Searching for Malware Data Likely to Lead to More Malware

It’s been a while since I blogged about Google Trends being abused to serve malware. However, recent attention around Google search poisoning led to me to check on things. It seems the attackers are being more selective in the search terms that they target–favoring those that have something to do with computer security. Hunting for poisoned search results based on random hot-search terms is hit or miss (and more miss than hit, at least in the top 10 results being poisoned). But terms that contained virus, trojan, rogue, and bulletin all lead to poisoned top search results. Some even lead to pages and pages of bogus links, which redirect to rogue anti-virus malware.

The following image is not intended to show the actual text of the search results, but rather it highlights the fact that four out of the top fifteen results are poisoned for one of today’s most searched terms at the time of this writing:

Starting from result number 20, the situation gets much worse–with dozens of poisoned results:

Granted, the link names on the second batch of results have nothing to do with the trojan search term I used. However, the attackers have set up thousands of pages that cross-link to each other, and contain various hot-search terms and content. So even if the long tail of poisoned results on any search term has a low conversion rate for that term, it can still serve to boost the score of other pages and terms that have a higher conversion rate.

Once a search user takes the bait, it’s business as usual for the attackers:

Graphic displayed while web page loads

Bogus warning message displayed from web page

Simulated system scan displayed from web page

Bogus scan results displayed from web page