Brute force attack yields keys to Google’s kingdom

Miscreants pushing Viagra and malware are making new progress infiltrating Google indexes, a feat that’s considered the Holy Grail among spammers.

Google, which by some estimates carries out 60 per cent of the world’s searches, goes to great lengths to filter naughty sites from its results. The proliferation of rogue sites that have made an end run around the controls is giving rise to conspiracy theories that Google has been hacked.

“If a smart spammer has really found a way to game the Google search results with spoofed or cloaked sites, and Google still doesn’t have a fix, this could be a major issue with the underlying infrastructure of the entire Google operation,” according to this post on The Google Watchdog blog. “This is the first time that I’ve ever been worried that Google’s own index has been hacked.”

The site notes that specific search terms return large number of domain names ending in .cn. When clicked, they redirect the user to a different address that attempts to install malware. The rogue sites catch the attention of Google search bots by appropriating keywords and other content from legitimate sites. Amazingly enough, the rogue sites manage to secure a higher ranking than the legitimate ones, according to Google Watchdog.

According to Roger Thompson, a Exploit Prevention Labs researcher who specializes in finding innocuous search terms that return toxic results, the perpetrators are mainly succeeding through sheer brute force. Spammers register thousands of domain names and create thousands of landing pages for each one and then embed thousands of legitimate sounding keywords in each one. Then they lie in wait. Once a page is entered into the Google index, the miscreants enter code into the page that causes it to redirect to a site that installs malware.

“We’ve seen a real surge of this thing over the last couple of months,” Thompson says. “By putting out just the landing pages, they get up near the top of the search results and potentially get a lot more victims before they get shut down.”

Domain names ending in .cn seem to be especially popular these days because they sell for as little as 13 cents apiece, Thompson said.

Via (theregister.)