Thursday, April 17, 2008

Google Groups Porn Malware Invasion Continues Unabated

Wow, what a cluster f*. Hundreds of thousands of pages, if not over a million.

Examples (warning: graphic language):

Googlegroups12388888


Googlegroups12388888a

Most of these push videos that push fake codecs.

But it�s not just malware. There�s spam-a-plenty:


Googlegroups12388888b

And there�s also splogs pushing malware, not as porn, but just off of keywords. Here�s a search for �Symantec Download�:

Googlegroups12388888c

Click on a link, and you get this page:

Googlegroups12388888d

That file being pushed, setup.exe, is a trojan.

Or, let's use the search term �McAfee download�:


Googlegroups12388888e

(I�m not picking on these AV companies, if you do similar searches for Sunbelt products, you�ll hit these types of things as well.)

These slimeballs are using all kinds of keywords. Here�s some more, like Blackberry Ringtones and Free Messenger Download, returning spam links:

Googlegroups12388888f


Googlegroups12388888g

Or how about keeping it simple, and just saying �free download�? Malware!

Googlegroups12388888h

I�m not making this up. Crank up a virtual machine and try these searches yourself.

Last week, I was quoted as saying that this invasion is due to Google�s CAPTCHA being broken, and this was rebutted by another. I beg to differ: A large part of this is most certainly caused by bots uploading stuff, breaking the CAPTCHA. They may not break it all the time, but they do break it probably 10% of the time. That�s enough to upload a ton of garbage.

This has to, has to stop.

Alex Eckelberry

No comments:

Post a Comment