GTalk

Makers of search engines like to market themselves as smart, using the most intelligent technology to find the best websites on the Internet for users’ queries.  In a recently reported study, a security researcher showed how one provider, Google, proved itself to be head and shoulders above its competitors, at least in one specific aspect of search.

Most of us are familiar with the problem of phishing, whereby certain parties attempt to learn personal and private information about computer users, often for the purpose of perpetrating identity theft-related fraud.  One of the methods to gain access to this data is to direct unsuspecting users to malicious websites that appear to be legitimate business addresses.  These sites attempt to fool users into giving up their personal information, or they contain viruses that are down-loaded onto the users’ computers when visited, allowing outsiders access to sensitive data on the infected machine.  In either case, the success of the ruse depends upon tricking users into clicking onto the malicious website.

Using his knowledge of search engine protocols and how they rank sites, Jim Stickley, CTO and co-founder of TraceSecurity, an information technology security company, created a bogus website that looked as if it belonged to the Credit Union of Southern California, a real business that agreed to be part of the experiment.  Interestingly, Stickley found that his site received a number two and top rankings (even ahead of the genuine Credit Union site, in the latter case) on Yahoo and Microsoft’s Bing search engines, respectively.  In contrast, corresponding Google searches placed the bogus site no higher than on Page 6.  During the eighteen months that the fake website was in operation, more than ten thousand users clicked over to it.  Fortunately for them, Stickley’s experiment was not malicious and these users were redirected to the genuine site.

Search engine providers are famously secretive about how they process users’ queries, both for competitive and security-related reasons.  Yahoo declined to comment for the article.  Microsoft addressed the problem and subsequently removed the bogus Credit Union site from Bing’s search results.

This experiment provides another illustration of the never-ending cat-and-mouse game played between security officers and engineers and hackers.  A search quality engineer at Google described the process as a type of Internet “Whac-A-Mole” with hackers creating new potential vulnerabilities that pop up each time engineers address an existing one.  This rivalry drives continuing technology innovation and promotes the development of new products and services in the security and life safety industry.  Our interactions with large and established companies in this industry have shown us that they are always on the lookout for new technologies that have demonstrated a significant level of market acceptance and are willing to aggressively pursue those targets that meet their strategic needs.