Search results poisoned to distribute scareware

Feb 10, 2010 10:01 GMT  ·  By
Cyber-crooks poison search results for George Clooney and the Oscars
2 photos
   Cyber-crooks poison search results for George Clooney and the Oscars

With the Oscars rapidly approaching, the associated black hat search engine optimization (BHSEO) campaigns have already started. Security researchers from ALWIL Software, the creators of Avast! antivirus, warn that searching online for information about Academy Award nominees has a high chance of leading to scareware.

The 82nd Academy Awards ceremony will take place less than a month from now, on March 7, 2010. One of the movie stars rumored to have the biggest chances of winning the award for Best Actor this year is George Clooney, for his leading role performance in the critically acclaimed drama "Up in the Air."

However, according to Jindřich Kubec, senior programmer at ALWIL, searching for keywords such as "clooney oscar" on Google will generate results poisoned with malicious links. These rogue websites take visitors through a series of silent redirects to Web pages bombarding them with fake security warnings.

These bogus alerts have the purpose of tricking users into downloading and installing scareware on their computers. The term of scareware refers to computer programs that masquerade as antivirus scanners and security products. Once these applications infect a computer, they generate reports of fictitious infections and instruct users to pay for license fees in order to resolve the made-up problems.

Mr. Kubec points out that having good surfing habits is not enough to stay clear of these programs, as cyber-criminals will exploit every single event that raises a considerable amount of interest over the Internet. And it doesn't appear there's much Google can do to put a stop to these black hat search engine optimization campaigns either.

It is therefore more sensible for users to try and protect themselves by surfing the Web with a reliable and up-to-date antivirus program running on their computer. Firefox users can install NoScript for an extra layer of protection. NoScript is a browser extension that blocks untrusted JavaScript by default and is generally able to thwart these attacks.

Photo Gallery (2 Images)

Cyber-crooks poison search results for George Clooney and the Oscars
Scareware fake infection alert
Open gallery