Channel Register

Brute force attack yields keys to Google's kingdom

Anonymous Coward

John C. Dvorak talked about this in his column weeks ago. 

John C. Dvorak talked about this in his column weeks ago.

http://www.pcmag.com/article2/0,1895,2188281,00.asp

James

It must be your computer 

I have no "rogue sites" in my google results.

your computers are probably infected with some sort of spyware that replaces the google search page with its own trash.

Anonymous Coward

Maybe they fixed it 

James - Maybe they read this article and fixed it.

We already know that google manually modify search results don't we, one of my mates used to do this for a job.

steve lampros

hahah @james . . . . 

yeah that must be it. if we can't see it then it must not be true.

Richard Kilpatrick

How odd... 

I clicked the provided link, removed the ?, and watched as information about Toyota Supra nonsense appeared.

No malware on my machine at all. How peculiar.

I guess it must not work on OS X or, presumably, anything other than Windows ;)

Alan Donaly

Something to do with a javascript 

and long word lists the owners use .name registration for the script and .cn to host the list and all the pages are alphabetic jjhg.html xzc.html.I have been trying to figure out what it does exactly for a couple of weeks it seems to be tied in to links from spam emails using the I'm feeling lucky url encoded query string to unblock known spamvertisers

for that to work it has to be the number one search result it's not supposed to be possible to just dial in a number one search result is it.If it is I want to use it Google better beat me to it.

Matt Cutts

Quick update 

Hi Dan, I left a quick update on my blog, but the short answer is that we've recently made some changes that should help address this issue.

More info if you're interested is here:

http://www.mattcutts.com/blog/still-chugging/#comment-113783

Anonymous Coward

malware 

do a search for something like LadsLads

and toward the bottom of the results are such sites, which look like YouTube player but infact activex malware installers

A J Stiles

Impressive ..... 

When I visited the site linked from the Dvorak article, I got a page of nonsense words; I was then redirected to a site with a message to the effect of "Now scanning C:\WINDOWS\system32\32\drivers\..." Repeat visits redirected to various different sites. Later, it told me I was infected with Backdoor:Win32/NTRoot, Backdoor:Win32/Sivuxa. and Trojan:Caiijing.

Considering that I'm running Debian on a pure 64-bit system (no 32-bit code *at all*), that is truly impressive!

Danny

John C. Dvorak and crankygeeks.com 

"John C. Dvorak talked about this in his column weeks ago.

http://www.pcmag.com/article2/0,1895,2188281,00.asp"

OT but, there's a link from the pcmag site to JCD's crankygeeks.com where he has a video magazine thingy. Watching the latest episode now (#83) and noticed there's some guy on the show called Drew Cullen from The Reg...

Anonymous Coward

Google improved, still a problem on Yahoo and live.com 

The following search terms:

Bayesian networks decision graphs rapidshare

Produces mostly pukka pages on Google now, but still returns a load of .cn sites on Yahoo and live.com

Anonymous Coward

Google *is already* Spammed 

The Google index is full of garbage; search for almost anything and you'll get a blizzard of results for referrers, pretend blogs and abandoned domains now pointing at even more referrers. Sure, no one has been able to directly manipulate the Google index but all you have to do is keep saturating the index in enough dud web sites and they'll start appearing. We all know Google is under persistent attack from the pond scum that inhabit the Internet and this just confirms it.

Simon Painter

@Anonymous Vulture 

But then nobody cares what John C. Dvorak says anymore.

Anonymous Coward

How to prevent accidental clicks. 

#1. Just don't make it a link.

#2. If you insist on making it a clickable hyperlink, break it by munging the hostname part of the URL, not the URI path, because if it's not a real webserver but a malware-hosting-zombie, it's entirely likely that it completely ignores the path and just returns the same exploit for all URLs on the supposed website.

What you've done here is the worst possible way of trying to protect your readers. I suggest you edit the article and de-linkify it ASAP.

James Cleveland

@Simon Painter 

Too true, I learned to ignore him after he mindlessly attacked Chris Boyd (aka Paperghost) for reporting a valid problem with bittorrent.