Mountain View (CA) – Google is painting a scary scenario about potentially dangerous websites on the Internet: More than 1.3% of all search queries are now directing users to at least one malware site – and only seven out of ten threats are caught by the best security applications available today.

Google limited its research (PDF) to pages that contain so-called drive-by download web pages, which are installing and running malware on client PCs without user action. According to the company, such drive-by downloads are now hiding in more than 3.4 million URLs on more than 181,000 web sites. The research results also suggest that more and more search results provided by Google point to malware sites: While less than 0.3% of search queries contained a link to at least one malware site one year ago, the rate has gone up to about 1.3% at the end of the year.  

From the top 1 million web site addresses listed in search results, Google found about 6000 to be malicious – which means that, on average, 0.6% of the most popular web pages in Google search can lead to malware exposure. The most popular malicious web page has a rank of 1588 of 1 million. Most malware sites (67%) are hosted in China, followed by sites in the U.S. (15%), Russia (4%), Malaysia (2.2%) and Korea (2.0%).  

The company’s researchers also found that antivirus software may not be sophisticated enough to reliably protect users from web threats: Google found a 70% malware detection rate for the best anti-virus engine with the latest set of definitions.  “These results are disturbing as they show that even the best anti-virus engines in the market fail to cover a significant fraction of web malware,” the reports states.
 
“Merely avoiding the dark corners of the Internet” will not protect users from malware exposure, Google believes. “State-of-the-art anti-virus engines are lacking in their ability to protect against drive-by downloads. While this is to be expected, it does call for more elaborate defense mechanisms to curtail this rapidly increasing threat.”

Google said it examined about 66.5 million URLs for this report.

Prelude to a Google anti-virus offering?

Feb 19, 2008 15:24     

Now that Google has found the problem, will they be offering a (free) solution? If it was easy to design a perfect anti-virus, it would already have been done.
Bernard report abuse vote down vote up Votes: +0

China - greatest economy?

Feb 19, 2008 15:36     

Nope, just the world's most powerful botnet.
matt report abuse vote down vote up Votes: +0

Next Headline: Google Launches free ad based AV

Feb 19, 2008 16:05     

Yah sounds like they are getting ready to launch their own AV program.
Pete report abuse vote down vote up Votes: +0

If they have the ability to identify malware sites ...

Feb 20, 2008 05:17     

If they have the ability to identify malware sites from search results surely they should be able to block them before returning the results? Or is that too easy to do?
Bill report abuse vote down vote up Votes: +0

Google AV offering...

Feb 20, 2008 06:47     

Would be pretty cool. Like an above poster said though; if it were easy it would have already been done. I guess I can hope.
Ryan report abuse vote down vote up Votes: +0

If they can tell ....

Feb 20, 2008 08:45     

... that these sites are malware sites why doesn't Google filter them out of search results?
MT report abuse vote down vote up Votes: +0

Google Anti-Virus version 1.0

Feb 20, 2008 08:48     

lol it would be nice but I doubt it the big companies like Norton's and McAfee will sue them or do something to prevent it. A friend of mine once suggested that the big av houses create their own viruses just so people will buy their anti-virus software. Because with out new viruses people could be using Norton's Anti-Virus 2005.
ThomFrost report abuse vote down vote up Votes: +0

os-dependent?

Feb 20, 2008 10:41     

Is this malware os independent or does it affect just Windows users? I use eComStation on my pc and not worried about malware if it is (mostly) a Windows thing.
TomLeeM/BigWarpGuy report abuse vote down vote up Votes: +0

hmmm

Feb 20, 2008 12:59     

they already hav a filter, if a site is found to hav malware, google 1st says dat the site contains malicious programs, then asks the users if they still want to continue
Aayman report abuse vote down vote up Votes: +0

Another Bulldog A/V product

Feb 21, 2008 02:23     

The vast majority of ads that appear on Google's site are links to malware sites anyway. Much like Bullsh*t Antivirus, I bet they'll bombard you with ads to make their software free. Bullsh*t Antivirus has been included with Kazaa for God knows how long now, and Kazaa is one of the most spyware/adware-infected pieces of garbage that you can download, yet Bullsh*t conveniently doesn't detect any spyware or adware from it. I'd bet money that Google does the same. Note to Wolfgang: Google never actually does any research - they just collate data from other sources. Remember that hard drive defect rate study "they" did awhile back? It was data that was collated from studies that were performed that predate Google's existance.

Waethorn report abuse vote down vote up Votes: +0

Bop

Feb 21, 2008 13:35     

Just use VMware and a Firefox browser and it won't hurt your computer because it's all virtual.
Ben report abuse vote down vote up Votes: +0

re: Ben

Feb 22, 2008 00:56     

....unless you're connecting through a network connection. Malware can still easily jump through network connections. VMware doesn't sandbox virtual machines from physical machines when you use network connections. If you want to isolate your browser from your OS, you need a completely sandboxed solution, and Firefox just doesn't do that. Sorry. The best solution so far is IE7 in Protected Mode in Windows Vista. It's prevented several browser exploits from allowing access to the underlying OS. Protected Mode is only available on the Windows Vista version too, so although IE7 is hugely more secure than IE6 running on XP, now that they've taken out the hooks into the Windows Shell, it's still not as secure as Windows Vista. Application virtualization is another way to do it too, since applications (and thus malware) can't see network connections. Most new application virtualization technologies (at least thoses made by Microsoft, such as SoftGrid) utilize encrypted API communications and don't "see" standard TCP/IP communications, so the likelihood of any malware gaining access outside of the virtualized application is slim to none. SoftGrid support will be available in some versions of Windows Server 2008.

Waethorn report abuse vote down vote up Votes: +0

re: re: Ben - Firefox VMware should work fine

Feb 23, 2008 05:34     

@Waethorn You appear to offer good information, but you sound like a damn MS infomercial. Also, although you may be correct, I would bet 99% of malware downloaded from the Web installs itself into the OS the browser is running on and wouldn't be able to traverse though the VMware NAT to the Host OS. I mean, how would something like that work. If indeed that COULD work, then why wouldn't said spyware be able to randomly spread itself through the entire internet to different IP addresses? For the VMware Firefox solution, assuming spyware was installed on the virtualized OS, wouldn't it need to exploit a service running on the Host OS in order to spread itself out of VMware? In addition, VMware network connections go through a virtual adapter of the Host OS, and I bet you'd be able to set it up so as to completely firewall the virtualized OS from the Host OS so the virtual OS browser can ONLY access the internet and NOT the host OS.

sam report abuse vote down vote up Votes: +0

antivirus software

Mar 17, 2008 15:57     

Websites that captains viruses are very dangerous.We can not know such site opening.So you should strong anti virus system.
Virus Software report abuse vote down vote up Votes: +0