Risk

2/1/2009
08:40 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Typo Causes Malware Warning Misfire

Millions of confused Google users encountered a warning page Saturday morning.

A misplaced "/" on Saturday morning prompted Google's malware warning system to flag every search-results link as dangerous.

The snafu lasted from between 6:30 a.m. PST and 7:25 a.m. PST. Confronted by a warning page placed between the flagged link and the destination site, millions of confused Google users followed an explanatory link that led to StopBadware.org, the organization that helps Google establish criteria for designating a site malicious. The surge of traffic led to what StopBadware likened to a "denial-of-service attack" and proved to be more than the site could handle, taking the site offline temporarily.

In a blog post shortly after the incident, Marissa Mayer, Google's VP of search products and user experience, apologized and attributed the problem to human error.

"Google flags search results with the message 'This site may harm your computer' if the site is known to install malicious software in the background or otherwise surreptitiously," she said. "We do this to protect our users against visiting sites that could harm their computers. We maintain a list of such sites through both manual and automated methods. We work with a non-profit called StopBadware.org to come up with criteria for maintaining this list, and to provide simple processes for webmasters to remove their site from the list. We periodically update that list and released one such update to the site this morning. Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs."

The mistake also rippled through Google's Gmail service, which uses the same filtering system for identifying incoming e-mail as spam. On Saturday, Rishi Chandra, senior product manager for Google Apps, said in a blog post that the company was working on an automated fix to move legitimate messages that had been erroneously labeled spam back into Gmail users' in-boxes. He advises those expecting critical messages to check their Gmail spam folders while Google worked a way to refilter its users' e-mail. As of Sunday, Chandra said that the fix had been implemented but he cautioned that users should still check messages identified as spam that arrived between 6:00 a.m. and 8:00 a.m. PST on Saturday.

Ironically, Google's paranoid vision of a Web where every site is dangerous isn't far from the way security companies see things. An IBM X-Force security report planned for release on Monday warns that Web vulnerabilities are at an all-time high and that hackers have become adept at compromising legitimate sites. Given the speed at which malicious code can appear and disappear from the Web, something noted by security researchers at AVG Technologies, it appears that a great many sites that aren't marked as malicious should be. Perhaps Google's exaggeration of online malice will look overly conservative in a year or two.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
3 Ways to Retain Security Operations Staff
Oliver Rochford, Vice President of Security Evangelism at DFLabs,  11/20/2017
A Call for Greater Regulation of Digital Currencies
Kelly Sheridan, Associate Editor, Dark Reading,  11/21/2017
New OWASP Top 10 List Includes Three New Web Vulns
Jai Vijayan, Freelance writer,  11/21/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.