Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/25/2008
07:42 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Attackers Abuse Google Blogger

Blogger is flooded with phony blogs - including some that inject malware

Hackers are currently littering Google's Blogger site with phony blogs -- some containing malware, pornographic images, or pure spam.

"Google Blogger is being used as a malware delivery mechanism," says Ken Steinberg, CTO and president of Savant Protection, who discovered the attack while working on his own blog this morning. The attackers apparently are automatically generating the blogs with scripts. The blogs come with nonsensical names and content that's obviously been generated using English-compliant engines and keyword focuses, he says.

"They've upped the game. Mostly [blog attacks] have been through comments or postings," he says. Steinberg noted that some of the fake blogs were using malware-insertion techniques: "One of the more common ways of inserting malware is using overflow techniques found in movie [viewers]... When you click through a few of these blogs, up pops images set to auto-load -- some are images, some are movies" that can infect a visitor with malware, he says.

Google says it's investigating the event. "Google takes the security of our users very seriously, and we're always working to help protect our users and make the Blogger experience even better," a Google spokesperson said. "When we are notified of the existence of content that violates our Terms of Service, we act quickly to review it and determine whether it violates these policies. If we determine that it does, we remove it immediately."

At the time of this post, phony blog names were continuing to pop up regularly on the Blogger start page under "Blogs Updated."

Although there's no way to be sure exactly what the attackers and/or spammers are after at this point, Savant's Steinberg says it appears to be a combination of malware infection and skewing keyword statistics to their favor on Google Blogger.

Several contain pornographic images as well as advertisements purportedly for a traffic analysis tool for sites and blogs. Others appear legitimate, including one that was titled "The Washington Auto Show," but with random text and sentences within the blog entries.

"This is going to totally muck with Google statistics," Steinberg says. "When you look at how people do search engine optimization in the blogger world, a lot is based on keywords and they are prioritized based on usage. Google is mining all of this content and developing keyword statistics. So theoretically, someone with content associated with one of these crappy sites could get an elevated statistic."

Some of the blogs are cross-linked as well, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • Google (Nasdaq: GOOG)
  • Savant Protection

    Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    NSA Appoints Rob Joyce as Cyber Director
    Dark Reading Staff 1/15/2021
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon Contest
    Write a Caption, Win an Amazon Gift Card! Click Here
    Latest Comment: Hunny, I looked every where for the dorritos. 
    Current Issue
    2020: The Year in Security
    Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
    Flash Poll
    Assessing Cybersecurity Risk in Today's Enterprises
    Assessing Cybersecurity Risk in Today's Enterprises
    COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-8567
    PUBLISHED: 2021-01-21
    Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
    CVE-2020-8568
    PUBLISHED: 2021-01-21
    Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...
    CVE-2020-8569
    PUBLISHED: 2021-01-21
    Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, ...
    CVE-2020-8570
    PUBLISHED: 2021-01-21
    Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executi...
    CVE-2020-8554
    PUBLISHED: 2021-01-21
    Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typicall...