When clicking ‘OK’ isn’t
Google Montreal battling sneaky software front
Many Internet users have become familiar with the necessary steps to stay safe from malware and viruses, but hidden in plain sight beside l egitimate online products are now businesses that make money by tricking users into downloading look- a- like offerings that slow down or damage computers.
Hard at work in Google’s Montreal office is a small team that’s quietly making the Internet a safer place f or more t han a billion people around the world.
Since 2008, t he t eam — 10 developers and five analysts — has been fighting back against not just viruses and malware, but also the growing problem of unwanted software that sneaks into people’s computers.
“Malware often uses tricks or a vulnerability in a user’s machine to get installed, whereas unwanted software often looks very legitimate because users are looking for something they want but it gets on user’s machines in a deceptive way,” said Nav Jagpal, a software developer on Google Montreal’s Safe Browsing team.
“Once installed, it does things to your machine that are very disruptive.”
For example, if someone is looking for a program like Adobe Flash, they might search Google and get a page full of results. Often the first result is correct, but others might look just as plausible and when clicked has a page with the software’s name and a big download button. Instead of Adobe Flash, however, it ends up being software that might permanently change the default search engine or continually cause pop-ups.
“This is an economic problem. This is a problem with an industry that is financially motivated to get stuff on to your computer that you don’t want,” said Robert Shield, another Montreal- based developer on Google’s Safe Browsing team. “The thing that the team does here, the work we’ve been doing over these past number of years, is to make it a little bit harder for this stuff to happen.”
The Montreal group creates what is essentially a database of known sites or files that are problematic, plus a warning system — often a big, scary- looking screen — that’s triggered when a user stumbles across them. The database is continually updated and offered for other companies to use for free, and it’s already built into most popular web browsers including Google Chrome, Mozilla Firefox and Apple Safari — meaning this team of Canadians are already protecting millions globally, regardless of someone using Google’s other services or not.
“The problem is this move toward social engineering, which is convincing people to click ‘ OK’ under some kind of false pretence,” said Fabrice Jaubert, the Google software developer who also heads up the Safe Browsing team. “Maybe there’s something you’re led to believe you want, or it’s something you truly want but it comes packaged with other stuff and you’re not aware you’re installing 10 other things, then those things on their own pull other things in like bloatware.”
Warning users is just a temporary solution though, as ideally Google would like unwanted software to not exist in the first place, Jagpal said. Unlike people who release malware anonymously, companies who create unwanted software often have contact information or technical support, so Google has taken things a step further by reaching out to them directly or through industry groups like the Clean Software Alliance.
“All of us sit in a room together and try to understand everybody’s perspective,” said Jagpal. “We can explain our perspective about how we don’t want users to have the unpleasant surprise and the people who are creating the software will often try to explain their point of view and how they got to this point. Often it is a lot of finger-pointing.”
The companies are told they are investing a lot of money into trying to mislead people instead of creating a better product, said Jagpal, and if things continue then they’ll just continue to become more like malware.
“Some of these companies are trying to run legitimate shops and they want to compete on the value of their software rather than the deception,” he said.
Already tens of millions of people see warnings from t he Safe Browsing t eam every week, according to Google’s transparency report, and by continually flagging problems over the years the group has seen successes such as getting most vendors to fix security flaws or making a big dent in how malware is distributed, said Jaubert.
“Our goal is to make it so that the average person browsing the web is no longer accidentally exposed without any kind of warning,” he said. “Once people are fully informed and they make the choice they want to make, that’s fair, but at least we’ve given them a chance to be protected.”
The most important thing for people to do is heed the warnings, said Shield, because they are there to protect the user’s computers and stop the problematic company’s revenue.
“The Internet is great and it has wonderful tools and content, but if you can’t use it safely then it detracts from everything else,” he said. “The team here is making it possible to browse the Internet and to view all of this content while staying safe, and it makes me happy to come to work every day.”
YOU’RE NOT AWARE YOU’RE INSTALLING 10 OTHER THINGS.