Forum Moderators: Robert Charlton & goodroi

Message Too Old, No Replies

Google Pops Malware Warning Interstitial - without using any Google site

         

Angonasec

12:53 am on Sep 3, 2008 (gmt 0)



G have long been warning in their serp that a site may harm your computer, but this is new to me...

My platform is Mac, FF, with Addons; NoScript, MacAfee SiteAdvisor, and AdBlock Plus.

I was NOT using any Google site or feature, but tried to visit two sites I regularly go to +from a bookmarks page on my desktop+.

The first was a Formula One news site, the other a cycling enthusiast site, nothing dodgy at either usually.

However, a semi-opaque interstitial warning page covered my browser view warning me that the site I'm trying to visit may harm my computer, and according to my setting I am being warned, proceed or not?

Instead of visiting, I clicked on the "More info" link and was taken to a Google url (sorry I didn't save the url) with data on the site's malware problem, and last 90 days scanning results. It seems they had some harmful script inserted in their ads by a third party.

I removed those sites from my bookmarks page.

What concerns me, is that later I realized that I hadn't used any Google feature to visit those sites, so how did G know I was going to them?

I didn't go through G search, or a G bookmark. I went through a simple homemade bookmarks page on my desktop.

I have a Google account that I remain logged into most of the time. I use it for sitemaps, and the Google removal tool, G alerts, and of course G search.

However when I looked in my G account settings for anything remotely like, "Warn me if I ever try to visit a dodgy site", and there's nothing there remotely like that. I use the default "moderate" setting to stop filth showing in the serp.

So, how come G popped the interstitial, when I wasn't using any G site feature I'm aware of?
Too spooky.

All I can guess is that McAfee are collaborating with G on the Site Advisor feature, and extending it's reach beyond the G serp? Or perhaps it is the NoScript addon people who G are collaborating with?

Normally when the McAfee addon warns you about a dodgy site it will point you to an info page on the McAfee domain, not the Google domain.

Anyone else seen this recently? Was it a test run, a slip-up, or old news?

Interestingly, I visited the same F1 site today using the same method, and got no warning interstitial, nor did the G serp listing of this site have any warning note.

tedster

2:55 am on Sep 3, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I've never seen that. I have seen interstitials for malware warnings, and it's a lot better for the end user than a simple warning on the SERPs.

Since you are working from memory on this and you can't reproduce the effect, are you very certain that a regular bookmark in your browser triggered the interstitial page? Do you ever use Google Bookmarks [google.com]?

aeclark

5:04 am on Sep 3, 2008 (gmt 0)

10+ Year Member



You mentioned you have Firefox installed. Perhaps it is the anti-malware component of firefox that is responsible? See: [mozilla.com...]

Angonasec

1:47 am on Sep 4, 2008 (gmt 0)



Thanks Ted, no I never use Google bookmarks, I used my self-made desktop html bookmarks page.

Thank you aeclark; yes that certainly looks like the source of the interstitial I saw. Full screen, and two buttons, "Get me out of here" and "Why was this site flagged?. It must be from Firefox 3.0.1

What is still strange is that the info page you're taken to is a google url, not a Mozilla one, and it reports the results of Google scanning the naughty site for the last 90 days.

Will the release of "Chrome" change this? The Firefox people will have to arrange their own site scanning or do a deal with McAfee to avoid pushing FF users to "Chrome".

Anyway, I'm pretty sure the interstitial came from FF, thanks.

And yes it is good to be warned about malware, and cross-scripting attempts.

jdMorgan

2:05 pm on Sep 5, 2008 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



> Will the release of "Chrome" change this? The Firefox people will have to arrange their own site scanning or do a deal with McAfee to avoid pushing FF users to "Chrome".

No, Google makes their potentially-malicious site data freely available to all.

I've seen the warning you describe, and the "Get me out of here" is definitely what I saw using the Firefox/Google bad-site warning feature.

Jim