Daily cyber threats and internet security news: network security, online safety and latest security alerts
March 28th, 2008

Google Helps Most Phishing Sites

Researchers from MarkMonitor, a brand-protection firm, compiled a list of 750 Google search terms that are used to track down websites likely to have easily exploitable vulnerabilities – mostly PHP-based sites. Three-quarters of phishing sites are built on hacked servers that have been tracked down using pre-programmed Google search terms, according to the research. Among other activities, MarkMonitor tracks phishing attacks that target brand names.

MarkMonitor found that 75 percent of the phishing sites it had discovered had been originally tracked down using one of the list of 750 Google search terms. The finding was based on a sample of one-quarter of the phishing sites logged by the firm.

The search terms return a list of sites likely to have particular vulnerabilities; the attackers then exploit the vulnerability, gain access to the site, and then use it to host malicious code, counterfeit web pages (phishing) and spam redirection “doorways”, as part of the scam. Search terms, are actively traded on internet forums, and are routinely scanned by IRC-based “bots”, which also scan Yahoo and AOL Search results, according to MarkMontitor.

Google has already made moves to block automated exploitation, but they can still be used manually. The websites exploited tend to be small, local PHP-based sites, which are less likely to have the latest patches installed, and are invaded via one of more than 1,800 known PHP bugs.

Auction sites are the biggest targets, accounting for 44 percent of the phishing emails in the fourth quarter, up from 36 percent in the first quarter of 2007. In the fourth quarter of 2007, 412 organisations were targeted by phishing attacks, up 37 percent from the same period in 2006, according to the firm’s brand-jacking index, published last month.

Share this item with others:

More on CyberInsecure:
  • Trojan Poses As Google Chrome Browser Extension
  • Another Google Adwords Phishing
  • Phishing Attacks Doubled In UK
  • New Security Warning Feature Added On Facebook
  • Another Google Adwords Phishing Attack In Progress

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Google Helps Most Phishing Sites

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.