Google Finds More than 4,000 Malware Distributing Sites
Google's Online Security Blog published some information regarding the number of potentially malicious sites that appear to have been set up for distributing malware. Of the more than 4,000 sites that they have identified, more than a quarter are registered under a .cn hostname and there were several that tried to play on Google services to trick users into thinking that they were legitimate.
Based on the chart presented in the post, it seems that the best opportunity to avoid detection and blacklisting by Google is to select a non .cn domain, and to pick a name that is inoffensive and bland and doesn't correlate to any pre-existing service that it plainly isn't. From the chart, it seems that orgsite.info had the greatest level of success, both in terms of the length of time before being added to the malware list, and with the number of people reached before being added.
Just because a site is added to Google's malware list doesn't mean that it is going to fade from significance. Gumblar's recent and rapid rise to prominence, including not peaking until well after being added to Google's malware list highlights this succinctly. It reflects the growing number of sites that Google has identified as being infected with the Gumblar malware, all of which points back to the problematic gumblar.cn domain. Almost all of the sites flagged by Google as pointing towards gumblar.cn would be legitimate websites that have been compromised by a group or groups as part of a widespread Internet attack that is being used to distribute malware to Windows PCs (though it could always easily be repurposed).
7 June 2009
Social bookmark this page at eKstreme.
Alternatively, Bookmark or Share via AddThis
Do you like how we cover Information Security news? How about checking out our company services, delivered the same way our news is.
Let our Free OS X Screen Saver deliver the latest security alerts and commentary to your desktop when you're not at your system.
Comments will soon be available for registered users.
Subscribe to our feed.
