Beware Google Wave links

Stephen Withers
Monday, 19 October 2009 06:02

Business IT - Security

Interest in Google Wave is being exploited by people behind malicious web sites, according to a security software company. Looking for an invitation could result in a malware infection.

With only 100,000 or so invitations to the Google Wave beta having been issued so far, demand greatly exceeds supply. And that level of interest is being exploited by people behind malicious web sites.

Those using Google searches to try to gain an invitation risk landing on a page that attempts to install malware on their computer. According to Kane Lightowler, Imperva's regional sales director for Australia and New Zealand, the bad guys are using techniques such as Google search poisoning to attract people to malicious sites.

"We've seen this happening," he told iTWire.

Lightowler explained that one approach involves linking to the malicious page from reputable sites either by using exploits that allow the alteration of content hosted on a server, or simply by leaving comments. Embedding the right keywords makes the target appear a better match to Google, and setting the link text the same colour as the background means it is less likely to be spotted by the site administrator.

"Google Wave is a very topical search term at the moment," says Lightowler, which is why it is being targeted.

He suggests individuals run up to date security software on their computers and keep it up to date. Browsers such as Firefox and Chrome warn of dangerous search results, and there are various add-ons for other browsers to provide similar protection.

Organisations should take steps to ensure the security of their web servers to prevent such malicious defacements. Previous attacks have concentrated on high-profile sites which have now tightened their security, so attention has shifted to compromising larger numbers of smaller organisations.

One way this can be readily achieved is by attacking a service provider's server that hosts multiple sites.

"Small or large [sites] are not immune" to the crooks' attention, said Lightowler. And the processes needed to mount such attacks are becoming automated, he warned.