Google search: more links are malicious than you realize

It is not uncommon to find malicious links in 15% to 20% of the first 100 results returned by Google for any popular search term (according to Google trends). If Google doesn’t take the Blackhat SEO problem more seriously, the total number of malicious links is bound to increase and this may already be happening.

The top search on April 2^nd was “tri energy”. I am not sure why it became so popular, but don’t google it: more than 90% of the first 100 links are malicious! Here is what I found for this search on April 4^th:

• 86 links were sending users directly to a malicious, fake antivirus page that tries to install malware. This is the same issue, with the same domain name (xorg.pl) involved in most of the redirections that I detailed in a previous post.
• 4 malicious links were down or Google displayed a warning page
• The first 5 links on the first page of results were legitimate

One of the too few warnings from Google

Same search on Bing and Yahoo

For the same search, Bing did not show any malicious links. Yahoo! displayed 4 malicious links on pages 2, 6 and 7. At this point, I’m not sure if Bing and Yahoo! do a better job at cleaning up their search results, or if they are simply slower at picking up new pages.

8 hours later

I have re-scanned the Google results 8 hours later and things are a bit better. There are still only 10 legitimate links in the first 100 results, but Google displays a warning for 87 links. Only 3 malicious links redirect to a harmful site.

Google warns the users to not follow these links. Why do they even show them?

Not an exception

This number of malicious links may be extreme in this example, but the overall problem of attackers leveraging SEO optimization is not rare at all. For the same day, the #5 Google Trends search term,  “epic google”, 50% of the first 100 links are malicious. For the #2 search term, “mendicant”, 38% of the links are malicious. It took 2 days to Google to start clean up the results, from April 2^nd to April 5^th in the morning.

I do not understand why Google decides to include malicious links in their search results. Depending on the user’s browser version, clicking on these links can be harmful to users, or display useless content. In both cases, users do not want to visit these sites.

-- Julien

How Google is (NOT) tackling the Blackhat SEO issue

Google is widely used by attackers to trick users into going to malicious sites. The attackers hack legitimate sites that rank high on popular searches. The hacked pages display good content to the Google crawlers but when users surf to the hacked pages, they receive malicious content, which redirects them to other harmful domains.

While some Google searches contain numerous malicious results, even on the first page, Google seems to be attempting to address this issue. While analyzing the results for “google april fool”, I found several malicious results. I’ve investigated two - the 11th and 15th search results. The first link is to hxxp://consultenet.com/seriously/topeka-google-april-fools.html, while the second one is hxxp://sitnprettyphoto.com/werishmne/topeka-google-april-fools.html. Both links redirect to mysecure-safetypc.xorg.pl, a domain that displays fake antivirus pages to trick users in downloading and installing malware disguised as antiviruses.

A known bad site to Google

Google maintains a public list of malicious site, known as Google SafeBrowsing. You can look at the status of any domain by going to http://www.google.com/safebrowsing/diagnostic?site=<domain>. Within a few seconds of spotting these 2 malicious links, consultenet.com was not showing up anymore in the top 100 results.. The Google diagnostic page flagged the domain as having been involved in distributing malware.

Google Diagnostic for consultenet.com

Note that Google says “this site is not listed as malicious”, but that it is used to distribute malware. Indeed, consultenet.com does not host any malware, but it used to redirect the users to a different domain that host the malicious content.

How does Google use this information? A search for “site:consultenet.com” yields 403 results. By looking at the URLs, it is easy to spot the bad pages. One of them is hxxp://consultenet.com/seriously/didi.html. If you access this page from Google using the same search terms, you get the harmless page which Google used to rank the content. The hacked page looks at the Referer header to check where the user is coming from. Not only does the user has to come from Google, but it also needs to have done a “normal” search. This is an attempt to fool both Google and security tools into marking these pages as good.

Yes, all the fake pages are as ugly as this one! But this is the content that matters to Google.

I extracted 3 words from the page, and ran the following Google search: “didi index indicator”. Sure enough, the malicious page shows on the first result page as the 5th result.

Don’t click on link #5

If you follow the link, you get redirected to the following fake antivirus page on xorg.pl.

Fake antivirus page

An unknown hacked site

Google did not, at the time this blog was published, flag the second domain, sitnprettyphoto.com as malicious.

Domain is safe according to Google

It may not take long for Google to flag this domain. Since I don’t know when the website was hacked, I’m not able to measure Google’s response time to scan and flag it correctly.

What is Google doing with its data?

While it is not surprising that Google does not flag all hacked websites immediately, it is very concerning that they keep bad websites in their index. They know consultenet.com is used to spread malware, yet they still display dangerous links to this domain in their search results! Protecting users should be their number one priority. I personally, would prefer that they erroneously blacklist some websites temporarily, rather than keeping known bad websites in their search results - even showing them in the top 10 results!

-- Julien

Governmental website hacked to spread malware

Malicious sites are hiding themselves behind hacked legitimate sites. Attackers use these legitimate sites to fool the search engines into showing them as the top results for the most popular searches. These sites are then used to redirect visitors to a malicious site on a different domain, displaying a fake antivirus page.

Most of the hack sites are low profile: personal pages, small community sites, etc. But yesterday (03/31), an Argentinian governmental website was showing up in the first 10 results on Yahoo for "who got kicked off dancing with the stars tonight".: hxxp://misioneseduca.gov.ar/rob.php?id=who+got+kicked+off+dancing+with+the+stars+tonigh After clicking on the link, I got redirected to hxxp://p3p0.com/?said=3333&q=WHO+GOT+KICKED+OFF+DANCING+WITH+THE+STARS+TONIGHT

misioneseduca.gov.ar is down today. It appears that it was hacked along with several other PHP websites using Joomla due to a vulnerability in an image gallery plugin.

Not so long ago, hacking a website was the final goal. Attackers would do it for fun, as a political statement, or to steal money or information (login credentials, Social Security Numbers, etc.). Now, a hacked website is a platform to attack users, and not just the ones who frequent the site. Attackers are using Google SEO to widen the range of visitors to the hacked site serving malware.

-- Julien

Unlike popular belief, short links on twitter aren't malicious!

Twitter recently announced that it has implemented a new security system to scan all URLs posted in tweets to protect users from malicious sites. This follows a similar announcement from bit.ly in November 2009

Twitter, and the URL shorteners it has helped to popularize, have long been blamed for leading users to malicious sites. I posted on this topic 3 weeks ago and argued that this may not be true. I wanted to additionally do a thorough investigation of the Twitter links both before the security scan and after.

I have retrieved more than 1 million URLs (1,314,615 to be exact) from the public timeline over a couple of weeks before they put any protections in place. I then ran the links through the Zscaler infrastructure to find out which links lead to malicious sites.

The state of the Twitter links

 Prevalence of hostnames on Twitter

As expected, URL shorteners are very popular on Twitter, and bit.ly represents 40% of all links. TinyUrl, one of the original URL shorteners, comes in 3^rd with only 5% of all URLs.

How many malicious links?

I looked for malicious sites - phishing sites, malware, etc. I did not look for spam, only for pages that present a security risk to users.

To my surprise, a very low number of links led to malicious pages - only 773, links, 0.06% of all links scanned, redirected to malicious content.

  Types of malicious sites

Here is the distribution of malicious links by host name:

Bit.ly represents 40% of all links, and roughly the same proportion of malicious links. Same case for TinyUrl:  5% of all URLs and 6 % of all malicious sites. It does not look like bit.ly’s phishing and malware protection is making it any safer than other URL shorteners.  Twitpic.com is used to share images, so it is unlikely to be used for malicious content. Mediafire is known for hosting malware and other viruses, even if it is not blacklisted by Google Safe Browsing.

Note that these links may have been scanned up to 4 weeks after they were collected. Bad sites may already have been taken down, or cleaned up.

Can Twitter and bit.ly really protect their users?

The key to protecting end users, is real-time scanning of both the URL and the content. Twitter and bit.ly can only scan the links periodically.  Malicious websites try to hide their malicious content to non-users by checking the user agent or geography and by requiring a real browser which fully understands Javascript, Flash, etc.  An attacker can present harmless content to the Twitter or bit.ly scanners, but harmful content to a real user.

But remember that only 0.06% of all the URLs tests represented a security risk. It is actually much safer to follow link s from Twitter that from some search results on Google!

-- Julien

Whitepaper: Botnet Analysis Leveraging Domain Ratio Analysis

While conducting stats and trends for last Quarter's "State of the Web" report, I found an interesting way of analyzing top-level domains (TLDs). I added the total number of web transactions involving a TLD for the month and divided it by the total number of unique domains within that TLD. In other words I calculated a ratio of Transactions:Unique Domains per TLD for each month and tracked this ratio. A low ratio means that the transactions were well distributed across the domains visited within that TLD. A ratio of 1:1 for example means that there was essentially 1 web transaction per unique domain visited. A very high ratio would indicate that there were a large number of transactions to one or more of the unique domains visited - suggesting that one or more popular domains dominated customer usage of that particular TLD.

By sifting through the records for the high-ratio results, some interesting information can be discovered. In some cases, high-ratios were caused by numerous transactions to a popular site or service, such as a popular social networking site in a particular ccTLD. However, high-ratios may also represent malicious command and control (C&C) or information drop servers that have a large number of transactions beaconing to them.

An example of a TLD that bubbled to the top was .LY. This domain had more than double the monthly ratio value of .COM. This high-ratio is explained by the TLD being relatively unpopular for our customers in terms of unique domains visited, but having a large number of transactions to a popular domain: BIT.LY, a URL shortening service.

Another TLD, .NU, had more than double the monthly ratio of .LY. After conducting analysis on the results, I detected that there were several customers beaconing to a .NU site over HTTP on port 53/TCP (generally used for DNS). Upon further investigation the customers were infected with a previously undetected variant of the Win32.PcClient Backdoor. The full research report of the detection methodology and incident analysis can be read HERE.

March Madness Malware

The previous post spoke about the increase in frequency to sports related websites from corporate users because of March Madness. A follow on question: are there any associated security risks from this? While browsing to some well-known sports sites is of negligible risk, several Google searches for some NCAA / March Madness terms reveal malicious results:


Following the search result causes redirection to occur:

Which loads a Fake A/V page:
Which is detected by 9/42 anti-virus vendors.

In addition to this Google SEO example, Zscaler blocked and logged this malicious NCAA site:
hxxp://ncaa-bracket-2010-update.bitterrootjrfootball.com


which loads an obfuscated JavaScript file: /styless.js
which after some decoding, redirects to this flash file:
hxxp://ncaa-bracket-2010-update.bitterrootjrfootball.com/?ncaabracket2010updatencaabracket2010updatebitterrootjrfootballcom.swf

This is the Wepawet report for the flash file, and the VirusTotal (6/42 detection) report.

The flash file contains obfuscated JavaScript redirector:

Decodes to:
the document.location.search provides the query string portion of the URL.

Safe Browsing results (Google, Norton) show a handful of fake NCAA related sites that load Fake A/V:
hxxp://st-mary-s-basketball.bitterrootjrfootball.com/
hxxp://espn-bracket-picks.bitterrootjrfootball.com/
hxxp://siena-university.bitterrootjrfootball.com/
hxxp://nit-tournament.bitterrootjrfootball.com/

Corporate Users and the March Madness Temptation

Over 50% increase in Sports Related Bandwidth Usage

Those not familiar with Zscaler, Inc. – we provide Security Software as a Service (SaaS) to protect customers from web-based threats as well as enforce customer policy decisions. We see traffic from over 140 different countries, and process millions of web transactions every day. Our customer user base is composed primarily of corporate end-users. Based on these facts, Zscaler is in a unique position to conduct stats and trends for corporate end-user web usage during the NCAA basketball tournament.

I pulled the numbers for transactions to sports related websites for March 2010 and as suspected, there was a noticeable increase in requests to sports related websites. In order to best quantify the activity I added the total HTTP request and response size (bytes) per day to sports related sites - I call this bandwidth usage. I calculated a trend line for weekday and weekend traffic. Because our users are mostly corporate users, there is a general decline in weekend web usage, so the actual trends are more visible by trending weekday and weekend traffic separately.

The blue line represents the weekday trend and the red the weekend trend. The light-grey Y-Axis lines are the bandwidth values in KB – the actual numbers are not shown, but the difference between each line is 100,000 KBs. What we see are the following percentage increases for sports related bandwidth usage during March 2010:

• 37% increase during weekday traffic
• 68% increase during weekend traffic
• The mean between these two, is a 52.5% increase in sports related bandwidth usage

There are a number of March related sports events, including the PGA tournament and the IPL cricket tournament (as I mentioned, Zscaler has a global user-base). As the trendlines show there is an increase in activity in the later March dates, corresponding with the NCAA tournament games:

• First-round games (March 18-19)
• Second-round games (March 20-21)

The two premier websites providing coverage of the NCAA tournament are ncaa.com and cbssports.com. Below is a chart of bandwidth usage to these two domains over March:


Other NCAA dates visible within the data are the NCAA division championships March 12-14 and the NCAA tournament selection (“Selection Sunday”) March 14. The trend line shows roughly a 95% increase in bandwidth to these two domains over March.

While corporations may turn a blind-eye to their employees spending time online monitoring their brackets and watching the amazing upsets that have occurred in this year’s tournament – this increase in sports related web usage, likely means a drop in productivity and potentially associated costs with respect to bandwidth usage. However, most would argue that the tournament and its associated office pools provide a welcomed increase in moral … that is of course, unless you are a die-hard fan of one of the top-seeds that has been upset ;)