November 27, 2009 | Misc

Rogue Blogs Using Google to Offer Malware and Bogus Antiviruses

The Unmask Parasites blog has uncovered a devious method being used by a particular network of malware sites. Maleware purveyors are creating subdirectories in legitimate blogs where they host their own illegitimate blogs.

The illegitimate blogs are targeted toward very specific and unpopular Google search terms, such as “blue mustang picture”, “upstate ny photos”.

Interestingly, the malware isn’t presented if you go directly to the site, only if you go through Google. The malware is presented in the form of bogus anti-virus software, but not directly. Rather, obfuscated Javascript redirects are used to prevent blacklisting.

Unmask Parasites cites this as another reason to be running the Firefox NoScript plugin, which allows Javascript only for specified sites.

Another plugin for this purpose, much simpler than NoScript, is QuickJava, which allows you to turn Javascript on and off with a single click.

It’s also another reason to keep WordPress (or whatever blog software you’re using) updated and to regularly check your installation for problems.

Read the details of the malware network at Unmask Parasites.