Jonathan Richards
Enter our Snapshots of Summer photography competition
About one in ten websites is infected with malicious software that could result in a user’s personal information being stolen, according to Google.
Sensitive data such as banking passwords and e-mail addresses could unwittingly be handed over to criminals as a result of visiting infected pages, which work by exploiting a vulnerability in the user’s internet browser, a study by the search company suggests.
Google said that it had analysed approximately 4.5 million websites over a 12 month period and found that 450,000 had caused a test computer to make a ‘drive-by download’, a common example of which was a ‘keylogger’, which captures every keystroke a user makes.
The report, entitled ‘The Ghost in the Browser,’ concluded: “Unfortunately average computer users have no means to protect themselves from this threat.”
"Their browser can be compromised just by visiting a page and become the vehicle for installing multitudes of malware on their systems.”
Sites with advertising were among those most commonly exploited, the study, said, because the ads were often displayed via a third party network and not under the control of the website owner.
Other sites that were vulnerable included those with user-generated content, such as forums or blogs, and those that make use of ‘widgets’ – for instance traffic counters – which could be configured by exploit a visitor’s computer.
In many instances the website owner was unaware their site had been infiltrated, experts said.
“We expect that the majority of malware is now spreading via web-based infection, because the computer of an average user provides a rich environment for adversaries to mine,” Niels Provos, who led the study, wrote.
“Banking transactions and credit card numbers, for instance, are much more likely to be found on a user’s machine than on a compromised server.”
The work of anti-virus software providers was made difficult by the fact that malware evolved rapidly, one malicious code changing over 1,100 times over the 12 month period of the study, the authors said.
But Graham Cluley, an expert at the computer security firm Sophos, said that there was “a fair amount” users could do to protect themselves by ensuring their virus protection software was up to date and downloading patches from Microsoft’s website
“Anti-virus vendors now also sell plug-ins, which screen pages as you try to access them, detecting relevant threats,” Mr Cluley said, adding that according to research by his company, 70 per cent of web-based infections were found on ‘legitimate’ websites.
Google said it was now labelling sites that had been identified as malicious as “potentially harmful” when they were returned as search results.
Win a luxury weekend to Newcastle and its neighbour Gateshead, find out more here
Risk, resilience and embracing new technology
Industry sectors news at a glance. Interactive heatmap, video and podcast
Discover the collective power of smart thinking. Submit a solution and be in with a chance to win a Flip MinoHD Camcorder
The inside track on current trends in the charity, not for profit and social enterprise sectors
Everything the Business Traveller needs to know to make a better trip
Make the most of the summer and enter our fabulous photographic competition, you could win a £5000 holiday
Corsica is an island of beauty and contrast, an ideal holiday destination
Enjoy further reading from Travel to Fashion, Business to Sport, discover more
Shortcuts to help you find sections and articles
The clever way to lease a new car is with Car leasing made simple™
2009
42,945
2008
71,450
Car Insurance
Not Specified
MI6
UK-based
£60,000
The Environment Agency
Bristol
Up to £90K
Boots
Midlands
OTE £85k
Credit Protection Association
Nationwide Opportunities
Completely London
Luxury Condo's in Manhattan with NYC views
The best new homes in Wimbledon?
Nationwide
Save up to £1,000 per couple with Elite Vacations at the five-star Constance Lemuria Resort
and do the British Isles this Summer.
Save up to 60% with Oxford Hotels and Inns
Try our inspiring luxury holidays to the Indian Subcontinent and South East Asia.
Great offers available
8 fabulous Canadian cities ...you won’t find cheaper
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths | Subscriptions | E-paper
News International associated websites: Globrix Property Search | Property Finder | Milkround
Copyright 2009 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
Rick, England
Opera is now at version 9.21 and I use it for everything, banks included, with no problems. If you haven't tried it recently, you should try it again. www.opera.com
Like you, I never use IE7. It is a useless piece of dangerous, insecure bloat created by a monopoly.
Oh, end when asked for a date of birth or a post code, I MAKE ONE UP!
Dave Brooklyn, Brooklyn, USA
Did Google make these accusations without recommending actions of which users can take? It would appear to be consistent with Google's ethos to recommend or provide software to overcome these problems. Or did The Times omit the recommendations made? (this would appear the most important part of a report if made).
Sam Bamkin, Liverpool, England
People don't take care of their computer. I suggest that a PC should have a really powerful Security Software. They should get a powerful one like McAfee, Norton, Windows Live aCare etc. In order to stay away from Hijackers, Keyloggers you should have a firewall. I think we all should be careful on the Internet. And if you all want an advice, download McAfee's site adviser. That advises you on what website you should not go, I think that will help.
Harsimran Singh, Alhambra, CA, USA
One reason malware is so prevalent is because offenders have not been punished appropriately.
Perhaps if they offered the opportunity to eliminate malware while in prison, we could turn this problem around. Provide small rewards, such as free time, when a problem is found and counter-effected. And larger rewards when the perpetrator was caught (and added to the group of individuals cleaning up the internet), such as time off their sentence. To make sure these prisoners did not perpetrate malware themselves, they could be watched by trusties, that were watched by computer savvy guards.
Of course no one would be forced to do this work - but I suspect they would rise to the challenge given no computer privileges otherwise.
Dave Robar, Kent, WA, USA
Mark from Bristol has hit it on the nail. Most folks (even thiose who know what they are doing) have to run all their user accounts as Admin solely because a high percentage of software packages will ONLY run in XP under admin. So you give your kids a restricted account and then find that their new game doesn'r run...
WJy don't MS and the games makers get their act together on this. The ideal situation is for you to install the game from an admin account so that the kids can run it from a safe account. Hardluy Rocket science,
xpatjock, Aktau, Kz
People treat their computer as if it were a tv: just turn it on and use it.
In reality when connected to the internet, the pc becomes an open door for the criminal elements of the world to enter into your life. Blame who you want, but if you don't protect yourself you lose.
In Windows XP running as a non admin user is a good start, however many program sadly wont' work properly. Security is complicated but its your money at risk.
Reminds me of the UK border controls.
mark, bristol, uk
"Another good reason to go out and buy a Mac."
Newsflash: Macs aren't immune to spyware.
Ahmed, London, UK
This article states that most malware comes from advertisements that the site owners don't control. They say that 70% of malware comes from "legit" websites this way. Why don't they disclose who these advertisers are? Let's educate the public and start going after these advertisers, and put them out of business already.
Joshua C, Baghdad, Iraq
Another good reason to go out and buy a Mac.
Steven Mcpartland, Bournemouth, England
It's possible to have 1100 changes over the course of a year because the original code is release to the public and there are a thousand little hacker-geeks all over the world making their own little version so they can go troll for personal information.
Daren, Fresno, CA
Google has been labeling sites as containing spyware for the past six months. A lot of readers might cheer and say they are doing a good job. But the system they have is not perfect, there is no warning before the message is posted on their search results. As a website owner I have lost hundred of dollars in lost revenue, some people had lost thousands of dollars. In my case there was malware, but in other cases it was a false positive. The review process to get your site delisted could take a two days to over two months. Interestingly enough while google servers check for the virus, to get it removed the outsource the responsibility to a understaffed non-profit organisation . Very clever way of doing the easy work, while outsourcing customer complaints to a third party.
I think Google should not be involved with this, because it does not do a good job.
William, Richmond, Canada
Quote from article: "The work of anti-virus software providers was made difficult by the fact that malware evolved rapidly, one malicious code changing over 1,100 times over the 12 month period of the study, the authors said."
Can they be serious? A particular "malicious code" changed so frequently; 3 times a day! Clearly only automated code can change this quickly, and so regularly. This news smells fishy, like so much news that is disseminated recently it hardly bears the most elementary scrutiny. What is "malicious code"? It is as amorphous as "weapons of mass destruction", a generalized almost meaningless term designed to elicit a reactionary response from an alienated public. Hey people wake up, how many websites have actually stolen your money? NONE I bet. The government is stealing half of all you earn every day, why not worry about reality if you have to worry about anything.
Nick, Leeds, UK
I use Firefox on Windows XP, with all the updates. I tried Opera, but Opera is not recognised by Bank Website. I use Internet Explorer 7 for a couple of sites that require Direct7, but will never use Internet Explorer to access my bank, or any website that ever asks for Credit Card Details, or my Postcode or Date of Birth.
It could be worse.. I could still have Windows 98SE (released back in 2000.)
Rick, England,
Ha, Use Firefox That Would Help Cut It Down, Internet Explorer Passed It Sale By Date Ages Ago
Ben, scunthorpe,
Keyloggers are actually one of the biggest problems in the Internet nowadays. I could only recommend to visit this site http://anti-keylogger.org and download one of the anti-keylogging products. BTW there are a lot of information about keyloggers there.
TVS, USA,