Forest Global Training Partners

Cyber Risks · Krebs on Security

Hiding from Anti-Malware Search Bots

Summary: Security researchers David Dede and Denis Sinegubko documented hacked sites that serve malicious JavaScript to ordinary visitors but withhold it when the requesting user agent matches Google's or Yahoo's anti-malware crawlers. Dede found the malware checking for the search engine bots and skipping them, while Sinegubko documented at least two blog infections that hid malicious redirects from Google's bots, and Google engineer Niels Provos said the company adjusts to these obfuscation techniques in what he called a constant arms race.

Bottom line: The warning label Google and Yahoo append to infected search results is itself the thing attackers are now engineered to avoid, so a clean-looking listing no longer tells you the site was checked and cleared.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related