Friday, July 13, 2018

Safe Browsing: malware and phishing




Safe Browsing is a service that Google's security team built to identify unsafe websites across the web and notify users and webmasters of potential harm. In this Transparency Report, we disclose details about the threats we detect and the warnings we show to users. We share this information to increase awareness about unsafe websites, and we hope to encourage progress toward a safer and more secure web.

How we identify unsafe websites

Google’s Safe Browsing service examines billions of URLs and software and content on those pages in its search for unsafe websites. Safe Browsing then warns users when they navigate to websites that could steal their personal information or install software designed to take over their computers. Every week, Safe Browsing protects billions of devices.

Unsafe websites detected per week

Every day, Safe Browsing discovers thousands of new unsafe sites. Many of these are legitimate websites that have been compromised by hackers. Unsafe sites fall into two categories that threaten users’ privacy and security: phishing and malware

Malware explained 

These websites contain code that installs malicious software onto visitors’ computers, either when a user thinks they are downloading legitimate software or without a user’s knowledge. Hackers can then use this software to capture and transmit users' private or sensitive information. Our Safe Browsing technology also scans and analyzes the web to identify potentially compromised websites

Phishing explained

These websites pretend to be legitimate so that they can trick users into typing in their usernames and passwords or sharing other private information. Web pages that impersonate legitimate bank websites or online stores are common examples of phishing sites. 

 

 


Manage warnings about unsafe sites


You'll see a warning if the content you're trying to see is dangerous or deceptive. These sites are often called "phishing" or "malware" sites.

Get warnings about dangerous & deceptive content

Phishing and malware detection is turned on by default. When it's turned on, you might see the following messages. If you see one of these messages, we recommend that you don't visit the site.
  • The site ahead contains malware: The site you're trying to visit might try to install bad software, called malware, on your computer.
  • Deceptive site ahead: The site you're trying to visit might be a phishing site.
  • The site ahead contains harmful programs: The site you're trying to visit might try to trick you into installing programs that cause problems when you’re browsing online.
  • This page is trying to load scripts from unauthenticated sources: The site you're visiting is not secure.
Download with caution: Some sites try to trick you into downloading harmful software by telling you that you have a virus. Be careful not to download any harmful software.

View unsafe sites, content & downloads

You can visit a page or access a downloaded file that is showing a warning. This is not recommended.

Visit an unsafe page

  1. On your computer, open Chrome.
  2. On the page where you see a warning, click Details.
  3. Click Visit this unsafe site.
  4. The page will load.
When you visit an unsafe site, Chrome will try to remove the unsafe content from the page.
To view the entire page:
  1. On your computer, open Chrome.
  2. On a deceptive site, to the right of the address bar, click Content blocked Content blocked.
  3. In the alert, click Load full site.
  4. The page will load.
If the error mentions scripts, you can view the entire page by clicking Load unsafe script.

Download an unsafe file

  1. On your computer, open Chrome.
  2. At the top right, click More More and then Downloads.
  3. Find the file you want to download.
  4. Click Recover malicious file.

Turn off warnings about dangerous & deceptive sites

If you don't want to be warned about unsafe content, you can turn off deceptive and dangerous site alerts. This also turns off download warnings.
We do not recommend turning off alerts.
  1. On your computer, open Chrome.
  2. At the top right, click More More and then Settings.
  3. At the bottom, click Advanced.
  4. Under "Privacy and security," turn off Protect you and your device from dangerous sites.

What warnings about dangerous & deceptive content mean

  • Deceptive sites (also known as "phishing" or "social engineering" sites) try to trick you into doing something dangerous online, such as revealing passwords or personal information, usually through a fake website.
  • Dangerous sites (also known as "malware" or "unwanted software" sites) can harm your computer, or can cause problems when you’re browsing online. Learn how to clean Chrome of unwanted ads, pop-ups & malware.
  • Google Safe Browsing: To protect you from dangerous websites, Google maintains a list of websites that might put you at risk for malware or phishing. Google also analyzes sites and warns you if a site seems dangerous. Learn more about Google Safe Browsing.
  • Using a Chromebook at work or school? Your network administrator might set up phishing and malware detection for you, in which case you can't change this setting yourself. Learn about using a Chromebook through work or school.

My site or software is marked dangerous

My site blocked from Google Search?



If Google suspects your site of hosting dangerous or spammy downloads, engaging in practices that are bad or dangerous to the user, or of being hacked, you will see a warning either in Google Search results or in your browser (or both).
  • Google Search results might show labels such as "This site may harm your computer" or "This site may be hacked" next to your site.
  • Your browser might display an interstitial page when you try to open your page, either from a link in Google Search results or anywhere else.
  • If you are a verified site owner in Search Console, you should receive an email from Search Console warning that your site is suspected of being hacked or containing content that is harmful to visitors. You can also see warnings in the Security Issues report for your site.
Interstitial malware warning in the browser.
Interstitial hacked website warning in the browser.
Example warnings that you might see in your browser

Your website contains malware.
The term malware covers all sorts of malicious software designed to harm a computer or network. Kinds of malware include (but are not limited to) viruses, worms, spyware, and Trojan horses. Once a site or computer has been compromised, it can be used to host malicious content such as phishing sites (sites designed to trick users into parting with personal and credit card information). Some hackers may even take administrative control over a hacked site.
If your site has been infected, it is generally because some vulnerability has allowed a hacker to take control of your site. The hacker may change the content of the site (for example, to add spam), or add additional pages to the site, usually with the intent of phishing. Alternatively, they may inject malicious code (malware)—for example, scripts or iframes that pull content from another website that tries to attack any computer that views the page. Learn how Google defines malware and unwanted software.
This site may be hacked.​
Hacked content is any content placed on your site without your permission as a result of vulnerabilities in your site’s security. In order to protect our users and to maintain the integrity of our search results, Google tries its best to keep hacked content out of our search results. Hacked content is often of poor quality, and may be designed to mislead users or infect their computer or device. We recommend that you keep your site secure, and clean up hacked content when you find it.

See What can I do? below to learn how to handle these problems.

Why did this happen?

Google checks the pages that it indexes for malicious scripts or downloads, content violations, policy violations, and many other quality and legal issues that can affect users.  When Google detects content that should be blocked, it can take the following actions:
  • Hide search results silently
  • Label search results as dangerous or omitted for a specific purpose
  • Add pages to the Safe Browsing list of dangerous sites, which is used by most major browsers. These browsers typically warn users in some way before visiting affected pages.
The material on the page or site might violate our policies, whether or not you intended to.
  • You might have hired someone to manage your content or search performance, and this person engaged in practices that violate the Google Webmaster Quality guidelines: for example, link purchasing in order to increase search rankings).
  • Your site might have been hacked without your knowledge by professionals who engage in bad practices for money or other nefarious goals.

What material can be blocked or labeled?

Material that violates a Google policy, a law, or has been banned for some other reason can be labeled or removed.

Six Google search tips to find anything faster


Google is the go-to destination when you need to find something on the web—the verb "to google" even made it into the dictionary. But while everyone's heard of the popular search engine, very few know how to make the most of it.

Behind the unassuming Google interface, you'll find a host of useful tricks to help you zero in on what exactly you want to find. Looking for an obscure recipe or rare photo? Read on to start using Google like an expert.
1 of 6

Include and exclude keywords

Search operators
Search operators
You can include or exclude specific keywords.
David Nield/Popular Science
When you type a bunch of search terms into Google, it's smart enough to understand—more or less—what you want. However, the search engine sometimes provides results that match most of, but not all, of the words you typed. To be more specific, you can point out which keywords are the most important: Put a plus symbol (+) in front of words you want to force Google to include. What if the results you want get pushed off the page by similar, but irrelevant, articles? There's an easy fix: Just add a minus symbol (-) in front of keywords that you don't want to see.

Google has to match any word preceded by a plus, and exclude any word preceded by a minus. Keywords that lack a preceding symbol are considered important but not essential. For example, search for "+Chicago +coffee -starbucks" to make sure you see results for non-Starbucks coffee shops in Chicago. Running that search without the symbols would bring up a very different list of results. Search for "dolphins -miami -football," meanwhile, to look up the aquatic mammals without seeing any mention of the football team.
While we're talking about symbols, don't forget quotation marks. Put these around a specific phrase you want to find. For example, if you want to look up the Walt Whitman poem "When I Heard the Learn’d Astronomer," you don't want articles about astronomers with hearing problems. So put the title in quotation marks to ensure more specific results.
2 of 6

Search within websites

Searching sites
Searching sites
Focus your search on one particular site.
David Nield/Popular Science
One of the most useful Google tricks to learn is the site-specific search: Just add "site:url" (replacing the "url" part with the relevant website) to the end of your search query to look on one particular site.


For example, let's say you want to find what Popular Science has written about frogs. Simply go to the Google homepage and search for "frogs site:popsci.com." The results will only include pages from the specified site, and Google will apply its usual weighting, so you'll see the most relevant hits (based on factors like how many other sites link to a page, its timeliness, and so on) first. When you need to find something on a website, then this trick often works better than a site's own built-in search option. Try combining it with the keyword manipulations we mentioned above to narrow down your results even further.
Google also lets you search within a top-level domain. Say you're trying to look up technical scientific information—you'll probably find more reliable results on a university or government website than you might see on a random blog. So add "site:.edu" to your search query to limit results to university websites. Or if you want, say, NASA's take on space information, add "site:.gov."
3 of 6

Limit the time period

Date search
Date search
Dig deep into the past.
David Nield/Popular Science
Google has been indexing the web for a long time now. While that's great for pulling up stuff from decades past, it also makes it more difficult for searchers to cut through the noise to find the exact site or page that they're after. Searching within a specific time period can help with that.
After you've run a search on the main Google search engine, click Tools and then the Any time drop-down menu to limit the results to more recent hits. This tweak is helpful for focusing on very recent stories.
On the other hand, if you want to look for archived news that has since been replaced by more current stories, then you might want to specify a date range. Choose Custom range, and you get to specify a start and end date.
4 of 6

Find files

File type search
File type search
Discover PDFs, spreadsheets, and more.
David Nield/Popular Science
Google's search results mainly concentrate on webpages, but it also indexes publicly available files. You can look for them using a "filetype:" command at the end of your normal query.
So looking for "report filetype:pdf" will return PDFs with "report" in the title. Try "report filetype:xlsx" to do the same for Excel spreadsheets. This also lets you search for images, though Google already has a handy image search tool.
Remember, this will only work for publicly available documents and files uploaded to the web. You're not going to suddenly come across some secret government files...or at least we hope not.
5 of 6

Advance your search

Advanced search
Advanced search
A host of extra options are available through the advanced search interface.
David Nield/Popular Science
These tricks are great for getting started, but if you really want to get specific, you should take advantage of Google's more specialized search options. On any Google search results page, click Settings from the toolbar at the top, and then choose Advanced search. The subsequent page will give you a host of extra ways to focus your searches, from looking at a given region to finding images you have the right to reuse.
Some of the operators, such as specific phrases, will be familiar by now. But the extra region and language options can be helpful. By default, Google prioritizes hits from the country or continent where you're currently located, so you should use these settings to get better results for the rest of the world.
The advanced search page is also worth visiting if you forget one of the tricks we've mentioned above, like searching on a certain site or excluding keywords—or doing both at the same time. Once you've typed in all your parameters, click Advanced Search to see what you can find.
6 of 6

Get personal

Personal results
Personal results
You can search through your own Google accounts.
David Nield/Popular Science
Want to sift through the emails and files you've stored in Gmail or Google Drive? You don't have to visit those apps—Google will let you search through your personal accounts from the main search engine page. However, this will only work if whatever you're looking for is in a Google app and you're signed into your Google account. So don't worry: Your emails won't pop up when somebody else googles you from a strange computer.
For example, type "my flights" into the Google search box to see information on flights you've previously booked. "My trips" will reveal upcoming trips you're taking. (Side note: Google will pull this data from your Gmail account, so if you didn't receive a confirmation email, you won't see trip information.) You can look through your Google Photos too—try searching "my photos of..." with the name of one of your contacts.
Recently, Google has been making personal searches a more prominent feature. You can find a dedicated Personal tab at the top of the results page, alongside the usual News, Images, and Videos ones. It's a one-stop searching shop for all the stuff you've stored in Google's various services.

Secure your site with HTTPS

 

What is HTTPS?

HTTPS (Hypertext Transfer Protocol Secure) is an internet communication protocol that protects the integrity and confidentiality of data between the user's computer and the site. Users expect a secure and private online experience when using a website. We encourage you to adopt HTTPS in order to protect your users' connections to your website, regardless of the content on the site.
Data sent using HTTPS is secured via Transport Layer Security protocol (TLS), which provides three key layers of protection:
  1. Encryption—encrypting the exchanged data to keep it secure from eavesdroppers. That means that while the user is browsing a website, nobody can "listen" to their conversations, track their activities across multiple pages, or steal their information.
  2. Data integrity—data cannot be modified or corrupted during transfer, intentionally or otherwise, without being detected.
  3. Authentication—proves that your users communicate with the intended website. It protects against man-in-the-middle attacks and builds user trust, which translates into other business benefits.

Best practices when implementing HTTPS

Use robust security certificates

You must obtain a security certificate as a part of enabling HTTPS for your site. The certificate is issued by a certificate authority (CA), which takes steps to verify that your web address actually belongs to your organization, thus protecting your customers from man-in-the-middle attacks. When setting up your certificate, ensure a high level of security by choosing a 2048-bit key. If you already have a certificate with a weaker key (1024-bit), upgrade it to 2048 bits. When choosing your site certificate, keep in mind the following:
  • Get your certificate from a reliable CA that offers technical support.
  • Decide the kind of certificate you need:
    • Single certificate for single secure origin (e.g. www.example.com).
    • Multi-domain certificate for multiple well-known secure origins (e.g. www.example.com, cdn.example.com, example.co.uk).
    • Wildcard certificate for a secure origin with many dynamic subdomains (e.g. a.example.com, b.example.com).

Use server-side 301 redirects

Redirect your users and search engines to the HTTPS page or resource with server-side 301 HTTP redirects.

Verify that your HTTPS pages can be crawled and indexed by Google

  • Do not block your HTTPS pages by robots.txt files.
  • Do not include meta noindex tags in your HTTPS pages.
  • Use Fetch as Google to test that Googlebot can access your pages.

Support HSTS

We recommend that HTTPS sites support HSTS (HTTP Strict Transport Security). HSTS tells the browser to request HTTPS pages automatically, even if the user enters http in the browser location bar. It also tells Google to serve secure URLs in the search results. All this minimizes the risk of serving unsecured content to your users.
To support HSTS, use a web server that supports it and enable the functionality.
Although it is more secure, HSTS adds complexity to your rollback strategy. We recommend enabling HSTS this way:
  1. Roll out your HTTPS pages without HSTS first.
  2. Start sending HSTS headers with a short max-age. Monitor your traffic both from users and other clients, and also dependents' performance, such as ads.
  3. Slowly increase the HSTS max-age.
  4. If HSTS doesn't affect your users and search engines negatively, you can, if you wish, ask your site to be added to the HSTS preload list used by most major browsers.

Consider using HSTS preloading

If you enable HSTS, you can optionally support HSTS preloading for extra security and improved performance. To enable preloading, you must visit hstspreload.org and follow the submission requirements for your site.

Avoid these common pitfalls

Throughout the process of making your site secure with TLS, avoid the following mistakes:
Issue Action
Expired certificates Make sure your certificate is always up to date.
Certificate registered to incorrect website name Check that you have obtained a certificate for all host names that your site serves. For example, if your certificate only covers www.example.com, a visitor who loads your site using just example.com (without the "www." prefix) will be blocked by a certificate name mismatch error.
Missing Server name indication (SNI) support Make sure your web server supports SNI and that your audience uses supported browsers, generally. While SNI is supported by all modern browsers, you'll need a dedicated IP if you need to support older browsers.
Crawling issues Don't block your HTTPS site from crawling using robots.txt.
Indexing issues Allow indexing of your pages by search engines where possible. Avoid the noindex meta tag.
Old protocol versions Old protocol versions are vulnerable; make sure you have the latest and newest versions of TLS libraries and implement the newest protocol versions.
Mixed security elements Embed only HTTPS content on HTTPS pages.
Different content on HTTP and HTTPS Make sure the content on your HTTP site and your HTTPS is the same.
HTTP status code errors on HTTPS Check that your website returns the correct HTTP status code. For instance 200 OK for accessible pages, or 404 or 410 for pages that do not exist.

More tips

See the HTTPS migration FAQs for more tips about using HTTPS pages on your site.

Migrating from HTTP to HTTPS

If you migrate your site from HTTP to HTTPS, Google treats this as a site move with a URL change. This can temporarily affect some of your traffic numbers. See the site move overview page to learn more.
Add the HTTPS property to Search Console; Search Console treats HTTP and HTTPS separately; data for these properties is not shared in Search Console. So if you have pages in both protocols, you must have a separate Search Console property for each one.

Turn on HTTPS for your blog



If you want visitors to access your blog over HTTPS, you can turn on HTTPS and HTTPS redirect.
There are three main benefits to using HTTPS instead of HTTP to access your blog:
  • It helps check that your visitors open the correct website and aren’t being redirected to a malicious site.
  • It helps detect if an attacker tries to change any data sent from Blogger to the visitor.
  • It adds security measures that make it harder for other people to listen to your visitors’ conversations, track their activities, or steal their information.
To turn on HTTPS for your custom domain blog:
  1. Sign in to Blogger.
  2. In the top left, click the Down arrow Down Arrow.
  3. Select the blog to update.
  4. In the left menu, click Settings and then Basic.
  5. On the right, under "HTTPS" and "HTTPS Availability," select Yes.
Note: If you don't use a custom domain for your blog, HTTPS is automatically turned on for your blog and the HTTPS setting is hidden. 

Turn on HTTPS redirect

When you enable HTTPS redirect, visitors always reach the encrypted version of your blog at https://<your-blog>.blogspot.com.
  1. Sign in to Blogger.
  2. In the top left, click the Down arrow Down Arrow.
  3. Select the blog to update.
  4. In the left menu, click Settings and then Basic.
  5. On the right, under "HTTPS" and "HTTPS Redirect," select Yes.