June 4th, 2009

Typo'd Google domains in Top 10 malware exploit sites

Posted by Ryan Naraine @ 8:55 am

Categories: Anti Virus, Botnets, Browsers, Data theft, Exploit code, Google, Hackers, Malware, Phishing, Rootkits, Viruses and Worms, Zero-day attacks

Tags: Google Inc., Domain, Malware, Site, Spyware, Adware & Malware, Cyberthreats, Viruses And Worms, Security, Ryan Naraine

Misspelled versions of two popular Google services are among the Top 10 sites hosting exploits for use in drive-by malware download attacks.

On the heels of two massive drive-by attacks — ten of thousands of hijacked sites launching attacks via the browser — Google released a list showing that malicious hackers are typo-squatting on its domains to evade detection and to keep malware sites alive for long periods.

Here’s the top 10 list (click image for full size):

The list above contains domains referenced by hacked Web sites.  According to Google, all domains on the top-10 list are suspected to have compromised more than 10,000 web sites on the Internet

Google scans its index for dangerous Web sites and, according to Niels Provos, the company’s automated systems found more than 4,000 different sites that appeared to be set up for distributing malware by massively compromising popular web sites.

Of these domains more than 1,400 were hosted in the China’s .cn top level domain.

Several contained plays on the name of Google such as goooogleadsence.biz and googleanalystics.net.

As an example, he’s what Google’s Safebrowsing API is reporting for one of the typo-squatted attack sites:

What happened when Google visited this site?

Of the 17903 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2009-06-04, and the last time suspicious content was found on this site was on 2009-06-04.Malicious software includes 521 scripting exploit(s).

This site was hosted on 68 network(s) including AS21826 (Internet Cable Plus C. A.), AS8708 (RDSNET), AS39539 (NETONE).

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, goooogleadsence.biz did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 10808 domain(s), including antique.gov.ph/, suratthani.m-society.go.th/, tesseract.mn/.