Risk

2/1/2009
08:40 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Typo Causes Malware Warning Misfire

Millions of confused Google users encountered a warning page Saturday morning.

A misplaced "/" on Saturday morning prompted Google's malware warning system to flag every search-results link as dangerous.

The snafu lasted from between 6:30 a.m. PST and 7:25 a.m. PST. Confronted by a warning page placed between the flagged link and the destination site, millions of confused Google users followed an explanatory link that led to StopBadware.org, the organization that helps Google establish criteria for designating a site malicious. The surge of traffic led to what StopBadware likened to a "denial-of-service attack" and proved to be more than the site could handle, taking the site offline temporarily.

In a blog post shortly after the incident, Marissa Mayer, Google's VP of search products and user experience, apologized and attributed the problem to human error.

"Google flags search results with the message 'This site may harm your computer' if the site is known to install malicious software in the background or otherwise surreptitiously," she said. "We do this to protect our users against visiting sites that could harm their computers. We maintain a list of such sites through both manual and automated methods. We work with a non-profit called StopBadware.org to come up with criteria for maintaining this list, and to provide simple processes for webmasters to remove their site from the list. We periodically update that list and released one such update to the site this morning. Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs."

The mistake also rippled through Google's Gmail service, which uses the same filtering system for identifying incoming e-mail as spam. On Saturday, Rishi Chandra, senior product manager for Google Apps, said in a blog post that the company was working on an automated fix to move legitimate messages that had been erroneously labeled spam back into Gmail users' in-boxes. He advises those expecting critical messages to check their Gmail spam folders while Google worked a way to refilter its users' e-mail. As of Sunday, Chandra said that the fix had been implemented but he cautioned that users should still check messages identified as spam that arrived between 6:00 a.m. and 8:00 a.m. PST on Saturday.

Ironically, Google's paranoid vision of a Web where every site is dangerous isn't far from the way security companies see things. An IBM X-Force security report planned for release on Monday warns that Web vulnerabilities are at an all-time high and that hackers have become adept at compromising legitimate sites. Given the speed at which malicious code can appear and disappear from the Web, something noted by security researchers at AVG Technologies, it appears that a great many sites that aren't marked as malicious should be. Perhaps Google's exaggeration of online malice will look overly conservative in a year or two.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
Don't Roll the Dice When Prioritizing Vulnerability Fixes
Ericka Chickowski, Contributing Writer, Dark Reading,  5/15/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Security through obscurity"
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2607
PUBLISHED: 2018-05-21
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users...
CVE-2018-1108
PUBLISHED: 2018-05-21
kernel drivers before version 4.17-rc1 are vulnerable to a weakness in the Linux kernel's implementation of random seed data. Programs, early in the boot sequence, could use the data allocated for the seed before it was sufficiently generated.
CVE-2018-11330
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.
CVE-2018-11331
PUBLISHED: 2018-05-21
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.
CVE-2018-7687
PUBLISHED: 2018-05-21
The Micro Focus Client for OES before version 2 SP4 IR8a has a vulnerability that could allow a local attacker to elevate privileges via a buffer overflow in ncfsd.sys.