Attackers Abuse Google Blogger

Hackers are currently littering Google's Blogger site with phony blogs -- some containing malware, pornographic images, or pure spam.

"Google Blogger is being used as a malware delivery mechanism," says Ken Steinberg, CTO and president of Savant Protection, who discovered the attack while working on his own blog this morning. The attackers apparently are automatically generating the blogs with scripts. The blogs come with nonsensical names and content that's obviously been generated using English-compliant engines and keyword focuses, he says.

"They've upped the game. Mostly [blog attacks] have been through comments or postings," he says. Steinberg noted that some of the fake blogs were using malware-insertion techniques: "One of the more common ways of inserting malware is using overflow techniques found in movie [viewers]... When you click through a few of these blogs, up pops images set to auto-load -- some are images, some are movies" that can infect a visitor with malware, he says.

Google says it's investigating the event. "Google takes the security of our users very seriously, and we're always working to help protect our users and make the Blogger experience even better," a Google spokesperson said. "When we are notified of the existence of content that violates our Terms of Service, we act quickly to review it and determine whether it violates these policies. If we determine that it does, we remove it immediately."

At the time of this post, phony blog names were continuing to pop up regularly on the Blogger start page under "Blogs Updated."

Although there's no way to be sure exactly what the attackers and/or spammers are after at this point, Savant's Steinberg says it appears to be a combination of malware infection and skewing keyword statistics to their favor on Google Blogger.

Several contain pornographic images as well as advertisements purportedly for a traffic analysis tool for sites and blogs. Others appear legitimate, including one that was titled "The Washington Auto Show," but with random text and sentences within the blog entries.

"This is going to totally muck with Google statistics," Steinberg says. "When you look at how people do search engine optimization in the blogger world, a lot is based on keywords and they are prioritized based on usage. Google is mining all of this content and developing keyword statistics. So theoretically, someone with content associated with one of these crappy sites could get an elevated statistic."

Some of the blogs are cross-linked as well, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.