Jul 8 2008 5:12PM GMT
Posted by: Troy Tate
Data security,
Google,
Firefox,
anti-virus,
awareness,
botnet,
honeynet,
IT education,
Development,
Security,
antivirus,
forensics,
honeypot,
malware,
Policy,
metrics,
online identity,
policy enforcement,
reporting,
web,
website,
www
I sometimes browse the internet using Firefox. I say sometimes because Internet Explorer is the standard browser at my company and Firefox is not supported by IT. Well, since I work in IT, sometimes you have to test things on behalf of users and also to see how certain sites are different depending on the client browser.
Well, I recently upgraded Firefox to v3. It does seem much better than v2 although some of my useful addins are now broken (when will YSlow get fixed for v3?). One of the new features of Firefox v3 is the ability to report to the user if the visited website is a known potential malware site. This is a good feature! It provides the user with some useful information and education about the dangers on the internet. However, how accurate is this feature? What if you are visiting a trusted website that you frequently visit and now get this message?
For your information, this is the message that you will see when you attempt to visit a site deemed as risky.
Reported Attack Site!
This web site at certification.xxxxxxx.org has been reported as an attack site and has been blocked based on your security preferences.
Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.
Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners.
I blanked out the actual website address above. However, those of you with a bit of detective in you are likely going to figure it out.
What is interesting about this particular warning message is that it is referring to a website that has security as a guiding principle. When you see this message in Firefox, you have three options presented:
- Get me out of here!
- Why was this site blocked?
- Ignore this warning - in very tiny print at bottom of message.
I was curious as to why this site would be considered as a danger. I clicked on the Why was this site blocked? option. The report I received was interesting and as I mentioned earlier, could this be an example of someone crying “Wolf!”?
The report was as follows:
What is the current listing status for certification.xxxxxxx.org/?
Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.
What happened when Google visited this site?
Of the 6 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 07/06/2008, and the last time suspicious content was found on this site was on 07/06/2008.
Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 3 new processes on the target machine.
Malicious software is hosted on 3 domain(s), including lokriet.com, clrbbd.com, catdbw.mobi.
1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including catdbw.mobi.
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, certification.xxxxxxx.org/ did not appear to function as an intermediary for the infection of any sites.
Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
Next steps:
This is great educational stuff, but did it really happen to this particular website? I don’t know, but apparently Google does. With the report of just one incident, does it make this site really worth the notification? How many incidents should it take before a site is considered malicious and who determines what malicious is?
Just something else to mull over in your copious time as you go perusing websites in Firefox.
Thanks for your time. Let’s be good network citizens together & practice safe networking!
0 Comments
RSS Feed
Email a friend
