Google warns drive-by downloads up 300 percent

Summary:Drive-by downloads, in which malicious Web sites exploit browser vulnerabilities to execute malicious code, have increased since April 2007, warned Google researchers have warned.

Drive-by downloads, in which malicious Web sites exploit browser vulnerabilities to execute malicious code, have increased since April 2007, warned Google researchers have warned.

In April 2007, fewer than 0.4 percent of searches returned at least one harmful result. However, it increased to over 1.3 percent in January 2008, warned Google researcher Niels Provos in a Google blog post.

Drive-by downloads use URLs which target Web browser vulnerabilities to download and run malware automatically when a user visits the site.

Targeting Web browser vulnerabilities can circumvent some traditional security systems, such as firewalls.

The Google researchers investigated billions of URLs over the past year and a half, and found more than three million unique URLs on over 180,000 Web sites automatically installing malware, said the blog post.

Web servers are targeted to host the malware. The researchers blamed poor patching of Apache and PHP servers for the amount of compromised sites. The Google researchers also wrote in a paper called All Your iFrames Point To Us that 67 percent of compromised servers and 64 percent of the Web sites that link to them are located in China.

"These results raise serious question about the security practices employed by Web site administrators," wrote the researchers.

According to a Google source, Google security researchers report compromised sites to StopBadware.org, a clearinghouse for Web malware research run by Harvard Law School, Oxford University, and technology companies including Google, Lenovo and Sun.

Google searches return all results, including suspect sites, to a user. However, Google uses the StopBadware.org list of compromised sites to place "interstitial pages" (pages that sit between the search results pages and the suspect page) between the user and the suspect site they wish to visit. Once the user has been warned that the site is probably compromised, they have the option to then click through to the site if they wish.

Topics: Google, Malware, Servers

About

Tom is a technology reporter for ZDNet.com, writing about all manner of security and open-source issues.Tom had various jobs after leaving university, including working for a company that hired out computers as props for films and television, and a role turning the entire back catalogue of a publisher into e-books.Tom eventually found tha... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.