Google search behind most phishing sites

By Dave Nixon

75% of phishing sites are built on hacked servers that have been tracked down using pre-programmed Google search terms, according to study from brand-protection firm MarkMonitor.

Among additional activities, MarkMonitor tracks phishing attacks that target brand names.

Researchers assembled a list of 750 Google search terms that are used to track down websites liable to have effortlessly utilizable vulnerabilities - mostly PHP-based sites.

The search terms return a list of sites prone to have particular vulnerabilities; the attackers then take advantage of the vulnerability, get admission to the site, and then use it to host malevolent code or counterfeit web pages as part of the trick.

MarkMonitor established that 75 percent of the phishing sites it had discovered had been initially tracked down using one of the list of 750 Google search terms. The discovery was based on a taster of one-quarter of the phishing sites logged by the firm.

The search terms, called “Google dorks”, are vigorously traded on internet forums, and are routinely scanned by IRC-based “bots”, which also scan Yahoo and AOL Search results, according to MarkMontitor.

Google has previously made attempts to block automated exploitation of the “dorks”, but they can still be used manually.

The websites broken have a tendency to be small, local PHP-based sites, which are less prone to have the latest patches installed, and are invaded via one of more than 1,800 known PHP bugs, MarkMonitor said.

In the fourth quarter of 2007, 412 organisations were targeted by phishing attacks, up 37 percent from the same period in 2006, according to the firm’s Brandjacking Index, published last month.

Auction sites were the main targets, accounting for 44 percent of the phishing emails in the fourth quarter, up from 36 percent in the first quarter of 2007.