Criminals are increasingly attempting to conceal malware embedded in hacked websites from search engines such as Yahoo! and Google. Their aim is to prevent browsers which use technology such as Google's Safe Browsing API from sounding the alarm when a user visits a hacked website. Google's Safe Browsing API allows client applications to query Google's phishing and malware blacklist. Firefox and Google Chrome both make use of the API, which is based on

Google searches of websites for suspicious code.

If a Google search bot reaches one of these sites that conceal malware, it is recognised and simply fed harmless code. Web applications can identify visits from Google from the IP address and from the user agent (googlebot, yahoo) and can then use this information to control optional redirects to other pages. This can be achieved with just a few lines of code inserted into a hacked PHP web application. Fraudsters often use compromised websites, but also sometimes use special blog software.

Serving this kind of browser-specific content is nothing new, but it has previously tended to be used by developers to deliver different code to Internet Explorer and Firefox due to different functions. Blogger Brian Krebs quotes Google as confirming that criminals are using these kinds of tricks. Niels Provos of Google even adds that when search bots reach the infected sites they are directed to current content extracted from news sites, helping to increase the ranking of the infected site and making it more likely to attract victims. When an ordinary user then follows the link from the search engine they are fed the malicious code. Google is reported to be instituting counter-measures to combat such tricks, but is declining to release details, noting that it is engaged in a constant arms race with criminals.


See also:

• Google statistics reveal top 10 malware sites, a report from The H.
• Google extends Safe Browsing API, a report from The H.