Thousands Of Google Images Infected With Malware

That picture of a cat licking a lollipop you found on Google Images may be infected.

According to the SANS Internet Storm Center, a number of Google Images are actually infected with malware that misdirects users to pages that try to sell fake anti-virus scareware and to makes users believe they must download the program to avoid viruses.

These scammers use photos from third-party sites so that the images appear to be legitimate, using top search terms from Google Trends so that the content on the page also seems real.

When a user clicks on an infected thumbnail, his/her browser sends a request to the infected page, which then runs the hacker's script, and then redirects to the site trying to peddle scareware. SANS guesses there are over 5,000 hacked sites, with Google referring about a half million visits to these fake sites each day.

While researcher Bojan Zdrnja has developed a Firefox add-on that displays the infected images with a border in red, it is not yet available for public use.

Google spokesman Jay Nancarrow told Krebs on Security that the company is making "active efforts to improve both the quality of the results and malware detection. We're improving, as are the people trying to put users at risk, and in the interests of those users it's best if we don't reveal everything that we're doing about this."

Comments

[jadeba]

03:47 PM on 05/10/2011

Okay, there seem to be a lot of folks who know a lot more about computers than I do. This week my friend got hit with the phony "Mac Defender" virus protection thing. It's phony, does not exist but is the means to acquire cc info. It is exactly what happened to my friend. Evidently happens to those running Mac OS X, using Safari). The article is on macdaily news - titled "Mac Under a Virus Attack - No" (not technically a virus, but malware or a Trojan) but they talk about this scam. Her laptop is now going to her tech people. I'm a Mac user and never worried much about this stuff but now I guess I have to.

[gws1968]

12:53 AM on 05/11/2011

This is where you want to go for instructions to get rid of the Mac Defender. It's free and they will walk you through it.

http://www.bleepingcomputer.com/virus-removal/remove-mac-defender

[Kristina Lee]

01:53 PM on 05/17/2011

Macs unfortunately get viruses too. I wish Mac users didn't have that false sense of security. Use WOT, and Malwarebytes on top of your virus protection and you shouldn't have much problem. :)

[fjawodfc]

03:36 PM on 05/09/2011

Misinformation and/or ignorance. Who comes up with this stuff? First of all, the IMAGES are not "infected". The web server just redirects you to another page when you access them, just like plenty of legit images/servers do. Second, you can't get infected simply by visiting a web page. You still have to explicitly choose to install the fake anti-malware software before anything bad can happen.

[vibroluxor]

06:19 PM on 05/09/2011

thanks for correcting my earlier post - I did mean to say what I had posted below

[filo]

08:09 PM on 05/09/2011

Sorry but I am a PC tech and you can get infected with fake anti-virus software just by visiting a sight. They hack into legit sites. Both Google and the NY Times were hit. Google got it out quick but just think how many people hit them in an hour. I have had many customers get fooled into thinking it is their own AV software and give out their card #. From what I have read the Russian mob is behind a lot of this.

[fjawodfc]

03:54 PM on 05/27/2011

You still don't get it. Your "customers" still had to take some conscious action after visiting the sites, such as providing their credit card numbers. Simply OPENING the web site doesn't INFECT anything.

[vibroluxor]

10:25 AM on 05/09/2011

the issue isn't google images, is it? it wouldn't matter if you used google or bing or netscape either. the problem is compromised servers.

[Flying Sparkz1]

10:07 AM on 05/09/2011

This page requires AC_RunActiveContent.js.

Is anybody else seeing this box when they switch pages on the Huff Post? Is it malware?

[filo]

08:10 PM on 05/09/2011

Not me.

[John Crane]

06:06 AM on 05/09/2011

While it's crawling the internet and adding to its database, I would like to see Google do two things. In fact, if any search engine did the following two things and provided an assurance to users that is was doing this, it would quickly become the most popular search engine.

1. Before adding an image to the data base, check it for malware, and reject infected images.
2. Periodically check its database and make sure the sites it references still exist (no dead links), and are accurately keyworded (more accurate searches).

In search results, prefer quality over quantity.

[kmg90]

06:12 PM on 05/29/2011

The problem is the "infected" websites which have these "infected" images are designed to manipulate what the "google spider" sees, in which if it detects that google is browsing the site (via the spider) it will direct it to a "legit looking" page which their is nothing harmful on it.

When the user clicks on the "clean" result, they get directed to the the scareware sites with the fake security notices.

[Nexstepper]

02:13 AM on 05/09/2011

Thank you, BYTHEO, for confirming my suspicions around my encounter with SCAREWARE>
This article re: Google's infected images bears out its origin; the cryptic quote at the end seems to suggest that there are people working on the problem. Tonight I returned to the Google site and accessed images for the Archangel Raziel, without incident. Ironic, Raziel is the Keeper of God's Secrets in the Kabbalic pantheon. The scribe and protector of Higher Knowledge, he gave Adam and Eve the Book of Life to lead them back to the Garden, but God threw it into the sea. It comes as little surprise that there's a bit of a rift between them, but the archangel had better luck with Solomon.
Yet it rings true that I have been blessed with the acquisition of special knowledge; the amalgam of digits in my and my elder daughter's birthdates comprise not only my partial password these last 12 years, but also the dates of the first two major earthquakes this year; New Zealand and Chile. When I first published this numerical sequence on FB, it became a link. That was the first time I was beset by trojans, malware, and spambots over 2 months ago. I bought the Firewall (Internet Security Shield) required.
The numerical sequence remains, but it leads to a blank FB page with my name on it.
Methinks I'll use a public computer to access it, just to be safe.

[kraki]

11:53 PM on 05/08/2011

Better info from here. Its javascript, in an iframe+malware. I havent been hit but run linux, malware means nothing even if javascript is on.
http://www.net-security.org/secworld.php?id=10989

More :
http://search.slashdot.org/story/11/05/07/229200/Poisoned-Google-Image-Searches-Becoming-a-Problem

Kraki

[stmpoodle]

11:53 PM on 05/08/2011

Just use Bing. It's better.

[vibroluxor]

10:20 AM on 05/09/2011

You were misled by the headline, which was totally wrong. it wouldn't matter what engine you use, a large percentage of images on serves are infected.

[fjawodfc]

03:38 PM on 05/09/2011

That's not right either. The images are not "infected" any more than a car that you could use to drive to a biological weapon factory is "infected".

[filo]

08:11 PM on 05/09/2011

yup

[NevaforLeadership]

11:40 PM on 05/08/2011

Creating malware, viruses and spam, such as e-mails advertising drug sites, with broken up subject lines to fool filters, and dissemination of them should be made international criminal offenses. It there is no such international avenue of justice, then it's time one was created.

[mathme]

11:27 PM on 05/08/2011

The most annoying thing about those is that they shrink my FF window down to probably the absolute smallest size possible, and after a forced quit, it reopens that same size. The people who do this should be sterilized.

[eaglespark]

11:07 PM on 05/08/2011

Yeah... sometimes I look at all the keys in pocket, and the anti-virus software I need to use, etc., and I think: "What the heck?.." ;>)

[indecisiveh]

10:34 PM on 05/08/2011

Nothing a good browser and virus protection can't solve. You people know nothing of the machines you so heavily rely on.

[ls1z28chris]

07:25 PM on 05/08/2011

I had this happen to me a couple of times while looking for Cisco icons for logical topology maps. I click on the thumbnail and get a prompt to download an anti-virus program. It won't let me say no. So I force quit the browser and run a virus scan. The scans turned up no malicious code, so I seem to have been safe. I've had friends running Windows, though, that get caught with browser hijackers.

[sfstewart]

06:30 PM on 05/08/2011

Happened to me this weekend. Part that really sucks was that I wasn't even looking at dirty pictures this time. Who spams art? Jerks!

[SillyCon]

04:38 PM on 05/08/2011

It's wonderful to see that a Firefox add-on has already been developed to identify the infected images. Hopefully this will translate into filtering options when image searching.