Security Response

検索結果と悪質な Web サイト

コンピュータのセキュリティ管理が非常に甘いユーザーや、Web 上の攻撃の標的になる可能性を一笑に付すようなユーザーに話を聞くと、その多くが「危ないものは検索しないから」とか「知らないサイトにはアクセスしないから」という理由を口にします。こうした態度を見聞きするたびに私は実に歯がゆい思いを抱き、このようなユーザーの啓蒙に使える情報が少しでもないものかと探したくなります。最近シマンテックが発表した「Report on Attack Kits and Malicious Websites （攻撃ツールキットと悪質な Web サイトに関するレポート）」で私が取り組んだ関連データの解析結果に特に関心を持ったのも、そのためです。

このレポートで私たちが利用したある調査では、Web 検索のキーワードと、各キーワードを使うことでユーザーが悪質な Web サイトに誘導されてしまった回数を調べました。検索キーワードは任意に選出され、「良い」語句も「悪い」語句もありました。つまり、Web で誰もが検索しそうな言葉だということです。詳しく調べるために、悪質な Web サイトがヒットした回数に基づいて、上位 100 個のキーワードを選出しました。

検索キーワードの種類に基づく悪質な Web サイトの比率

この解析で得られたデータの中に、意外な結果ではないものの特に注目に値する結果があります。上位 100 個の検索キーワードのうち、74 個は正規のドメイン名に固有のものだったのです。ということは、正規の Web サイトを名前で検索したユーザーが、いつの間にか悪質な Web...

In previous blogs we have discussed how malware can exploit a search engine’s indexing features in order to spread malicious content. Recently we have observed a massive compromise of websites under the .ch and .nl top-level domains, aimed at performing a massive search engine optimization (SEO) attack to spread fake antivirus applications.

To keep track of pages on the Internet, search engines use automated web scanners, called crawlers or spiders. Their purpose is to find every possible Web page on the net, read its content, and then index it for future user searches. Attackers often try to exploit this feature in order to trick a search engine into associating a malicious Web page with very common...

With only a couple of days to go before the start of the World Cup in South Africa, the people behind the black hat search engine poisoning attacks have been very busy trying to up their game. The goal, as ever, is to get their bogus software out to as many victims as possible, and the excitement around the World Cup presents a golden opportunity.

We have become aware of many World Cup 2010-related search terms that are currently being used to direct users to the familiar FakeAV scanner pages.

The scanner pages are the usual suspects that have been designed to look like the user interfaces of Windows XP, Vista and Windows 7. We have seen them time and time again—after the fake scan is over, they offer the user a file named packupdate[RANDOM NUMBER]_195.exe to...

Yesterday there was a volcanic eruption in Iceland near the Eyjafjallajoekull glacier that has led the Icelandic authorities to declare a state of emergency in southern Iceland. People living nearby have been evacuated in case of glacial melt water flooding and the airspace near the now active volcano is effectively closed off.  As you have probably already guessed, any event that commands a high level of public interest will be pounced on quickly by the makers of fake antivirus software in order to make a quick buck. This incident is no exception.

Web searches for subjects relating to this eruption, such as "Iceland Volcanic Eruption" or "Iceland Volcano," will return results that may include dozens of hacked websites. It is not that difficult to spot the hacked sites with the fake antivirus redirection in the search results. Generally, you should look for a pattern like this:

[...