Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2008
07:42 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Attackers Abuse Google Blogger

Blogger is flooded with phony blogs - including some that inject malware

Hackers are currently littering Google's Blogger site with phony blogs -- some containing malware, pornographic images, or pure spam.

"Google Blogger is being used as a malware delivery mechanism," says Ken Steinberg, CTO and president of Savant Protection, who discovered the attack while working on his own blog this morning. The attackers apparently are automatically generating the blogs with scripts. The blogs come with nonsensical names and content that's obviously been generated using English-compliant engines and keyword focuses, he says.

"They've upped the game. Mostly [blog attacks] have been through comments or postings," he says. Steinberg noted that some of the fake blogs were using malware-insertion techniques: "One of the more common ways of inserting malware is using overflow techniques found in movie [viewers]... When you click through a few of these blogs, up pops images set to auto-load -- some are images, some are movies" that can infect a visitor with malware, he says.

Google says it's investigating the event. "Google takes the security of our users very seriously, and we're always working to help protect our users and make the Blogger experience even better," a Google spokesperson said. "When we are notified of the existence of content that violates our Terms of Service, we act quickly to review it and determine whether it violates these policies. If we determine that it does, we remove it immediately."

At the time of this post, phony blog names were continuing to pop up regularly on the Blogger start page under "Blogs Updated."

Although there's no way to be sure exactly what the attackers and/or spammers are after at this point, Savant's Steinberg says it appears to be a combination of malware infection and skewing keyword statistics to their favor on Google Blogger.

Several contain pornographic images as well as advertisements purportedly for a traffic analysis tool for sites and blogs. Others appear legitimate, including one that was titled "The Washington Auto Show," but with random text and sentences within the blog entries.

"This is going to totally muck with Google statistics," Steinberg says. "When you look at how people do search engine optimization in the blogger world, a lot is based on keywords and they are prioritized based on usage. Google is mining all of this content and developing keyword statistics. So theoretically, someone with content associated with one of these crappy sites could get an elevated statistic."

Some of the blogs are cross-linked as well, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Google (Nasdaq: GOOG)
  • Savant Protection

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Commentary
    How SolarWinds Busted Up Our Assumptions About Code Signing
    Dr. Jethro Beekman, Technical Director,  3/3/2021
    News
    'ObliqueRAT' Now Hides Behind Images on Compromised Websites
    Jai Vijayan, Contributing Writer,  3/2/2021
    News
    Attackers Turn Struggling Software Projects Into Trojan Horses
    Robert Lemos, Contributing Writer,  2/26/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Current Issue
    2021 Top Enterprise IT Trends
    We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
    Flash Poll
    How Enterprises are Developing Secure Applications
    How Enterprises are Developing Secure Applications
    Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2021-27907
    PUBLISHED: 2021-03-05
    Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javasc...
    CVE-2021-20663
    PUBLISHED: 2021-03-05
    Cross-site scripting vulnerability in in Role authority setting screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and ea...
    CVE-2021-20664
    PUBLISHED: 2021-03-05
    Cross-site scripting vulnerability in in Asset registration screen of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type 6.7.5 and earlier (Movable Type 6.7 Series), Movable Type Premium 1.39 and earlie...
    CVE-2021-20665
    PUBLISHED: 2021-03-05
    Cross-site scripting vulnerability in in Add asset screen of Contents field of Movable Type 7 r.4705 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.4705 and earlier (Movable Type Advanced 7 Series), Movable Type Premium 1.39 and earlier, and Movable Type Premium Advanced 1.39 and ear...
    CVE-2021-28031
    PUBLISHED: 2021-03-05
    An issue was discovered in the scratchpad crate before 1.3.1 for Rust. The move_elements function can have a double-free upon a panic in a user-provided f function.