Comments on: Another look at SafeBrowsing warnings

By: David

David — Sun, 28 Dec 2008 10:09:29 +0000

I got the same thing with safebrowsing trying to get my pin – is this a genuine attempt to get my pin or is it just that a bunch of data is being transferred and the few digits that make up my pin are sometimes transmitted just by coincidence?

By: Gres

Gres — Thu, 23 Oct 2008 03:55:53 +0000

I’ve seen the same security message from ZoneAlarm only safebrowsing is trying to get my pin. What is going on with this?

By: Gene

Gene — Sat, 13 Sep 2008 13:12:51 +0000

I have Trend Micro as my security program and it has stopped countless tries from safebrowsing …… trying to get my private data ie phone number and bank account number

By: George

George — Tue, 08 Jul 2008 06:24:32 +0000

This is a big problem for smaller sites, but not a problem for bigger sites – AOL and other companies have a lot of malware on their sites but their sites are not “suspicious”, while smaller sites with just couple “problems” are getting blacklisted – compare links below – first one is blacklistes, the other one is not and compare number of problems:
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://txdnl.com/
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://aol.com/
http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http://freewebs.com/

By: Z

Mon, 19 May 2008 14:48:41 +0000

Tried the firefox page in FF3RC1 and didn’t get any warning.

By: Gijs

Gijs — Sun, 11 May 2008 20:25:42 +0000

Are those pages localized? Those dates could mean either “May 1st” or “January 5th” to me.

By: Justin Dolske

Justin Dolske — Wed, 07 May 2008 21:08:59 +0000

jwatt:

I think, but am not sure, that “this site has not hosted malicious software” is making a distinction between targeting users and just providing bandwidth for distributing malware? It is confusing, though.

The linked URLs just go to the report pages for those sites, not the actual site.

I’ve seen mixed results on how often blocked sites are scanned. But I think the important point for the moment is that by making this data available, it’s now possible to critique the method.

Chris:

I’m not now sure exactly what “without user consent” means. I’d assume it’s a mix of pages trying to exploit known security vulnerabilities, and distributing software that dishonestly includes malware (eg, a screensaver that includes trojan).

I don’t think listing the exact exploits and advisories is all that useful for users. If the site is actively distributing malware, then it’s risky to visit, end of story. I would expect that sites using known malware are also highly likely to include unknown attacks.

By: Chris Hubick

Chris Hubick — Wed, 07 May 2008 19:28:28 +0000

How does “malicious software” get “downloaded and installed without user consent”?

Does this really mean “this web site attempts to exploit security vulnerabilities to download and install malicious software without user consent”?

I mean, no site should be able to do that, so I’m lost.

As for the level of detail, IMO, it tells me almost nothing – I want to know what exploits the page attempts with links to corresponding security advisories, etc. So, my preference would be a summary at the top for “normal” users, and then a big divider, and give even more detail below.

By: Olly

Olly — Wed, 07 May 2008 10:49:14 +0000

I’ve hit the big red warning in FF3b5 and upon clicking through found that Google’s already marked the site as “safe”. How often does FF update it’s blacklist?

By: Jonathan Watt

Jonathan Watt — Wed, 07 May 2008 08:19:16 +0000

So it says:

> Of the 151 pages we tested on the site over the past 90 days, 108
> page(s) resulted in malicious software being downloaded…

Then just a bit further down it says:

> Has this site hosted malware?
> No, this site has not hosted malicous software over the past 90
> days.

Huh??? That’s confusing.

Also, it says this is for bettasearch.com, but actually it’s for http://www.bettasearch.com. That www. can make a big difference, so they should fix that.

And why on earth are the URLs to the malicious sites actually hyperlinked? (Unless they go to safebrowsing.clients.google.com of course.)

I visited the site myself just now, and the page is currently saying:

> Of the 1 pages we tested on the site over the past 90 days, 0 page(s)
> resulted in malicious software being downloaded and installed without
> user consent. The last time Google visited this site was on
> 03/26/2008, and suspicious content was never found on this site
> within the past 90 days.

So why is it still being blocked? Is 1 page test really enough? I suspect the site is still hosting malicious software (being bet_t_asearch.com and all), but if a user sees that only one page was tested, and it wasn’t found to have malicious software on it, they’re going to loose confidence in the protection and think it’s buggy and just a pain. They’re also likely to click through to the page.