Ad Violations: Why Search Engines Won’t Display Your Site If it’s Infected With Malware

As your website’s webmaster have you ever seen an e-mail from Google like this?:

Hello,

We wanted to alert you that one of your sites violates our advertising policies. Therefore, we won’t be able to run any of your ads that link to that site, and any new ads pointing to that site will also be disapproved.

Here’s what you can do to fix your site and hopefully get your ad running again:

1. Make the necessary changes to your site that currently violates our policies:
Display URL: site.com
Policy issue: Malware
Details & instructions:

2. Resubmit your site to us, following the instructions in the link above….

If so, you know the potential downside risk this poses for your website. In their own words, Google says:

In some cases, you may be unaware that you have malware on your site. But to protect the safety and security of our users, we stop all ads pointing to sites where we find malware.

In essence, Google and Bing care about their searchers more than your business so, to protect their customers, they’ll shut your website out of Adwords and Bing Ads and will offer your site less frequently in organic searches.

Often overlooked in the search business is the role of the actual search engine in the ad placement process. These are businesses that specialize in creating algorithms to show relevant search results, assigning quality scores to your landing pages and placing your actual ads. A lot goes into the process, but in all cases, the key for the search engine is to show relevant search results (including ads) that keep people using their search engine. It is in this spirit that search engines like Google and Bing reserve the right to refuse your ads. This is especially true if they have any reason to believe that your site may be infected with malware–including viruses, worms, spyware, and Trojan Horses–or is being used in phishing schemes.

From the search engine’s perspective, this makes perfect sense. Searches are their lifeblood and there are other search engines a person could use to find websites. By showing your ads or returning your site organically in a search, they are tacitly telling the searcher, “We found these sites to be relevant to you.” If they start sending you to sites that are potentially harmful, then a searcher could, potentially, switch search engines.

However, knowing why search engines work as they do doesn’t make it easier to be a webmaster when a site is hacked. Luckily, our clean up and malware removal tools as well as our de-blacklisting service are just a click away.

Or, better yet, keep yourself from ever getting an email like the one above from Bing or Google. Instead, protect your site, and business, from potential problems stemming from malware, blacklisting or phishing and look into protecting your site with a website application firewall like our CloudProxy WAF .

Thumb Wars: Sucuri Acquires Google Webmaster Tools

Google Webmaster Tools

Today Sucuri unofficially acquires Google Webmaster Tools.

In an effort to combine forces of good, Sucuri officials challenged Google to a thumb wrestling war. Here is a breakdown of the event.

Over The Top

In a best-of-5 style tournament, the competition got heated. The underdog had fought well, and stayed in it to win it. They weren’t letting the big dog walk away with this. In what turned into an exciting but nerve-wracking competition, the tournament was at a 2-2 going into the final match. With great confidence, Matt Cutts from the Google team belted out that, “Google does no harm, but that doesn’t extend to your thumbs!” He was so confident that he bet the ranch, saying “winner takes all, including Google Webmaster Tools”.

The room went silent. You could see sweat on the faces of each of the competitors, no more than on the faces of our trusty Labs team. They knew what this meant. It was go hard now or go home empty handed.

The last match was about to start, and you could see white knuckles showing from the great pressure in grip arrangements. It was time, thumbs were arched, and hats were turned backwards. This could be the very moment where everything changed.

The start was called, and Google aggressively launched their attack, a quick launch sneak pin attack, but the Sucuri competitor saw it a mile away. Google missed their kill shot and Sucuri took advantage with an over-arching attack from the top ropes. Sucuri slammed down with the power of Zeus… Google was in trouble.

Coming to an End

One quick glance to the right and you could see Matt’s face twisted in horror. One quick glance to the left and you could see the Sucuri CTO, Daniel Cid, his face emotionless as he enjoyed his popcorn.

You could see the strain and distress across faces of team Google as they realized what was happening, as they realized how it was about to go down. The tip of their thumb was moving from shades of red to signs of failed purple. The counter by Sucuri was risky, but as strong as Eddie Bravo’s triangle to beat Royler Gracie in 1993. This was epic. You could just imagine what was going through team Google’s mind, “Sergey will never understand!”

The crowd. Silent. Almost as if the hand of death had grabbed their shoulder. Stuck in sudden disbelief as to what was transpiring, and in complete anticipation as to what was next.

The referee started to count. It was as if slow motion was being called in slow motion. The ref kept counting, and counting. Then you had it. As quick as it had started, it was over.

Sucuri had won. On the line was Google Webmaster Tools which will now slowly be migrated to Sucuri Labs over the coming weeks.

In this moment of great triumph, the David-sized security firm looks forward to expanding website security efforts to all webmasters across the world, with the inclusion of this Goliath-sized prize.

No Fooling Around

If you’re interested in helping fight the good fight, make sure to check out our open job requisitions.

If you have questions about this fever dream of a completely fake post, please leave them in the comments below.

SiteCheck Chrome Extension Now Available

Have you ever wondered if the websites you (or your family) visit contain code that is potentially harmful to you or your computer? If you are a Chrome user, then you’re in luck because we’ve made it much simpler for you to utilize SiteCheck, our website malware scanner. Whether you want to scan your own website or check up on other sites, install our new Chrome extension to make it easier. If you love the extension, let us know in the comments and make sure to tell your friends about this cool new tool.

All right, we’re done selling the benefits of this thing so here are the instructions to install it and try it out for yourself:

First, install the extension from the Google Chrome Web Store.
Read More

Google Bots Doing SQL Injection Attacks

One of the things we have to be very sensitive about when writing rules for our CloudProxy Website Firewall is to never block any major search engine bot (ie., Google, Bing, Yahoo, etc..).

To date, we’ve been pretty good about this, but every now and then you come across unique scenarios like the one in this post, that make you scratch your head and think, what if a legitimate search engine bot was being used to attack the site? Should we still allow the attack to go through?

This is exactly what happened a few days ago on a client site; we began blocking certain Google’s IP addresses requests because they were in fact SQL injection attacks. Yes, Google bots were actually attacking a website.

Read More

Google Transparency Report – Malware Distribution

Google just released their Malware Distribution Transparency Report, sharing the amount of sites compromised or distributing malware detected by their systems (Safe Browsing program).

Google’s Safe Browsing program started in 2006 and since has become one of the most useful blacklists to detect and report on compromised sites. They flag around 10,000 different sites per day, which are being used for over 1 billion browser (Chrome, Firefox And Safari) users.

What is really scary from their report is the amount of legitimate compromised sites hosting malware compared to sites developed by the bad guys for malicious purposes. For example, in the first week of Jun/2013, 37,000 legitimate sites were compromised to host malware. At the same time, they only identified around 4,000 sites that were developed for the unique purpose of infecting people.


Read More

New Google Chrome Blacklist Warning for Macs

If you go to a site that is Blacklisted by Google, you will see a new (and prettier) malware warning now if you are using a Mac:

The Website Ahead Contains Malware!
Google Chrome Has Blocked access to site.com for now.
Even if you have visited this site safely in the past, visiting it now may infect your Mac with malware.

Nothing major has changed, but we found this new wording to be more clear for the end user. So good move from the Google/Chrome team.

If you have additional concerns regarding getting your site removed from a blacklist the one above, let us know and we will be happy to help.

Website Cross-contamination: Blackhat SEO Spam Malware

We recently posted about Website Cross-Contamination which we see quite a bit of in shared hosting environments. This post is a follow up with a nice sample of an SEO Spam infection that uses multiple sites in a shared environment to push their campaign.

We received a clean up request from a customer who was clearly infected with Blackhat SEO Spam:

Read More

Ask Sucuri: How Long Does It Take For a Site To Be Removed From Google’s Blacklist? – Updated

If you have any questions about malware, blacklisting, or security in general, send it over to us: contact@sucuri.net and we will answer here. For all the “Ask Sucuri” answers, click here

This is an update to our previous post about Google blacklisting. We have some updated numbers to share.

Question: My site was hacked and we cleaned and secured it properly. We also scanned it, and it is showing up as clean. However, it is still blacklisted by Google. How long until they remove us?

Answer: This is a very common question. In fact, every time we clear a hacked site, their owner asks us the same question: How long until that scary red warning sign is gone?

To give a solid answer to our clients, we started to time how long it takes from when the review submission is requested, until the site is reviewed and removed by Google. We have now measured a few hundred blacklist removals and we have some good numbers to back up our tests.

Current Results:

  • Average time from submission to removal: 440 minutes (about 7 hours)
  • Maximum time: 792 (13 hours)
  • Minimum time: 290 (a bit less than 5 hours)

On average, it takes Google around 7 hours to clear your “bad” website from their lists. For our lucky clients, it takes roughly 5-6 hours. Another important point that some people forget is that you need to request a review! Google will not automatically remove a site once cleaned.

How do you increase your odds of getting cleared faster?

  1. Make sure to clean everything up!
  2. Do not remove the infected files, fix them. If you remove them, they will 404, and a 404 will delay the verification (even if you need to leave the file with a 0-size, don’t remove it until after the site is de-listed).
  3. Follow best practices to increase security on your site so that you minimize the risk of reinfection.

That’s it. Let us know if you have any questions or comments.


Is your site hacked? Blacklisted? We are here to help! We can get your sites cleaned up and secured right away!

Will Google blacklist itself?

We were analyzing an infected site today and their Google blacklist diagnostic said the following:

Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 3 domain(s), including site.com/, google.com/.

Hum… So Google.com was somehow infected as well? I know it is probably some small sub site from within Google, but I found it interesting that they listed Google’s main domain in there.

If you look at Google’s own diagnostic page, it says:

31 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2011-03-28, and the last time suspicious content was found on this site was on 2011-03-28.

 
Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, google.com appeared to function as an intermediary for the infection of 71 site(s) including our-pretty-pets.blogspot.com/, daum.net/, portovelhodownload.blogspot.com/.

 
Has this site hosted malware?

Yes, this site has hosted malicious software over the past 90 days. It infected 72 domain(s), including tamansoftware.co.cc/, agusnih.co.cc/, duniamisteri.co.cc/.

Let’s see if Google actually blacklists themselves :)

Google blacklist – No way to request a review for the last two days

We are seeing a big issue on Google for the last few days. Whenever a site got blacklisted, you had the option to request a review after the site was clean. Something like that:

Request blacklist review Google

Read More