Robert Siciliano explains a Google search vulnerability that silently redirects users to servers delivering malware, turning their PCs into botnets. Wired, USA Today, and History.com were compromised. The malware runs invisibly unless you dig into your system.
Chapters
Google is so popular its brand name has become a verb. Some hackers have apparently found a way to take advantage of that popularity. They could hijack your computer and grab your information and wouldn't leave you with a clue. The Google bug. Next. It's a security problem with the potential to affect millions and millions of us online. Well, that's the word from computer experts who now say hackers have figured out a way to launch spam attacks and steal personal information from those who search through the Google system. Cyber crooks are now manipulating the computer code of the popular websites so that all you have to do is Google or Yahoo this site, a bug can secretly be installed on your computer and you don't know anything about it. That's when the trouble starts. With us now from Boston is the internet security analyst and CEO of IDTheftSecurity.com, Robert Siciliano, good to see you, sir.
Good afternoon, Shepard.
Explain to me the basic— I guess this has to do with JavaScript. For people who don't know, JavaScript is what sort of makes your website pretty. Like when you run your mouse over something and it changes colors or something like that, it has to do with that, right?
JavaScript has been corrupted, or at least they've created a malicious code that works alongside JavaScript, and when the user searches through Google, they click on a link that brings them to a website that's infected, at the exact same time they are also redirected to another server that actually uploads an executable, a malicious program, a virus, to your own computer, infecting your PC.
You know, I've never heard of this before. When did this start? And how serious— this sounds like it could be very serious.
Actually, this technology manipulating a website to incorporate malicious code has been around for quite some time now. It's becoming more and more prevalent, especially over the past couple years, as computer users are understanding what it is that they have to do to protect themselves. So it's been around, and now it's, it's become the, the new way to really get to a person's computer.
Let's see how much I know about computers. I know that Wired, USA Today, and History.com are among the really popular ones where where people are having problems. What do you do to avoid this?
Really, the responsibility lies twofold. For one, the websites that are infected, those providers, they need to make sure that their websites are free and clear of this code, that they're doing everything they can on their end to protect their information, to protect their servers. And then for the consumer, you and I, those who are using the search engines, accessing the web, going to these sites, we have to make sure that our virus definitions are updated, that our software is all updated, that making sure that at all times that the machine that you're working from has the utmost security, the, the most updated virus definitions, so that you cannot be infected by this malicious code.
And, and will you know it once you have it, or is just there no way?
They operate in a way where everything happens in the background. You're unaware of what's going on, and your computer could literally be used as a server, as something which is called a botnet, which is another term is a a robot network of computers that are infected by this virus that can be remotely controlled by this criminal hacker from anywhere in the world. You will not know that it's actually happening to you unless you actually go into the bowels of that PC and understand what all those different applications that are running mean.
Robert Siciliano, something to watch for. Thank you, sir.
