We are constantly working on detecting sites that are compromised or are deliberately set up to infect your machine while browsing the web. We provide warnings on our search results and to browsers such as Firefox and Chrome. A lot of the warnings take people by surprise — they can trigger on your favorite news site, a blog you read daily, or another site you would never consider to be involved in malicious activities.
In fact, it’s very important to heed these warnings because they show up for sites that are under attack. We are very confident with the results of our scanners that create these warnings, and we work with webmasters to show where attack code was injected. As soon as we think the site has been cleaned up, we lift the warning.
This week in particular, a lot of web users have become vulnerable. A number of live public exploits were attacking the latest versions of some very popular browser plug-ins. Our automated detection systems encounter these attacks every day, e.g. exploits against PDF (CVE-2010-2883), Quicktime (CVE-2010-1818) and Flash (CVE-2010-2884).
We found it interesting that we discovered the PDF exploit on the same page as a more “traditional” fake anti-virus page, in which users are prompted to install an executable file. So, even if you run into a fake anti-virus page and ignore it, we suggest you run a thorough anti-virus scan on your machine.
We and others have observed that once a vulnerability has been exploited and announced, it does not take long for it to be abused widely on the web. For example, the stack overflow vulnerability in PDF was announced on September 7th, 2010, and the Metasploit project made an exploit module available only one day later. Our systems found the vulnerability abused across multiple exploit sites on September 13th.
Here’s a few suggestions for protecting yourself against web attacks:
- Keep your OS, browser, and browser plugins up-to-date.
- Run anti-virus software, and keep this up-to-date, too.
- Disable or uninstall any software or browser plug-ins you don’t use — this reduces your vulnerability surface.
- If you receive a PDF attachment in Gmail, select “View” to view it in Gmail instead of downloading it.
Follow
5 commentaires :
another tips for the readers:
Install Flash Block plugin for your browser (available for both Chrome and Firefox). And run execute flash only on sites that you trust.
@Saqib Ali:
FlashBlock is nice, but relying on FlashBlock for your security is a bad idea.
I'm guessing this advice is mainly aimed towards users of windows either all or certain versions. I realise some of the advice is more generic but it would be useful if it was clear what advice applies to which platform.
You might also download and use Fox-it to work with those files. Its suppose to be somewhat more ssecure than Adobe.
I thank It's A Great Idea!
Publier un commentaire