Most drive-by malware comes from China, Google says
Google analyzes Web sites in its index and finds that most of the sites that have malware are in China, according to a presentation at the Usenix security conference.
SAN JOSE, Calif.--A analysis by Google of Web sites that have malware found most of the malicious drive-by activity is due to computers in China, an engineer for the search giant said at the Usenix security conference on Wednesday.
About 67 percent of all the sites that secretly drop malicious software onto visitors' computers are located in China, as are 64 percent of the compromised servers, said senior staff engineer Niels Provos during a presentation here at the event.
"Web based malware is a significant problem and...there is no real good proactive defense against this," Provos said.
Between January and October 2007, Google's malware analysis of 66 million unique URLs found 3.5 million had malware, he said. There was a 90 percent detection rate and the false positive rate was 0.1 percent, according to Provos.
The analysis is part of Google's efforts to steer Web surfers clear of sites with malicious software that can install malware on their computers and turn them into zombies on a botnet, which is a growing problem on the Internet.
The company is using its Web site crawling system that feeds up search results when someone "googles" something to analyze the sites that come up.
Google is creating a list of sites that may be harmful to users and putting a warning next to those sites when they appear in Web search results, Provos said. The company began doing this about two years ago.
Twelve percent of the malware infections were due to ads, based on search traffic, he said.
"We're trying to prevent people from going to places where there is bad content, but at the moment there is nothing I can tell my mother that 'this is what you can do to be safe,'" he said.