Google recently released a paper detailing a new CAPTCHA scheme it calls “What’s Up?” (the latest in a long string of such schemes), which it feels will defeat programmatic attempts to defeat it, and make it easier for human users to solve the puzzles — based on identifying a rotated picture. But they’re fighting yesterday’s battle. Because human interpreters of CAPTCHAs are now so cheap, the criminals who use them are actually farming them out to cheaper countries to save money. An article on ZDNet sums this up in great detail. Here are just a few excerpts from ... more

Google’s “Webmaster Central Blog” has a good article up for webmasters to avoid a particularly insidious form of abuse, since it can happen without you even being aware of it. The article starts out with general advice: No one wants malware or spammy URLs inserted onto their domain, which is why we all try to follow good security practices. But what if there were a way for spammers to take advantage of your site, without ever setting a virtual foot in your server? There is, by abusing open redirect URLs. Webmasters face a number of situations where it’s helpful ... more

From a Trend Micro blog comes a report that over 400,000 Google Video queries lead to a single domain which downloads a worm to the user’s computer. From their post: Search traffic on Google Video were found to be polluted: instead of legitimate videos researchers found some 400,000 queries returning video results that have a single redirection point, and one that eventually leads to malware download and execution. Trend Micro detects the malicious executable as WORM_AQPLAY.A. This worm — file name FlashPlayer.v3.181.exe and from that alone one can already guess the social engineering strategy — spreads via removable and ... more

The fourth quarter 2008 click fraud numbers are out from Click Forensics, and they’re getting worse. From their Click Fraud Index report: The overall industry average click fraud rate grew to 17.1% for Q4 2008. That’s up from 16.0% in Q3 2008 and from the 16.6% rate reported for Q4 2007. The average click fraud rate of PPC advertisements appearing on search engine content networks, including Google AdSense and the Yahoo Publisher Network, was 28.2%. That’s up from the 27.1% rate reported for Q3 2008 and down slightly from the 28.3% rate reported for Q4 2007. ... more

From ZDNet comes a report of malware hiding in a new spot: Google video searches. Here is the entire article: From the real-time syndication of hot Google Trends keywords, maintaining AdWords campaigns, to the plain simple blackhat search engine optimization tactics, cybercriminals are constantly looking for new ways to acquire traffic by enjoying the clean reputation of each and every Web 2.0 property. From LinkedIn, Bebo, Picasa and ImageShack, to Twitter, everyone’s targeted efficiently using automated account registration tools. During the last couple of days, a single group involved in a countless number of blackhat SEO campaigns across the ... more