08:40 PM
Connect Directly

Google Typo Causes Malware Warning Misfire

Millions of confused Google users encountered a warning page Saturday morning.

A misplaced "/" on Saturday morning prompted Google's malware warning system to flag every search-results link as dangerous.

The snafu lasted from between 6:30 a.m. PST and 7:25 a.m. PST. Confronted by a warning page placed between the flagged link and the destination site, millions of confused Google users followed an explanatory link that led to StopBadware.org, the organization that helps Google establish criteria for designating a site malicious. The surge of traffic led to what StopBadware likened to a "denial-of-service attack" and proved to be more than the site could handle, taking the site offline temporarily.

In a blog post shortly after the incident, Marissa Mayer, Google's VP of search products and user experience, apologized and attributed the problem to human error.

"Google flags search results with the message 'This site may harm your computer' if the site is known to install malicious software in the background or otherwise surreptitiously," she said. "We do this to protect our users against visiting sites that could harm their computers. We maintain a list of such sites through both manual and automated methods. We work with a non-profit called StopBadware.org to come up with criteria for maintaining this list, and to provide simple processes for webmasters to remove their site from the list. We periodically update that list and released one such update to the site this morning. Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs."

The mistake also rippled through Google's Gmail service, which uses the same filtering system for identifying incoming e-mail as spam. On Saturday, Rishi Chandra, senior product manager for Google Apps, said in a blog post that the company was working on an automated fix to move legitimate messages that had been erroneously labeled spam back into Gmail users' in-boxes. He advises those expecting critical messages to check their Gmail spam folders while Google worked a way to refilter its users' e-mail. As of Sunday, Chandra said that the fix had been implemented but he cautioned that users should still check messages identified as spam that arrived between 6:00 a.m. and 8:00 a.m. PST on Saturday.

Ironically, Google's paranoid vision of a Web where every site is dangerous isn't far from the way security companies see things. An IBM X-Force security report planned for release on Monday warns that Web vulnerabilities are at an all-time high and that hackers have become adept at compromising legitimate sites. Given the speed at which malicious code can appear and disappear from the Web, something noted by security researchers at AVG Technologies, it appears that a great many sites that aren't marked as malicious should be. Perhaps Google's exaggeration of online malice will look overly conservative in a year or two.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.