7 ms·

Google blocks Twitpic over alleged malware

37 points by derpenxyne 14y ago

thehodge 14y ago
I cannot even load tweetdeck at the moment as it seems to preload the images on the links thus showing the big red screen
Zirro 14y ago
This is showing up in Firefox as well, since it uses "Google Safe Browsing" for information about suspicious sites.
jdangu 14y ago
Looks like yet another "malvertising" situation. The Google Safebrowsing report [1] appears fairly ambiguous though: "Site is listed as suspicious - visiting this web site may harm your computer (...)" "Of the 12029 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-30, and suspicious content was never found on this site within the past 90 days." [1] http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F&client=googlechrome&hl=en-US http://safebrowsing.clients.google.com/safebrowsing/diagnost...
- null_ptr 14y ago
  > Looks like yet another "malvertising" situation. And that's all the same to end users. When will the web evolve past these pests?
  - frostmatthew 14y ago
    They're working on it http://www.adsintegrityalliance.org/ http://www.adsintegrityalliance.org/ :-)
kngl 14y ago
I'm happy to use a third party client to browse twitter...
- jeffjose 14y ago
  While this gets you over this minor inconvenience , is it really worth the risk of exposure to malwares?
  - kylemaxwell 14y ago
    You're presuming right now that the detection is accurate and that, if it is, third-party Twitter clients would be susceptible to the same vectors. You have an exposure risk every time you use the Web; managing that risk is part of what we do as users (and, to a greater degree, as professionals).
    - magicalist 14y ago
      if you're ready to manage that risk (based on gut instinct that this is a false positive?), just click through. I don't see the issue there for users. The real issue is false positives from the website's point of view, since the vast majority of users won't click through by design.
twapi 14y ago
even Firefox now warns its users http://browserfame.com/1049/chrome-twitpic-malware-warning http://browserfame.com/1049/chrome-twitpic-malware-warning
- Zirro 14y ago
  That's because both Firefox and Chrome use the same source of information about potentially dangerous sites. It doesn't make Twitpic.com more suspicious.
stevencorona 14y ago
I posted this in another related submission- We're trying to sort it out but there isn't really any information provided by Google/Chrome to go on. The best "details" they have show that Twitpic has 0 pages with Malware. Crazy how some automated process at Google can kill an entire site just like that.
- driverdan 14y ago
  I believe you can appeal the block through Webmaster Tools but I'm not sure how quickly they fix it. Hopefully someone at Google sees this post and fixes it.
- citricsquid 14y ago
  This happened to us (granted we actually did have an infected advert network...) and once the adverts were fixed requesting a review via webmaster tools resolved it: http://support.google.com/webmasters/bin/answer.py?hl=en&answer=168328 http://support.google.com/webmasters/bin/answer.py?hl=en&#38...
- arashf 14y ago
  this is arash from dropbox. a similar thing happened to us a couple years ago and mattcutts helped resolve it pretty quickly (https://twitter.com/mattcutts https://twitter.com/mattcutts). I would try to reach out to him ASAP. edit: ack. just read his twitter feed and it looks like he's out for a week.
- tonfa 14y ago
  Looks like the safebrowsing console is lagging. It currently says "Updated 5 hours ago". I guess once the information propagates to it, you'll have more details. http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F http://safebrowsing.clients.google.com/safebrowsing/diagnost...
  - tonfa 14y ago
    And indeed it now shows: What happened when Google visited this site? Of the 12592 pages we tested on the site over the past 90 days, 31 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-31, and the last time suspicious content was found on this site was on 2012-12-30. Malicious software includes 13 trojan(s), 4 exploit(s). Successful infection resulted in an average of 8 new process(es) on the target machine. Malicious software is hosted on 5 domain(s), including mpchester.info/, malatyuhr.com/, iloveeu.info/. 2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 2upmedia.com/, adexcite.com/. This site was hosted on 3 network(s) including AS36351 (SOFTLAYER), AS15169 (Google Internet Backbone), AS31815 (MEDIATEMPLE). Has this site acted as an intermediary resulting in further distribution of malware? Over the past 90 days, twitpic.com appeared to function as an intermediary for the infection of 1 site(s) including ow.ly/.
nacs 14y ago
I'm not sure this qualifies as news as this same thing has happened to other large sites from time to time. What likely happened is that one of the 3rd party advertisers on Twitpic delivered ads that contain something classified as malware thus resulting in the entire Twitpic site getting blacklisted.
rickmb 14y ago
I wonder if Google's malware warnings have ever been reviewed by lawyers. Because this entire feature smells like a lawsuit waiting to happen.
- ihsw 14y ago
  You can opt out of it -- it's not mandatory.
  - jpdevereaux 14y ago
    As a customer you could choose to opt out, but from a business standpoint it's not so easy.
    - thrownaway2424 14y ago
      The browser works on behalf of the user, not on behalf of the site operator. In the matter of keeping malware off the user's computer, nobody gives two shits what the site operator wants.
- magicalist 14y ago
  The closest analog would be antivirus software deciding your legitimate app was malware, but I can't find any lawsuits over that with some quick searching. Anyone remember one? Punishing anti-malware software for false positives may feel like it could be warranted at times (at least in cases of anti-competitive actions or extreme incompetence), but it seems like it would set an extremely poor precedent. Even worse would be someone winning a case like "yes, there was malware, but you should have sent users though anyway." Which kind of points to the reason why you probably won't see a case like this go far. Whether or not it's bad from the website's point of view, users chose to install a browser that blocks what it thinks are infected sites, and there's still the option (however small or hidden) to click through or disable the warning. There are also tools to figure out why you're blocked (I'm not sure about Microsoft or Opera's system, but I assume so), even if they can be annoyingly slow in internet time. I don't think there's any more case than suing over a browser displaying a broken lock icon (or not loading a page at all) when you serve content over mixed secure and insecure connections, or warning that a self-signed certificate is untrusted and may be an attempt to hijack and redirect you.
tsunamifury 14y ago
It's not googles job to police the Internet. I, and many others, have been subjected to googles safe browsing malware flag without due cause. This is unacceptable and google overstepping its position. I am beginning to hope that someone takes google to task and reigns in thier power over the Internet community. No company should have the ability to practically shut down websites at will.
- magicalist 14y ago
  There's a reason Mozilla and Apple also use this service, and all the major browsers include something like it. Malware, injected malicious code (susceptible to XSS and social engineering attacks), and drive by downloads are a very real problem. You're going to have to suggest an alternative approach if you want to replace it.
- frostmatthew 14y ago
  The warnings are just that, warnings. Any user is free to proceed to the site if they desire. Just like any user is free to NOT use a browser that uses Google's blacklist if they desire (Chrome, Safari, Firefox use it). Though FWIW Google's malware detection is extremely accurate, so it's generally best to simply avoid blacklisted sites until they have been cleaned up.
- jonknee 14y ago
  I'd say by being the largest referrer on the internet and the developer of one of the most popular web browser, Google certainly has an excellent case to "police" the internet. If you don't want Google's advice, don't use Google's kit. As a HN user you're most likely able to take care of yourself, but the vast majority of people are better off heeding Google's advice.
  - rbarooah 14y ago
    Google's "advice" in this case is a statement issued to millions of users accusing a competitor of a crime. If it turns out to be true, that's fine. If it's not true, don't you think Google should be held responsible for the damage to their competitor's reputation?
4varb 14y ago
Interestingly, if you try to load any page with Twitpic content embedded you get the same warning. Try to load the founder's page on Twitter: http://twitter.com/noaheverett http://twitter.com/noaheverett "Danger: Malware Ahead! Google Chrome has blocked access to this page on twitter.com. Content from twitpic.com, a known malware distributor, has been inserted into this web page."
dumbfounder 14y ago
They blocked Twicsy today too, for using a pretty reputable ad network. It seems anti-competitive to me. Google knows it is an ad network that is causing the problems, they even pointed me to the supposedly malicious script. If they know that, they can just disable the ad network and send me a notice on Google Webmaster tools. They did neither, instead they block Twicsy for everyone and display a nasty message. It is ridiculous.

37 points by derpenxyne 14y ago

I cannot even load tweetdeck at the moment as it seems to preload the images on the links thus showing the big red screen

Zirro 14y ago

This is showing up in Firefox as well, since it uses "Google Safe Browsing" for information about suspicious sites.

jdangu 14y ago

Looks like yet another "malvertising" situation. The Google Safebrowsing report [1] appears fairly ambiguous though: "Site is listed as suspicious - visiting this web site may harm your computer (...)" "Of the 12029 pages we tested on the site over the past 90 days, 0 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-30, and suspicious content was never found on this site within the past 90 days." [1] http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F&client=googlechrome&hl=en-US http://safebrowsing.clients.google.com/safebrowsing/diagnost...

null_ptr 14y ago
> Looks like yet another "malvertising" situation. And that's all the same to end users. When will the web evolve past these pests?
- frostmatthew 14y ago
  They're working on it http://www.adsintegrityalliance.org/ http://www.adsintegrityalliance.org/ :-)

kngl 14y ago

I'm happy to use a third party client to browse twitter...

jeffjose 14y ago
While this gets you over this minor inconvenience , is it really worth the risk of exposure to malwares?
- kylemaxwell 14y ago
  You're presuming right now that the detection is accurate and that, if it is, third-party Twitter clients would be susceptible to the same vectors. You have an exposure risk every time you use the Web; managing that risk is part of what we do as users (and, to a greater degree, as professionals).
  - magicalist 14y ago
    if you're ready to manage that risk (based on gut instinct that this is a false positive?), just click through. I don't see the issue there for users. The real issue is false positives from the website's point of view, since the vast majority of users won't click through by design.

twapi 14y ago

even Firefox now warns its users http://browserfame.com/1049/chrome-twitpic-malware-warning http://browserfame.com/1049/chrome-twitpic-malware-warning

Zirro 14y ago
That's because both Firefox and Chrome use the same source of information about potentially dangerous sites. It doesn't make Twitpic.com more suspicious.

stevencorona 14y ago

I posted this in another related submission- We're trying to sort it out but there isn't really any information provided by Google/Chrome to go on. The best "details" they have show that Twitpic has 0 pages with Malware. Crazy how some automated process at Google can kill an entire site just like that.

driverdan 14y ago
I believe you can appeal the block through Webmaster Tools but I'm not sure how quickly they fix it. Hopefully someone at Google sees this post and fixes it.
citricsquid 14y ago
This happened to us (granted we actually did have an infected advert network...) and once the adverts were fixed requesting a review via webmaster tools resolved it: http://support.google.com/webmasters/bin/answer.py?hl=en&answer=168328 http://support.google.com/webmasters/bin/answer.py?hl=en&#38...
arashf 14y ago
this is arash from dropbox. a similar thing happened to us a couple years ago and mattcutts helped resolve it pretty quickly (https://twitter.com/mattcutts https://twitter.com/mattcutts). I would try to reach out to him ASAP. edit: ack. just read his twitter feed and it looks like he's out for a week.
tonfa 14y ago
Looks like the safebrowsing console is lagging. It currently says "Updated 5 hours ago". I guess once the information propagates to it, you'll have more details. http://safebrowsing.clients.google.com/safebrowsing/diagnostic?site=http%3A%2F%2Ftwitpic.com%2F http://safebrowsing.clients.google.com/safebrowsing/diagnost...
- tonfa 14y ago
  And indeed it now shows: What happened when Google visited this site? Of the 12592 pages we tested on the site over the past 90 days, 31 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2012-12-31, and the last time suspicious content was found on this site was on 2012-12-30. Malicious software includes 13 trojan(s), 4 exploit(s). Successful infection resulted in an average of 8 new process(es) on the target machine. Malicious software is hosted on 5 domain(s), including mpchester.info/, malatyuhr.com/, iloveeu.info/. 2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including 2upmedia.com/, adexcite.com/. This site was hosted on 3 network(s) including AS36351 (SOFTLAYER), AS15169 (Google Internet Backbone), AS31815 (MEDIATEMPLE). Has this site acted as an intermediary resulting in further distribution of malware? Over the past 90 days, twitpic.com appeared to function as an intermediary for the infection of 1 site(s) including ow.ly/.

nacs 14y ago

I'm not sure this qualifies as news as this same thing has happened to other large sites from time to time. What likely happened is that one of the 3rd party advertisers on Twitpic delivered ads that contain something classified as malware thus resulting in the entire Twitpic site getting blacklisted.

rickmb 14y ago

I wonder if Google's malware warnings have ever been reviewed by lawyers. Because this entire feature smells like a lawsuit waiting to happen.

ihsw 14y ago
You can opt out of it -- it's not mandatory.
- jpdevereaux 14y ago
  As a customer you could choose to opt out, but from a business standpoint it's not so easy.
  - thrownaway2424 14y ago
    The browser works on behalf of the user, not on behalf of the site operator. In the matter of keeping malware off the user's computer, nobody gives two shits what the site operator wants.
magicalist 14y ago
The closest analog would be antivirus software deciding your legitimate app was malware, but I can't find any lawsuits over that with some quick searching. Anyone remember one? Punishing anti-malware software for false positives may feel like it could be warranted at times (at least in cases of anti-competitive actions or extreme incompetence), but it seems like it would set an extremely poor precedent. Even worse would be someone winning a case like "yes, there was malware, but you should have sent users though anyway." Which kind of points to the reason why you probably won't see a case like this go far. Whether or not it's bad from the website's point of view, users chose to install a browser that blocks what it thinks are infected sites, and there's still the option (however small or hidden) to click through or disable the warning. There are also tools to figure out why you're blocked (I'm not sure about Microsoft or Opera's system, but I assume so), even if they can be annoyingly slow in internet time. I don't think there's any more case than suing over a browser displaying a broken lock icon (or not loading a page at all) when you serve content over mixed secure and insecure connections, or warning that a self-signed certificate is untrusted and may be an attempt to hijack and redirect you.

tsunamifury 14y ago

It's not googles job to police the Internet. I, and many others, have been subjected to googles safe browsing malware flag without due cause. This is unacceptable and google overstepping its position. I am beginning to hope that someone takes google to task and reigns in thier power over the Internet community. No company should have the ability to practically shut down websites at will.

magicalist 14y ago
There's a reason Mozilla and Apple also use this service, and all the major browsers include something like it. Malware, injected malicious code (susceptible to XSS and social engineering attacks), and drive by downloads are a very real problem. You're going to have to suggest an alternative approach if you want to replace it.
frostmatthew 14y ago
The warnings are just that, warnings. Any user is free to proceed to the site if they desire. Just like any user is free to NOT use a browser that uses Google's blacklist if they desire (Chrome, Safari, Firefox use it). Though FWIW Google's malware detection is extremely accurate, so it's generally best to simply avoid blacklisted sites until they have been cleaned up.
jonknee 14y ago
I'd say by being the largest referrer on the internet and the developer of one of the most popular web browser, Google certainly has an excellent case to "police" the internet. If you don't want Google's advice, don't use Google's kit. As a HN user you're most likely able to take care of yourself, but the vast majority of people are better off heeding Google's advice.
- rbarooah 14y ago
  Google's "advice" in this case is a statement issued to millions of users accusing a competitor of a crime. If it turns out to be true, that's fine. If it's not true, don't you think Google should be held responsible for the damage to their competitor's reputation?

4varb 14y ago

Interestingly, if you try to load any page with Twitpic content embedded you get the same warning. Try to load the founder's page on Twitter: http://twitter.com/noaheverett http://twitter.com/noaheverett "Danger: Malware Ahead! Google Chrome has blocked access to this page on twitter.com. Content from twitpic.com, a known malware distributor, has been inserted into this web page."

dumbfounder 14y ago

They blocked Twicsy today too, for using a pretty reputable ad network. It seems anti-competitive to me. Google knows it is an ad network that is causing the problems, they even pointed me to the supposedly malicious script. If they know that, they can just disable the ad network and send me a notice on Google Webmaster tools. They did neither, instead they block Twicsy for everyone and display a nasty message. It is ridiculous.