeBrowsing2::MySQL->new(...);
$mysql->export(list => MALWARE, file => 'malware.dat');
$mysql->export(list => PHISHING, file => 'phishing.dat');

my $redis = Net::Google::SafeBrowsing2::Redis->new(...);
my $gsb = Net::Google::SafeBrowsing2->new(key => ..., storage => $redis);
$gsb->import_chunks(list => MALWARE, file => 'malware.dat');
$gsb->import_chunks(list => PHISHING, file => 'phishing.dat');

Despite the popularity of Google Safe Browsing (used by Firefox, Google Chrome and Safari), there are still very few implementations available and even fewer complete implementations. Since I published a list of Google Safe Browsing libraries available back in December 2011, I'm aware of just one new implementation for Scala/Java. Popular languages like Ruby don't have such libraries yet.

Follow up on the top blacklisted sites

Earlier this week, I researched the top websites blacklisted by Google. I've looked at more of these websites over the last three days to better understand the most common attacks.

The findings are quite disappointing. First, most infected websites are not cleaned up after three days. Webmasters should see a huge drop in their traffic, since only Internet Explorer and Opera users would not receive a warning preventing them from visiting these sites, due to the fact that other browsers use the Google Safebrowsing blacklist. This also means that the owners of these very popular websites have not invested in keeping their website safe, or at least in solutions to detect the blacklisting of their pages, traffic anomalies, or the detection of malicious content.

Second, the injected IFRAMES or JavaScript, redirect to the same type of malicious pages that we've seen for years now, such as fake AV scareware, fake Flash updates, survey scams, etc. That means that users are
still not educated enough to recognize fake software updates and still fall for the same old tricks.

These users won't get much help from their antivirus either. The detection rate of new malicious executables is very low, usually below 25%.

Here are some of the very recognizable malicious landing pages.

Fake Flash Updates

This is exactly the same attack we described in October 2011 (Naked Emma Watson video). A website that looks a lot like YouTube, claims that Flash must be upgraded to watch the sex video of some celebrity.

Fake Youtube page

Warning about Flash upgrade

Only 9 AV vendors out of 42 detect the fake Flash upgrade executable as malicious

Fake AV

This one looks different than the usual fake AV pages, as it is just an image with no animation.

Fake AV page

Detected by 12 AV engines out of 42.

Survey scam

A common way for spammers to profit from users is to get them to do "free" trials in order to earn a gift (or so they claim). This type of scam is very, very common. It's amazing that is still works.

In this example, the spammer uses a fake Youtube page to make the scam appear more legitimate.

Survey scam

I also found out that while Google Safe Browsing might block the infected site, it often does not block the actual malicious domain injected into the page in the form of a malicious IFRAME or JavaScript redirect. This means that other websites infected with the same piece of malware could be missed by Google Safe Browsing and still impact other users.

For webmasters

There are many ways to know when your website is blacklisted. For example, you can register a free account with Google Webmaster Tools. Then look under Health > Malware for any indication of blacklisting. You can also check the Google Safe Browsing diagnostic page for your domain at http://www.google.com/safebrowsing/diagnostic?site=mysite.com. This will tell you not only if your domain is blocked, but also if a portion of your site is compromised before you actually get blacklisted. Finally, you can do some automated checks with the Google Safe Browsing Lookup API. We have released libraries to interact with the API using Perl, Python and Ruby.

Search Engine Security for Internet Explorer

Search Engine Security (SES), a browser extension designed to protect users against Blackhat SEO links in search engines, is now available for Internet Explorer. You can download it from our website. It is compatible with Internet Explorer 6.0 and above, on Windows XP thru Windows 7.

The features are the same as Search Engine Security for Google Chrome, released two weeks ago. The Referer and the User-Agent headers are modified when you follow a search result link on Google, Bing and Yahoo! This prevents the hijacked sites from redirecting users to a malicious page.

As with SES for Firefox and Google Chrome, you can turn the extension on and off for the three search engines.

Search Engine Security enabled on Bing

You can also whitelist specific pages. The only difference with the IE version as opposed to Firefox and Chrome is that the Referrer cannot be empty. This is why the default value is "-".

The options are available under Tools > Search Engine Security options.

Search Engine Security options

To test the features, search for "what is my user agent" or "what is my referrer" in Google, Bing or Yahoo! and follow a link. You will notice a different value when Search Engine Security is ON or OFF.

Modified User-Agent

There are very few browser extensions available for Internet Explorer, especially extensions helping to keep users safe. I will continue to port the Zscaler security extensions to Internet Explorer and will bring other security tools to this platform.

You can find a full list of all our browser extensions on the ThreatLabZ portal under Tools. Search Engine Security for Internet Explorer can be downloaded here.

Search Engine Security for Google Chrome

Google Chrome has recently added an API to modify HTTP headers. This in turns, made it possible to port Zscaler's Search Engine Security add-on from Firefox and Firefox Mobile to Google Chrome.

Search Engine Security on the Chrome Web Store

Most hijacked websites used for Blackhat SEO check the Referer header and the User-Agent, to decide whether to redirect the visitor to a harmless spam page or to a malicious domain (Fake AV page, Blackhole exploit kit, etc.). By modifying these 2 headers when the user leaves a Google, Bing or Yahoo! search, Search Engine Security fools the hijacked site into thinking that the visitor is not a real user and therefore avoids redirection to the malicious content.

Search Engine Security enabled for Google

All the work is done in the background, so it can be tricky to understand exactly what happens, or even if the add-on is working. We have therefore added a small note on the Google/Bing/Yahoo! search result pages to show you whether Search Engine Security is on (default settings) or off (disabled in the options):  Zscaler SES on or Zscaler SES off.

Search Engine Security disabled on Bing

To understand how the the headers are modified, look for "referer mobilefish" in Google after you have installed Search Engine Security. Click on the first link "Mobilefish.com - Show my IP". The page will display your User-Agent string and Referer header. With the default settings, the string "slurp" is appended to your User-Agent, and the Referer header is removed. These changes are done only when leaving a Google/Bing/Yahoo! search page.

You can also enable/disable the various settings on the Search Engine Security options page to see how the User-Agent and Referer strings are affected.

Search Engine Security options

You can install Search Engine Security for Google Chrome in the Chrome Web Store.

Blackhat SEO back in Google searches

In 2011, Blackhat SEO links were pretty much absent from the most popular searches in Google. Instead, Blackhat SEO was used to target more specific searches. The technique heavily used to poison the searches for buying software online with hundreds of fake online stores.

Blackhat SEO

Things are starting to change in 2012. I ran some numbers on Google searches for the month of March 2012 and found:

• 117 malicious domains, including 66 serving Fake AV pages and 35 fake online store domains
• 1,142 spam/malicious links in Google searches, including 299 links leading to a Fake AV page

The number of new domains hosting fake online stores is slowly decreasing, I found only 6 new domains in March, but the number of Fake AV sites has increased significantly.

While Google search results leading to Fake AV pages used to be caused primarily by hijacked sites that were redirecting the entire site to a malicious domain, the current increase is due mostly to the targeted use of Blackhat SEO for popular searches, as it was in 2010. The big difference with current results compared to those in 2010 is that Google is doing a much better job at flagging these malicious links: 294 of the 299 search results leading to a Fake AV page were flagged by Google.

The spammers are still able to get their spam pages on hijacked sites to appear on the first result page for popular searches such as "puerile in a sentence" and "edhelper password".

Malicious link in first result page

The technique used is still the same. Websites are hijacked and new pages are added. Each new page is targeting a popular search term trending in Google Hot Trends. Pages from different hijacked sites are linked together to increase their rank.

As I mentioned in an earlier post, the Fake AV pages still look the same, but surprisingly, use new source code with no obfuscation in most cases.

Fake AV instead of Fake store

The second trend I see is the increase in Fake AV links in searches related to software sales, like "Buy Windows 7". This is something I noted last year. The increase in search results leading to malware (Fake AV pages and others) where you would usually find fake stores is alarming because Google has not yet cleaned up these results. None of the spam links sending users to fake stores are flagged by Google.

Search Engine Security

The best tool to protect yourself against Blackhat SEO is Search Engine Security, a free browser extension from Zscaler. It was available for Firefox only, but versions for Google Chrome (currently waiting for approval in the Google Chrome Store) and Internet Explorer will be available shortly.

Fake AV: .ru sites used for redirections

This past month, I've seen an increase in hijacked sites redirecting to a Fake AV page. These attacks typically involves three separate phases:

1. The hijacked website redirects users coming from a Google search to an external domain.
2. A website redirects users to the Fake AV page or to a harmless site (mostly bing.com and google.com) depending upon the referer in step #1. This page adds a cookie using JavaScript, and reads it immediately, to make sure the page was accessed by a real browser that supports both JavaScript and cookies.
3. The fake AV page is delivered.

Hijacked sites

I demonstrated last year that the Blackhat SEO attacks had migrated from the most popular searches to more specific searches like buying software online where up to 90% of the links returned are malicious. It comes as no surprise that about 95% of the hijacked sites were found for searches like "purchase microsoft word", "achat windows" ("buy Windows" in French), "precio office 2007" (Italian), etc.

There were 12 hijacked sites being used, with 3 domains representing 90% of the hijacked sites redirecting to a fake AV page:

• politicalcampaignexpert.com (WordPress)
• www.extralast.com (WordPress)
• www.ukresistance.co.uk (blocked by Google Safe Browsing)

Redirection site

The domain used to redirect users from the hijacked sites to the fake AV pages are all .ru sites, with the same URL path:

• bannortim-qimulta.ru/industry/index.php
• daliachuuaroyalys.ru/industry/index.php
• bannortim.ru/industry/index.php
• uaroyalysdaliachu.ru/industry/index.php
• uaroyalys.ru/industry/index.php
• etc.

This page is used to differentiate between real browsers and bots or scanners. It uses JavaScript to write a cookie, and then reads it immediately thereafter. If the cookie is retrieved, the visitor is redirected to a malicious site, otherwise they are redirected to Bing or Google. Here is the snipped of the source code:

JavaScript and Cookie support test

Fake AV page

Fake AV page

Attackers are getting lazy! The fake AV page looks the same as it did two years ago and the source code of the page has barely changed. Fake AV pages used to change every 2-3 weeks when they were found all over the most popular searches, now they are remaining stagnant for six months. Here is the video that shows the Fake AV page in action:


As you can see in the video, the malicious executable is detected by 14 of 43 AV vendors.

Hopefully, one day Google will clean up the search results related to buying software as they did for the most popular searches. Until then, many users will end up on fake stores, fake AV pages or other malicious sites.  

Zscaler keygen: beware of what you are looking for

Some searches yield more dangerous results than others, for example, looking to buy software online has a 90% risk of bring you to a fake store and free software might not be free of adware/spyware. Looking for 'warez' is another risky query.

Last week, I received a Google alert for "Zscaler Likejaking Prevention 1.1.2 for MAC keygen serial crack Apple registration code activation". Given that Zscaler Likejaking Prevention is a free tool that we provide, it certainly doesn't need a keygen utility!

hxxp://mycleverlab.com/zscaler-likejaking-prevention-1-1-2-free-download.htm

The download link brings the user to firstclass-download.com. Downloading this specific file requires an account on firstclass-download.com which costs $1.99/month, plus a $69.95 one-time fee! At best, this money will allow you to download what is already available for free on multiple websites (Zscaler, Mozilla add-ons, Softpedia, etc.). At worst, users are paying to get a malware or spyware.

firstclass-download.com

This is the same technique I described in an earlier post related to Blackhat spam SEO. There are a lot of websites similar to mycleverlab.com. A search for "Zscaler keygen" shows many sites using the same trick: wacky-wii.com, dwlfile.com, zengenix.com, cracksguru.com, zengenix.com, etc.

Always go to the official source to download any software. If you want "Zscaler Likejacking Prevention for MAC", go directly to Zscaler's website. No need to pay for what is already free!

Google serves ad for Adware/Spyware

Last year, we wrote about Bing and Yahoo! serving ads leading to malicious websites. This week, it was Google who inserted ads for adware/spyware.

I found a suspicious ad in my Google Reader for a free FLV player. I've recently shown that this type of free software is regularly repackaged with adware/spyware for profit.

The ad leads to a download page for FoxTab FLV Player. There is a disclosure statement at the end of the page discussing the content of the bundle: "This product is totally free and offers the user additional bundle products that may include advertisement."

FLV Player download page

The adware/spyware is flagged by only 4 antivirus vendors out of 43. A behavioral analysis of the executable provided much more information about packages that were downloaded and ports open on the machine, etc.

The ad was found on the RSS feed of a security company specialized in cleaning up infected websites. This highlights the fact that even reading content from otherwise legitimate resources can inadvertently lead users to unwanted applications when sites include third-party elements (JavaScript driven ads in this case, but also IFRAMES, widgets, etc.) that they do not not have control over. Even trusted third-parties like Google are apparently not succeeding in delivering 100% adware/spyware free content to users.

Happy New Year 2012!

Switch to Google Safe Browsing v2

Google maintains a list of malicious URLs and phishing sites distributed through their Google Safe Browsing API. On December 12, version 1 was deprecated in favor of version 2. The API for version 2 works quite differently from version 1.

Importance of Google Safe Browsing

Google Safe Browsing is part of most popular web browsers including Firefox, Chrome, Safari and Opera. Internet Explorer uses it owns list, Microsoft SmartScreen. This makes Google Safe Browsing lists the most used security filter among all web users.

The Google Safe Browsing lists are also very extensive. There are currently about 460,000 entries in the lists and they are updated every 30 minutes. You can refer to "Google Safe Browsing v2: Implementation Notes" for more detailed numbers.

Coverage

I was curious see the overlap between Google Safe Browsing v2 and a few other security blacklists

• Malware domain list: 18,670 blocked / 71,352 entries (26%)
• Clean-MX Phishing: 540 blocked / 1,820 entries (30%)
• Phishtank: 1,318 blocked / 5,665 entries  (24%)

Of the Alexa top 1,000,000 sites, 250 are blocked by Google Safe Browsing v2.

Google Safe Browsing v2 libraries

The Google Safe browsing v2 API is fairly complex, at least more so than version 1. There are a number of libraries available, but not all implement the complete API. Here is a list of the libraries available within Google Safe Browsing v2:

Google Safe Browsing v2 libraries

Language	Name	Missing features	Comment
Python	google-safe-browsing	none	Reference implementation from Google
Perl	Net::Google::SafeBrowsing2	none	Several back-ends available for storage: MySQL, Sqlite, DBI, etc.
PHP	phpgsb	MAC	Helpful statistics for testing
PHP	gsb4u	MAC	Storage: MySQL, Sqlite;
C#	google-safebrowse-v2-client-csharp	MAC Back-off mechanism ? Save full hashes, discard them after 45 minutes MAC	Storage: data file
C#	Google-Safe-Browsing-API-2.0-C-p	MAC	Storage: SQL server
Java	jGoogleSafeBrowsing	???	Not finished?

Lookup API

If you need to check fewer than 10,000 URLs a day, you can use the much simpler Lookup API. This API allows you to send URLs directly to Google and receive the classification.

I've made a Perl library for the Lookup API, Net::Google::SafeBrowsing2::Lookup and I'm working on Ruby anfd Python implementations.

More software-related searches lead to malware

Spammers have done a very good job a hijacking web searches related to buying software online. More than 90% of search results for "buy Microsoft Windows" and similar searches, lead to fake stores on major search engines. Not much has been done by the search engines to clean up these search results.

Since the beginning of 2011, the number of search results for popular queries leading to fake AV pages and malware has dramatically decreased, especially on Google.

I've wondered when attackers would switch from the poisoning popular search phrases, to more targeted searches. In the past few weeks, I've seen more and more spam redirected to malware, where similar searches would previously have led to a fake online store.

For example, the website www.saloncti.com contains multiple spam pages around "buy microsoft office" (be careful if you decide to follow the search results). These spam pages are very similar to the spam pages leading to fake stores.

Spam page on http://www.saloncti.com/?p=1523

Instead of a fake store, the visitor is redirected to at least three types of malware.

Fake AV

One of the malicious redirections is to 31.44.184.89. It hosts a Fake AV page. Although the page looks visually the same as the Fake AV pages I've seen so far, the source code is very different.

Here is a video of the Fake AV page. I quickly got blacklisted (see details below in the post), so I had to reconstruct the page on my local machine. On the real website, I would have been prompted to download an executable, which was malware disguised as an antivirus solution.

Naked Emma Watson video

I've described this malicious page in a previous blog post. Basically, the page looks like YouTube, with a purported video of Emma Waston naked. The "Play" button warns users that they don't have the latest version of Flash and tricks users into installing malware.

Fake Flash installation

Top 10 Famous Celebrity Scandals

This is a variation of the naked Emma Watson video. The page shows a picture of a scantily clad Paris Hilton. Again, the goal is to trick users into installing malware disguised as a Flash update.

The page was hosted on firstuzsoft.rr.nu and was not blocked by Google Safe Browsing. The malicious executable was detected by only 6 AV out of 43. Zscaler's free Search Engine Security add-on for Firefox, does protect against these types of sites.

IP checks

There are multiple redirections between the spam page on the initial site (www.saloncti.com) and the final malicious page (31.44.184.89 or firstuzsoft.rr.nu). The referrer and the IP address are checked along the way. Here is a sample of a redirection from a Yahoo! search, to the malicious domain:

1. http://search.yahoo.com/ra/click?.bcrumb=tfNYWE9Y1t1&p=site%3Asaloncti.com%20software&cq=[...]
2. http://www.saloncti.com/?p=1870 (302 redirection)
3. http://74.63.193.178/tra1/change.php?sid=8 (302 redirection)
4. http://74.63.193.178/tra1/got.php?sid=8 (302 redirection)
5. http://www.communitysupportottawa.ca/cutenews/ip.php (302 redirection)
6. http://www.skibec.ca/castor-kanik/cutenews/ss/2.php (302 redirection)
7.  http://www3.bestiiarmy.rr.nu/?nlqqufcc=kuHa1bKbmpOZi%2BPdzaaUmNnsq56lopva18%2Bfl6Sqnp%2BU1Z3cntKV

After following a couple of search results, my IP address got blacklisted and I was redirected to ask.com instead of the malicious domain.

It is scary, but predictable, to see attackers switching their targets. I hope the search engines will take the threat of malicious executables more seriously than fake stores and clean up their search results. It will be interesting to see who has the best Blackhat SEO skills: people behind fake stores, or people behind fake AV/Flash pages.

Blackhat spam SEO trends in 2011

My last post on Blackhat SEO spam trends was posted in December 2010. Things have changed quite a bit in 2011.

Cleaner results in popular searches

The main target of search engine poisoning used to be popular searches found in the Google Hot Trends list. In several instances, popular searches contained up to 90% malicious links in the first ten pages. Currently, the number is between only one and three total malicious results in the first ten pages.

Still, in July 2011, we identified 60 popular searches which contained at least one malicious spam link. They led to 35 different fake AV domains and three other domains serving different types of malware.

Better protection

One of the big changes in 2011 is that various players appear to be taking action much more quickly in stoping hijacked sites from infecting users. Google has cleaner results and hosting companies are in general, much faster at taking down malicious domains. Antivirus vendors also seem to have better protection for fake AV pages (the fact that these pages are changing very slowly must help).

Webmasters seem to clean up their sites much faster as well. I believe that this is at least in part driven by better education as the threat of hijacked sites is now better known. Google has also helped to make webmasters aware of issues in their websites with warnings in Google Webmaster Tools, new warnings to users in search results and even direct e-mails to the owners of hijacked sites.

As a result, the number of spam pages redirecting to a malicious sites that are either down or have been cleaned up has increased significantly.

New targets

While the most popular searches are cleaner, a broader range of Google searches are now being poisoned. We recently demonstrated how Google News was redirecting users to malicious Java applets and Google Image search was poisoned for 6 months as well.

Searches for buying software online remains 90% malicious, redirecting users to fake stores. There has been no significant improvement on that front, with 60 different fake store domains observed in July 2011. This is a problem that pretty much all search engines are facing.

In total, I've found over 1,000 spam search results leading to 150 different domains, most of them were malicious. This is a conservative number as I did not include malicious sites that were down (but were likely infecting users in the past) and malicious domains which prevented me from accessing their content.

Distribution of malicious domains per category

Fake AV is still there

As you can see in the chart above, Fake AV sites are still present. They continue to look similar, both visually and in their source code. I've spotted 35 different Fake AV domains in July 2011. The usual suspects were there: 10 co.cc sites (xyfybir.co.cc, wydrjim.co.cc, ttvzxiw.co.cc, etc.), 6 co.be (vrtwyqz.co.be, urtty.co.be, etc.), etc.

Fake AV page seen on 08/22/2011

Google has definitely made progress cleaning their search results and hosting companies have been doing their part as well. It has been some time since I have seen a mass Google Web search poisoning like the millions of  "Hot Video" pages that we observed last year. The only exception would be for searches related to malicious online software stores.

I hope Google and other search engines vendors will continue to combat this threat.

-- Julien

The Web has still not switched to SSL-only

In November 2010, the release of Firesheep highlighted the dangerous consequences of not using secure HTTPS transactions. Following this, I provided some of the reasons why the web has not switched to SSL-only yet. There have been some improvements since, notably Google+, which works only over HTTPS, and from Twitter.

But those are very small steps. A lot more needs to be done.

SSL by default

One trend involves offering HTTPS as a new option. Facebook and Twitter took this path. Unfortunately, the option is usually disabled by default. Half of the users do not understand what this option does and the other half is not aware of the new feature well hidden in their profile!

HTTPS option under Security settings in Facebook

HTTPS should be enabled by default, perhaps with the option of disabling it for the very few users having problems with it.

Facebook

While Facebook has fixed the 2 bugs I mentioned in the earlier post - SSL: the sites which don't want to protect their users, it is practically impossible to use HTTPS on Facebook. The problem arises from the fact that the use of SSL breaks most of the applications I've tried on the platform. I used to get error messages, now users are warned that they need to switch to HTTP. They have to logout, and login again, to get HTTPS back.

Most Facebook Apps cannot be used with HTTPS

HTTPS cannot be used for popular applications like CityVille from Zynga. I doubt many users will take the hassle to logout/login constantly to switch back to SSL.


Insecure cookies

I've seen HTTPS implemented incorrectly on many sites, including Facebook. The main purpose of HTTPS is to hide the user cookies, so that tools like Firesheep cannot be used to hijack a user session. That means the HTTPS cookie should never be sent over HTTP. There are two ways to achieve this:

1. Use the secure keyword when sending a cookie with Set-Cookie. This mean the cookie can be sent by the client only over HTTPS
2. Use a different sub-domain that support HTTPS only (like encrypted.google.com) and restrict the cookie to this sub-domain

Otherwise, when the user connects to the website over HTTP the user session is vulnerable. Unfortunately, Facebook uses the exact same cookie over HTTP and HTTPS, without securing it. If you type "facebook.com" in your address bar, you will send your cookie in clear text, even if you are then redirected to https://www.facebook.com/ and simply visiting a site that uses a Facebook widget, a Like button for example, leaks your user session in plain-text, even if you check the "Secure (HTTPS)" option in your profile. Nowadays, it is a challenge to not visit a website that does not contain any element from Facebook...

My Facebook cookie leaked on a random web site (Like widget)

In the end, it does not really matter whether you use HTTPS or not for Facebook. Your Facebook cookie will be leaked when visiting other websites anyway.

Google

Google did the right thing with Google+. The website works with HTTPS only and there is no way to use HTTP. User cookies cannot be sent in clear text.

You can also use their search engine over HTTPS, unlike Bing, which does not offer a secure alternative.

But Google still has some work to do on the rest of their current web applications. For example, the Google Personal Home Page cannot be accessed over HTTPS (users get redirected to HTTP) and Adsense, the major adverting network, does not support HTTPS, which leads to a Mixed HTTP/HTTPS warning for sites would would like to use SSL.

Mobile

The situation is even worse in the mobile space. Most of the applications used on smartphones and tablets need to contact a web server to function: to retrieve advertising (Admob/Adsense Mobile), to get data from a web service, etc. But there is no way for the user to know whether sensitive information is sent over HTTP or HTTPS. There is no UI element equivalent to the lock shown in browsers and no visibility into the URLs. Researchers have illustrated that mobile developers cannot be trusted to secure communications, as all too often, they send user credentials in plain text.

While some websites have taken a few steps to protect the users, there is still a great deal to do. HTTPS should be enabled by default on all new web sites requiring user authentication. HTTPS should not just be required for login, it should also be required for all requests sent with a cookie.

-- Julien

Buying software online is getting more and more risky

Google searches for popular software (Windows, Microsoft Office, etc.) often contain links to fake online stores since at least December 2010. Google has done very little to clean up the search results.

Only 1 of these results is legitimate!

The situation is actually getting worse. More and more of these malicious search results redirect users to malicious pages containing malware, generally a fake AV page. About 8% of the links redirected to a malware pages in May compared to fewer than 1% in January.

Some of the malicious domains seen in May were adremekj2.cz.cc, drxjgjd.co.cc, krrhlrxl.co.cc, etc.

Top 1,000 hijacked domains

The most popular domains used by hijackers in May were mit.edu (nemis.mit.edu, scripts.mit.edu), harvard.edu (www.schepends.harvard.edu), stanford.edu (assu.stanford.edu), and notably ign.com (ffvault.ign.com), which ranks #158 by Alexa.

Only 5% of the malicious links in Google were flagged, but the number of malware sites overall (fake AV, browser exploits, malicious applets, etc.) have been going down since January.

Be very careful if you need to buy software online - use trusted websites only, and do not believe any website offering bigger discounts than usual.

-- Julien

Zscaler Safe Shopping Now Available for Google Chrome

The number of fake online stores displaying downloadable software at a steep discount remains high. It can be hard to distinguish these sites from legitimate online stores. Therefore, I had previously released Zscaler Safe Shopping for Firefox and Firefox mobile to warn users when they are visiting such sites. The extension is now available for Google Chrome. This extension also flags compromised stores, legitimate sites that are under the full control of malicious hackers.

Get Zscaler Safe Shopping from the Chrome web store

Zscaler Safe Shopping warning

When a user access a fake or compromised store, the extension displays a warning at the top of the page. It warns the users to not enter any sensitive information such as a credit card number which might be used illegally.

Zscaler Safe Shopping warning for a fake store

Options

The list of fake and compromised domains is updated regularly. You can choose how often the latest version should be downloaded in the options. You can also choose to whitelist domains to prevent any warning from being displayed.

Zscaler Safe Shopping options

This is my first extension for Google Chrome. Let me know if you find any issues. It has been tested with Google Chrome 11.0.696.68 on Windows.

You can download the extension directly from the Chrome Web Store. Don't forget to rate the extension if you like it!

-- Julien

Google Safe Browsing v2: Implementation notes

I wanted to share what I learned while I implementing Net::Google::SafeBrowsing2, a Perl library for Google Safe Browsing v2. I have put together "Google Safe Browsing v2 API: implementation notes", a collection of notes and real-world numbers about the API. This is intended for people who want to learn more about the API, whether as a user or to make their own implementation.

This is not another description of the API. Rather, it provides information about what you should expect from the API:

• how many updates does it take to get the full database initially
• how many updates there are per day on average
• how many add chunks and sub chunks you should expect
• how to test a library
• key differences between version 1 and 2
• etc.

The DOC and PDF versions can be downloaded from our website:



-- Julien

Blackhat SEO numbers for December 2010 (Part II)

This is a follow up to the numbers I presented in Part I, which discussed malicious spam pages in Google results and the malicious that sites they redirect to.

Google warnings

The number of spam pages which are flagged by Google represent only about 44% of all spam identified by Zscaler. If we look at spam pages redirecting to a malware, 57% are flagged. These numbers are about the same as what we saw in March 2010 (53% flagged).

52% of the malicious spam links are flagged by Google

Distributions of spam links per page

Spammers are still able to elevate their links to the first page of search results. However, compared to March 2010, there are fewer spam links on the first page than there used to be.

Number of spam links on each result page in Google

In general, more search terms contain Blackhat SEO spam links, but there are fewer such links per search, when compared to March 2010.

Number of spam links per poisoned search

Overall, Google's Blackhat spam SEO situation has improved: there are fewer spam links on the first page and fewer search terms had more than 50% of links returned as malicious. However, Google still struggles to clean their index, or at least to warn users about real threats.

-- Julien

High profile websites hijacked to lead to fake stores

Recently, a lot of high profile .EDU and .GOV were hijacked to redirect users to fake online stores. Google searches related to buying software ("buy windows 7 key", where to buy microsoft, "purchase microsoft word", "buy microsoft office", etc.) contain a long list of websites running on non-standard ports: www.kidsforkidsfestival.org:8080, en.jurispedia.org:4444, >www.notiuno.com:4577, etc. These links redirect users to online stores which claim to sell software at a discounted price.

Spam results for buying Windows

Major websites hijacked

The list of hijacked sites include:

• Harvard (Alexa rank in US: 875, cxc.harvard.edu)
• MIT (Alexa rank in US: 963, petar.blog.lcs.mit.edu, fig.scripts.mit.edu, hlt.media.mit.edu)
• Stanford (rank 782, mentalhealth.stanford.edu, yuba.stanford.edu, assu.stanford.edu)
• Fandango (rank 236, www.summermovies.fandango.com)

There are also governmental sites in the list, from US, China and other countries:

• openworld.gov
• paceflorida.gov
• fpa.tas.gov.au
• ezhouinvest.gov.cn
• perak.gov.my
• misiones.gov.ar
• etc.

Fake stores

The fake stores use multiple domain names, and each site looks slightly different: softsupreme.com, softsupreme.net, buysupreme.net, software-supreme.com, softbuy-download.net, softbuy-download.com, sacon.org, topoemdownloads.net, etc. I've seen more than 75 different domains so far.

Fake store

Multiple languages and other spams

Unlike the usual Blackhat spam SEO coming from the Google Hot Trends, this type of spam is targeted at multiple languages: English, French ("achat windows"), German ("Microsoft kaufen"), etc.

Hijacked sites on non-standard ports are also used for other types of spam: US student visa, Viagra, etc.

Once again spammers have managed to poison search results for popular searches. This specific spam was reported a month ago, but it still shows up in the first page of results for multiple searches.

-- Julien

Blackhat SEO numbers for December 2010 (Part I)

Blackhat spam SEO was very prevalent in 2010 and it is not likely to disappear in 2011. I've compiled a few statistics on Blackhat spam SEO pages found in Google search results during December 2010:

• Number of spam pages:  4,814
• Number of spam domains: 428
• Number of malicious sites: 483

I usually limit my Google scans to the first 10 pages of results, so there are likely many more spam pages in Google's full index.

Malicious sites

Fake AV pages are still the most popular type of attack, accounting for 85% of all malicious sites. Next in line are fake software stores, with 6% of the sites. I'll give more details about this type of attack in a future blog post.

5% of the malicious sites were unreachable, and could not be classified.

Types of malicious sites: mostly fake AV

44% of the malicious sites use a .IN domain name. 25% use a .COM extension, and 16% use an IP address without a domain name. .CC domains represent only 4% of all malicious domains. .CO.CC used to be the most popular TLD for fake AV pages, but it is now .IN

Malicious sites by domain extension

Spam pages

I found 428 legitimate sites hosting 4,814 spam pages in Google search results. That's an average of 11 spam links per domain within the top ranks for popular searches.

The spam sites are found all over the world: 31 different TLDs were found amongst spam sites. The international .COM extension was found in 58% of the sites, .ORG in 8% and .NET in 6%. The .EDU TLD represents 10% of the total. HJacked college websites were mostly to lead to fake software stores.

Spam sites by domain extension

Most dangerous searches

356 Google searches contained at least one malicious spam link in December 2010.

The most dangerous searches relate to buying software online, and lead to a fake store. The most dangerous popular search (shown in Google Hot Trends) was for "sherwood blount" with 63 spam links amongst the first 100 search results!

Top-10 most dangerous Google searches in December 2010

I am still compiling the numbers and will do another post on the topic shortly. It looks like malicious Blackhat spam SEO will still be a major threat, if not the most significant threat to users in 2011.

-- Julien