Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2008
07:42 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Attackers Abuse Google Blogger

Blogger is flooded with phony blogs - including some that inject malware

Hackers are currently littering Google's Blogger site with phony blogs -- some containing malware, pornographic images, or pure spam.

"Google Blogger is being used as a malware delivery mechanism," says Ken Steinberg, CTO and president of Savant Protection, who discovered the attack while working on his own blog this morning. The attackers apparently are automatically generating the blogs with scripts. The blogs come with nonsensical names and content that's obviously been generated using English-compliant engines and keyword focuses, he says.

"They've upped the game. Mostly [blog attacks] have been through comments or postings," he says. Steinberg noted that some of the fake blogs were using malware-insertion techniques: "One of the more common ways of inserting malware is using overflow techniques found in movie [viewers]... When you click through a few of these blogs, up pops images set to auto-load -- some are images, some are movies" that can infect a visitor with malware, he says.

Google says it's investigating the event. "Google takes the security of our users very seriously, and we're always working to help protect our users and make the Blogger experience even better," a Google spokesperson said. "When we are notified of the existence of content that violates our Terms of Service, we act quickly to review it and determine whether it violates these policies. If we determine that it does, we remove it immediately."

At the time of this post, phony blog names were continuing to pop up regularly on the Blogger start page under "Blogs Updated."

Although there's no way to be sure exactly what the attackers and/or spammers are after at this point, Savant's Steinberg says it appears to be a combination of malware infection and skewing keyword statistics to their favor on Google Blogger.

Several contain pornographic images as well as advertisements purportedly for a traffic analysis tool for sites and blogs. Others appear legitimate, including one that was titled "The Washington Auto Show," but with random text and sentences within the blog entries.

"This is going to totally muck with Google statistics," Steinberg says. "When you look at how people do search engine optimization in the blogger world, a lot is based on keywords and they are prioritized based on usage. Google is mining all of this content and developing keyword statistics. So theoretically, someone with content associated with one of these crappy sites could get an elevated statistic."

Some of the blogs are cross-linked as well, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Google (Nasdaq: GOOG)
  • Savant Protection

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Commentary
    How SolarWinds Busted Up Our Assumptions About Code Signing
    Dr. Jethro Beekman, Technical Director,  3/3/2021
    News
    'ObliqueRAT' Now Hides Behind Images on Compromised Websites
    Jai Vijayan, Contributing Writer,  3/2/2021
    News
    Attackers Turn Struggling Software Projects Into Trojan Horses
    Robert Lemos, Contributing Writer,  2/26/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-27581
    PUBLISHED: 2021-03-05
    The Blog module in Kentico CMS 5.5 R2 build 5.5.3996 allows SQL injection via the tagname parameter.
    CVE-2021-28042
    PUBLISHED: 2021-03-05
    Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.
    CVE-2021-28041
    PUBLISHED: 2021-03-05
    ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.
    CVE-2021-3377
    PUBLISHED: 2021-03-05
    The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
    CVE-2021-3420
    PUBLISHED: 2021-03-05
    A flaw was found in newlib in versions prior to 4.0.0. Improper overflow validation in the memory allocation functions mEMALIGn, pvALLOc, nano_memalign, nano_valloc, nano_pvalloc could case an integer overflow, leading to an allocation of a small buffer and then to a heap-based buffer overflow.