• Total Posts: 43050
  • Total Topics: 16231
  • Online Today: 5605
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)

Author Topic: Security Filters Often Flag Legit but Infected Sites  (Read 3639 times)

0 Members and 1 Guest are viewing this topic.


  • SCF Administrator
  • *****
  • Posts: 7528
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • - Samker's Computer Forum
Security Filters Often Flag Legit but Infected Sites
« on: 13. April 2008., 09:19:23 »

Up to 80 percent of Web sites flagged as malicious by antivirus and search engine indexes are legitimate businesses, according to security experts.

Experts said while the security industry is on top of conventional spam and phishing attacks, more effort needs to be put into preventing and eliminating so-called drive-by-downloads.

The attacks allow hackers to redirect massive amounts of traffic by inserting malicious IFRAMES into legitimate Web sites. The hacks are usually invisible to Web site visitors and do not often draw attention from security personnel because they only require a single line of code to be manipulated.

Sophos CTO Paul Ducklin said affected organizations risk losing business because they are flagged as malicious by search engines such as Google, and anti-phishing software.

"You could imagine the business lost if one of only three or four local sign writers were tagged in a search as malicious," Ducklin said.

"It can be very expensive to fix iframe attacks because they can originate externally or internally, and they have a very small footprint."

Compromised Web sites can turn into virtual breeding grounds for further attacks, according to Ducklin, because they are easy targets for hackers wanting to inject additional malicious IFRAMES.

A 2007 Sophos survey found that more than 80 percent of Web sites listed as malicious were legitimate organizations that had been compromised by various attacks including iframe injections.

Ducklin said Sophos "tries to be fair" and revisits Web sites to see if they are still carrying the exploits, but could not specify exactly how long businesses remain blacklisted by security vendors or search engines.

While a Google spokesperson contacted by Computerworld refused to comment on how often the company re-checks flagged Web sites, Google employee Phil Harton said in a blog that the process can take up to two weeks.

"We've begun sending email notifications to some of the Web masters of sites that we flag for badware. We don't have a perfect process for determining a Web master's e-mail address, so for now we're sending the notifications to likely Web master aliases for the domain in question," Harton said.

"We're planning to allow Web masters to provide a preferred email address for notifications through Web master tools."

IBRS security consultant James Turner said work still needs to be done to make it easier for Web masters to clear themselves off blacklists once they have removed malicious code.

"People have had to deal with attacks that use their domains to send spam to clients, and security vendors black-listing them because of it, so the concept is nothing new," Turner said.

"There are protocols in place to allow them to clear their Web site off the lists, but there really needs to be more [solid] procedures in place to streamline the process.

"It's a bit like the Wild West; everyone is scratching around trying to find the best solution for the problem."

The response times vary depending on the extent of infection and how quickly exploits are fixed, according to, a security watchdog used by Google to identify and evaluate malicious Web sites.

"Google is the sole decider for initial decisions to post a warning page for a Web site [and it] does not rely on any testing or reports from StopBadware in making these initial decisions," the company stated on its Web site.

"If Google does not find that the site is clean, Google notifies StopBadware [which] then performs further detailed testing [and will] notify the site owner."

(Copyright by PC World Communications, Inc.)

Samker's Computer Forum -

Security Filters Often Flag Legit but Infected Sites
« on: 13. April 2008., 09:19:23 »


With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters)

Enter your email address to receive daily email with ' - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising