Monday, April 19, 2010

Google says: their site is used "as an intermediary for the infection of 13 site(s)"

Google is doing regular security scans of the websites it indexes. Google SafeBrowsing, the service that Google uses to communicate if a domain is malicious, or used to redirect to a malicious site will show the results for a given URL with the following query:

http://www.google.com/safebrowsing/diagnostic?site=.


Until very recently, the Google SafeBrowsing status for google.com was not showing any potential threat. Now, it is showing that "google.com appeared to function as an intermediary for the infection of 13 site(s)".


Google SafeBrowsing page for google.com


Is is true that attackers are using Google to redirect users to a fake antivirus page in order to social engineer victims into installing malware? The status actually goes further by saying that google.com hosted malware:


Has this site hosted malware?
Yes, this site has hosted malicious software over the past 90 days. It infected 41 domain(s), including sangalonews.com/, ro777.com/, aviris.com.ua/.

How long will it take before Google blacklist itself? :-)

-- Julien

0 comments: