The New 'Google Search' Scam

Small and medium-sized businesses depend on the Web perhaps as much as anyone. They thus need to be mindful of the ever-evolving roster of Web scams--like a new one involving news. Most people know that search engines like Google are useful for quick research on topics in the news. Unfortunately, the bad guys aren't far behind. A search for "Bill Clinton heart attack" performed last Sunday produced the expected Google links about the former president's recent heart stent procedure. There were stories from the Los Angeles Times and ABC News, along with links to sites devoted to fighting heart disease.

However, it wasn't all what it seemed. If you clicked on the 10th item on the Google page, headlined "Bill Clinton heart attack," you were directed to another page of what appeared to be even more helpful Google results. Everything about the page--the typeface, the design--was authentic. If you looked quickly in the URL bar at the top of the page, you'd find what you might think was conclusive evidence of it being a legitimate Google page, since the URL seemed to be "googlesearches.com." But in fact the URL had a "q," not a "g," as its first letter. The two letters look enough alike that only the most eagle-eyed would have ever noticed.

"qooglesearches.com"--another of this ilk is "qoogle.com"--is a variation of a practice known as "typo-squatting." In its classic form, someone registers a domain that is close in spelling to a real one. When Web users inadvertently typed the wrong URL, they're directed to the typo-squatter's site, where they'd realize their mistake on account of all the ads and other attempts at easy monetization. But typo-squatters appear to be doing two things new. First, they are trying to fool you into thinking you've landed on the Web page you wanted to go to in the first place. Second, they are using tricks of "black hat" search engine optimization to get the links to their scam sites included in genuine Google search results.

Read more...

U.S. counterterror agency lacks "Google-like" search

A senior counterterrorism official said on Wednesday his agency lacks "Google-like" search capability that could have identified the suspect in the attempted Christmas Day airline bombing. The National Counterterrorism Center, the agency charged with reviewing disparate data to protect against attacks, does not have a computer search engine that could have checked for various spellings of the alleged bomber's name and his birthplace in Nigeria, the center's chief told a Senate hearing on security reform. "We do not have that exact capacity," said Michael Leiter, adding that the agency is working on solutions that could be in place within weeks.

The State Department has acknowledged it misspelling attacker's name, Umar Farouk Abdulmutallab, when sending an advisory out about him after his father warned the U.S. embassy in Nigeria his son had been attracted by militant ideology. Google and other common Internet search engines routinely offer alternative spellings for searches, particularly with names. Abdulmutallab had been flagged beforehand by U.S. embassy staff in Nigeria, but not under his full name.National Intelligence Director Dennis Blair acknowledged that current search tools used by U.S. spy and counterterror agencies have "blind spots that don't allow the sort of Google-like" searches civilians can do on their personal computers.

Read more...

Google reports China-based attack, says pullout possible

Google said Tuesday the company and at least 20 others were victims of a "highly sophisticated and targeted attack" originating in China in mid-December, evidently to gain access to the e-mail accounts of Chinese human rights activists. "Based on our investigation to date we believe their attack did not achieve that objective," according to a statement by David Drummond, senior vice president of corporate development and chief legal officer for Google, operator of the most popular Internet search engine.

Drummond said that as a result of the attacks, Google has decided it is no longer willing to consider censorship of its Google site in China and may have to shut down its site and its offices in that nation. "These attacks and the surveillance they have uncovered -- combined with the attempts over the past year to further limit free speech on the Web -- have led us to conclude that we should review the feasibility of our business operations in China."

Read more...

Twittergate: Update 2

Hacker used Twitter to control infected PCs

Twitter's been having a rough couple of weeks. A researcher looking into the attacks that knocked Twitter offline last week discovered another, unrelated security problem.

At least one criminal was using a Twitter account to control a network of a couple hundred infected personal computers, mostly in Brazil. Networks of infected PCs are referred to as "botnets" and are responsible for so much of the mayhem online, from identity theft to spamming to the types of attacks that crippled Twitter.

Jose Nazario with Arbor Networks said he found a Twitter account that was used to send out what looked like garbled messages. But they were actually commands for computers in a botnet to visit malicious websites, where they download programs that steal banking passwords.

The affected Twitter account was taken down. Nazario said what appeared to be the same person was doing the same thing on an account with a Google Inc. service called Jaiku, which is similar to Twitter. Google said the affected account was shut down.

The technique Nazario described isn't sophisticated, and a couple of hundred infected computers is small when some botnets contain hundreds of thousands of infected PCs. But it shows how criminals are finding inventive ways to exploit legitimate social networking services to help with their dirty work. One reason social networks are an attractive target for crooks is because their content is hard to monitor, and because people click on lots of links inside their accounts, which is a key way computer infections are spread.

Read more...