Increasingly worried by the use of conventional web sites to distribute the viruses that turn innocent PCs into botnet "zombies," Google appears to be readying a plan to police the web. If the plan goes forward, Google will use new software to automatically identify compromised web pages in its database and label them as "potentially harmful" in its search results. Because being labeled as suspicious by Google could devastate a site's traffic, the move would raise the security stakes for site owners dramatically.

Google security specialist Niels Provos tells New Scientist, "The firewall is dead." He's referring to a shift in the way botnet infections are spread - and it's this shift that's making Google particularly nervous. Botnet viruses used to be distributed mainly through email attachments or computer worms, both of which could be blocked by firewalls or sniffed out by antivirus software. Over the past year, however, the operators of botnets have shifted to using regular web sites to distribute their malware. Reports New Scientist:

"As users have grown wary of email attachments and installed firewalls and anti-virus software, however, the bad guys have shifted their attentions to websites in a bid to find more victims ... Even an ordinary website can be risky. At a meeting on botnets held last month in Cambridge, Massachusetts, Provos warned that many web users are becoming the victims of "drive-by" downloads of bots from innocent websites corrupted to exploit browser vulnerabilities. As firewalls allow free passage to code or programs downloaded through the browser, the bot is able to install itself on the PC. Anti-virus software kicks in at this point, but some bots avoid detection by immediately disabling it.

A recent Google study, led by Provos, discovered "around 450,000 web pages that launched drive-by downloads of malicious programs. Another 700,000 pages launched downloads of suspicious software. More than two-thirds of the malicious programs identified were those that infected computers with bot software or programs that collected data on banking transactions and emailed it to a temporary email account."

Anything that makes people wary of visiting web sites or clicking on links stands as a big threat to Google's business. It's not surprising, then, that the company has a unit investigating the dissemination of malware through the web. The paper that Provos and four of his Google colleagues have written on the subject, The Ghost in the Browser, explains how Google is preparing to respond to the threat by incorporating an automated security analysis into its routine spidering and indexing of sites:

"To address this problem and to protect users from being infected while browsing the web, we have started an effort to identify all web pages on the Internet that could potentially be malicious. Google already crawls billions of web pages on the Internet. We apply simple heuristics to the crawled pages repository to determine which pages attempt to exploit web browsers. The heuristics reduce the number of URLs we subject to further processing significantly. The pages classified as potentially malicious are used as input to instrumented browser instances running under virtual machines. Our goal is to observe the malware behavior when visiting malicious URLs and discover if malware binaries are being downloaded as a result of visiting a URL. Web sites that have been identified as malicious, using our verification procedure, are labeled as potentially harmful when returned as a search result. Marking pages with a label allows users to avoid exposure to such sites and results in fewer users being infected."

The authors note that Web 2.0 trends, including the incorporation of user-generated content and third-party widgets into sites, raise the risk of innocent sites being exploited by botnet masters. For example, they write:

"Many websites feature web applications that allow visitors to contribute their own content. This is often in the form of blogs, profiles, comments, or reviews. Web applications usually support only a limited subset of the hypertext markup language, but in some cases poor sanitization or checking allows users to post or insert arbitrary HTML into web pages. If the inserted HTML contains an exploit, all visitors of the posts or profile pages are exposed to the attack. Taking advantage of poor sanitization becomes even easier if the site permits anonymous posts, since all visitors are allowed to insert arbitrary HTML."

The paper goes into considerable detail about the system Google is building for identifying suspicious pages. Given the stakes involved, site owners and designers may want to give it a careful read.

Courtesy: Roughtype.com

NewsCorp plans to pay half as much for Photobucket as they did for MySpace. Photobucket is going for $300 million with the earnout (a steal compared to Google/YouTube), and MySpace was acquired for $580 million, back in 2005.

Two separate analytics services, though, show that the Photobucket deal will bring very few new customers to MySpace because of the nearly 100% overlap in users. Nielsen/Netratings says MySpace has 55.9 million monthly unique visitors, compared to Photobucket’s 14.7 million. Combined though, the sites will have just 57.7 million unique visitors. That means just just 1.8 million of Photobucket’s visitors don’t currently visit MySpace, too. That’s a 3% gain for MySpace. If you count just new users, MySpace is paying $167 for each one of them.

Comscore tells a similar story, showing that 77% of Photobucket’s users are also visiting MySpace regularly. As a point of comparison, the overlap between Google and YouTube was even greater according to Comscore. At the time of the acquisition in October 2006, 80% of YouTube’s users also visited Google regularly.

MySpace already offers its users the same basic services as Photobucket (photo and video sharing). If they aren’t buying Photobucket for the product and they aren’t getting any new users…then why are they buying them? To limit the availability of Photobucket features and all that user content to other fast-growing social networks without these features? Because they can? Let’s see what MySpace has to say about this as the deal closes.

Courtesy: Techcrunch.com

IAC said it will launch in the coming days a new mobile application for its Ask.com Web search service that will help consumers find shops and services they want, or friends they're looking for, based on their location at a given moment.

"Ask Mobile GPS," or Global Positioning System, will initially be available on No. 3 U.S. wireless operator Sprint Nextel through a deal between the carrier and WaveMarket, a company that provides location-based services for mobile phones.

In addition to regular search features and GPS-enabled maps and directions, Ask Mobile GPS will also offer services from within IAC's family of Internet brands, beginning with its Citysearch guide for finding customer-recommended restaurants and its Evite online party planner.

Courtesy: Reuters.com

Google Inc.'s corporate tag line has become "Search, Ads and Apps," reflecting a shift beyond search and advertising into online software applications, its chief executive said on Thursday.

Speaking to reporters at the company's headquarters ahead of Google's annual shareholder meeting, Chief Executive Eric Schmidt said his presentation to investors on Thursday afternoon would focus on the three parts of its business. Google, the world's dominant provider of Web search, is also the dominant provider of pay-per-click advertising, which contributes virtually all of its revenue.

Last year, it entered the software application market with products it collectively refers to as "Google Apps." This refers to a series of online software applications and Web publishing tools it provides free to consumers. It also offers a premium, licensed version to companies, government organizations and universities. It marks a challenge to Microsoft Corp.'s Office software franchise, according to analysts. The company's nascent diversification into applications software has generated little revenue to date.

"The idea here is to talk about this shift to an online lifestyle," Schmidt said of the company's growing focus on delivering Web-based applications, not just search and ads. "People are spending more and more time and Google can bring some of these new applications that really matter to them," he said, highlighting Google Calendar, its group scheduling tool, as an example.

Courtesy: Reuters.com