Risk
2/1/2009
08:40 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Typo Causes Malware Warning Misfire

Millions of confused Google users encountered a warning page Saturday morning.

A misplaced "/" on Saturday morning prompted Google's malware warning system to flag every search-results link as dangerous.

The snafu lasted from between 6:30 a.m. PST and 7:25 a.m. PST. Confronted by a warning page placed between the flagged link and the destination site, millions of confused Google users followed an explanatory link that led to StopBadware.org, the organization that helps Google establish criteria for designating a site malicious. The surge of traffic led to what StopBadware likened to a "denial-of-service attack" and proved to be more than the site could handle, taking the site offline temporarily.

In a blog post shortly after the incident, Marissa Mayer, Google's VP of search products and user experience, apologized and attributed the problem to human error.

"Google flags search results with the message 'This site may harm your computer' if the site is known to install malicious software in the background or otherwise surreptitiously," she said. "We do this to protect our users against visiting sites that could harm their computers. We maintain a list of such sites through both manual and automated methods. We work with a non-profit called StopBadware.org to come up with criteria for maintaining this list, and to provide simple processes for webmasters to remove their site from the list. We periodically update that list and released one such update to the site this morning. Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs."

The mistake also rippled through Google's Gmail service, which uses the same filtering system for identifying incoming e-mail as spam. On Saturday, Rishi Chandra, senior product manager for Google Apps, said in a blog post that the company was working on an automated fix to move legitimate messages that had been erroneously labeled spam back into Gmail users' in-boxes. He advises those expecting critical messages to check their Gmail spam folders while Google worked a way to refilter its users' e-mail. As of Sunday, Chandra said that the fix had been implemented but he cautioned that users should still check messages identified as spam that arrived between 6:00 a.m. and 8:00 a.m. PST on Saturday.

Ironically, Google's paranoid vision of a Web where every site is dangerous isn't far from the way security companies see things. An IBM X-Force security report planned for release on Monday warns that Web vulnerabilities are at an all-time high and that hackers have become adept at compromising legitimate sites. Given the speed at which malicious code can appear and disappear from the Web, something noted by security researchers at AVG Technologies, it appears that a great many sites that aren't marked as malicious should be. Perhaps Google's exaggeration of online malice will look overly conservative in a year or two.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.