Even search engines can get suckered by Internet scams.
With a little sleight of hand, con artists can dupe them into giving top billing to fraudulent Web sites that prey on consumers, making unwitting accomplices of companies such as Google, Yahoo and Microsoft.
Online charlatans typically try to lure people into giving away their personal or financial information by posing as legitimate companies in “phishing” e-mails or through messages in forums such as Twitter and Facebook. But a new study by security researcher Jim Stickley shows how search engines also can turn into funnels for shady schemes.
Stickley created a Web site purporting to belong to the Credit Union of Southern California, a real business that agreed to be part of the experiment. He then used his knowledge of how search engines rank Web sites to achieve something that shocked him: His phony site got a No. 2 ranking on Yahoo Inc’s search engine and landed in the top slot on Microsoft Corp’s Bing, ahead of even the credit union’s real site.
Google Inc, which handles two-thirds of US search requests, didn’t fall into Stickley’s trap. His fake site never got higher than Google’s sixth page of results, too far back to be seen by most people. The company also places a warning alongside sites that its system suspects might be malicious.
But even Google acknowledges it isn’t foolproof.
Some recession-driven scams have been slipping into Google’s search results, although that number is “very, very few,” said Jason Morrison, a Google search quality engineer.
“As soon as we notice anything like it, we’ll adapt, but it’s kind of like a game of Whac-A-Mole,” he said. “We can’t remove every single scam from the Internet. It’s just impossible.”
Stickley’s site wasn’t malicious, but easily could have been. In the year and a half it was up, the 10,568 visitors were automatically redirected to the real credit union, and likely never knew they had passed through a fraudulent site.
“When you’re using search engines, you’ve got to be diligent,” said Stickley, co-founder of TraceSecurity Inc. “You can’t trust that just because it’s No. 2 or No. 1 that it really is. A phone book is actually probably a safer bet than a search engine.”
Microsoft said in a statement that Stickley’s experiment showed that search results can be cluttered with junk, but the company insists Bing “is equipped to address” the problem. Stickley’s link no longer appears in Bing.
To fool users into thinking they were following the right link, Stickley established a domain (creditunionofsc.org) that sounded plausible. (The credit union’s real site is cusocal.org.) After that, Stickley’s site wasn’t designed with humans in mind; it was programmed to make the search engines believe they were scanning a legitimate site. Stickley said he pulled it off by having link after link inside the site to create the appearance of “depth,” even though those links only led to the same picture of the credit union’s front page.
The experiment convinced Credit Union of Southern California that it should protect itself by being more aggressive about buying domain names similar to its own. Domains generally cost a few hundred to a few thousand US dollars each — a pittance compared with a financial institution’s potential liability or loss of goodwill if its customers are ripped off by a fake site.
“The test was hugely successful,” said Ray Rounds, the credit union’s senior vice president of information services.
Stickley’s manipulation illuminates the dark side of so-called search engine optimization. It’s a legitimate tactic used by sites striving to boost their rankings — by designing them so search engines can capture information on them better.
But criminals can turn the tables to pump up fake sites.
“You can do this on a very, very broad scale and have a ton of success,” Stickley said. “This shows there’s a major, major risk out there.”
Robert Hansen, a Web security expert who wasn’t involved in Stickley’s research, said ranking high in search engine results gets easier as the topic gets more obscure. An extremely well-trafficked site such as Bank of America’s would always outrank a phony one, he notes.
Consumers can protect themselves from scam sites by looking up the domain at www.whois.com, which details when a site was registered and by whom. That can be helpful if the Web address of a phony site is similar to the real one.
NATIONAL SECURITY: The Chinese influencer shared multiple videos on social media in which she claimed Taiwan is a part of China and supported its annexation Freedom of speech does not allow comments by Chinese residents in Taiwan that compromise national security or social stability, the nation’s top officials said yesterday, after the National Immigration Agency (NIA) revoked the residency permit of a Chinese influencer who published videos advocating China annexing Taiwan by force. Taiwan welcomes all foreigners to settle here and make families so long as they “love the land and people of Taiwan,” Premier Cho Jung-tai (卓榮泰) told lawmakers during a plenary session at the Legislative Yuan in Taipei. The public power of the government must be asserted when necessary and the Ministry of
Taiwan’s Lee Chia-hao (李佳豪) on Sunday won a silver medal at the All England Open Badminton Championships in Birmingham, England, a career best. Lee, 25, took silver in the final of the men’s singles against world No. 1 Shi Yuqi (石宇奇) of China, who won 21-17, 21-19 in a tough match that lasted 51 minutes. After the match, the Taiwanese player, who ranks No. 22 in the world, said it felt unreal to be challenging an opponent of Shi’s caliber. “I had to be in peak form, and constantly switch my rhythm and tactics in order to score points effectively,” he said. Lee got
EMBRACING TAIWAN: US lawmakers have introduced an act aiming to replace the use of ‘Chinese Taipei’ with ‘Taiwan’ across all Washington’s federal agencies A group of US House of Representatives lawmakers has introduced legislation to replace the term “Chinese Taipei” with “Taiwan” across all federal agencies. US Representative Byron Donalds announced the introduction of the “America supports Taiwan act,” which would mandate federal agencies adopt “Taiwan” in place of “Chinese Taipei,” a news release on his page on the US House of Representatives’ Web site said. US representatives Mike Collins, Barry Moore and Tom Tiffany are cosponsors of the legislation, US political newspaper The Hill reported yesterday. “The legislation is a push to normalize the position of Taiwan as an autonomous country, although the official US
CHANGE OF TONE: G7 foreign ministers dropped past reassurances that there is no change in the position of the G7 members on Taiwan, including ‘one China’ policies G7 foreign ministers on Friday took a tough stance on China, stepping up their language on Taiwan and omitting some conciliatory references from past statements, including to “one China” policies. A statement by ministers meeting in Canada mirrored last month’s Japan-US statement in condemning “coercion” toward Taiwan. Compared with a G7 foreign ministers’ statement in November last year, the statement added members’ concerns over China’s nuclear buildup, although it omitted references to their concerns about Beijing’s human rights abuses in Xinjiang, Tibet and Hong Kong. Also missing were references stressing the desire for “constructive and stable relations with China” and
RSS