Yahoo and McAfee team to secure search results
McAfee and Yahoo have joined forces to cleanse search results and identify websites that may be malicious in nature.The SearchScan feature from Yahoo leverages McAfee's SiteAdvisor technology to either strip malicious websites from search results or flag a questionable link with a red warning stamp.
Tim Dowling, vice president of the web security group at McAfee, told SCMagazineUS.com on Tuesday that attackers are finding success in spreading malware through search results because users tend to trust them.
“We estimate that 7.8 billion risky sites are served up in search results every month, which is an enormous number when you think users have to pick the good from the bad,” he said. “It's like playing Russian roulette.”
Priyank Garg, director of product management for Yahoo search, told SCMagazineUS.com on Tuesday that SearchScan automatically filters out from search results those websites that are hosting drive-by browser exploits, which do not require any user interaction for infection.
Meanwhile, for websites hosting potentially dangerous downloads that could lead to malware being installed on a user's machine, a red warning label appears above a URL in question, he said.
That same feature applies to search results for sites that are known for distributing spam emails, Garg said.
The new service, however, will not defend against phishing sites, he said.
“They usually come up and go down in a day,” he said. “These sites so ephemeral and short lived that they don't show up in search results."
Garg said research revealed that users of all ages are increasingly concerned about the dangers of the internet. Yet, they are not sure how to defend against some of the malicious activities taking place.
“Users were not aware of what was risky to them and what was safe,” he said. “That's what we're trying to achieve here.”
Yahoo's primary search competitor, Google, unveiled a similar offering roughly two years through a partnership with StopBadware.org. That site, which relies on third-party research, serves as a clearinghouse for internet destinations hosting or distributing badware.
The new Yahoo service will not defend against attack scenarios such as cross-site scripting and SQL injection, Dowling said. However, businesses can purchase a new subscription service from McAfee that will test websites daily for vulnerabilities in code, he said.
