Stabroek News website in the clear - Google

Stabroek News website in the clear – Google

Jun 30, 2010 News

Re-printed from Stabroek News

Internet search giant Google says that the Stabroek News website has not hosted malicious software over the last 90 days and that it “is not currently listed as suspicious.”

Google said that over the last 90 days the website www.stabroeknews.com “appeared to function as an intermediary for the infection of 1 site(s)” and that it was “listed for suspicious activity 1 time(s) over the past 90 days.” This had resulted in the internet search giant temporarily issuing a security advisory listing the Stabroek News website as “suspicious” for several hours on Saturday. However, full access to the website was restored at 9 pm on Saturday.

Stabroek News technical staffer Kester Clarke said that on Friday one of the newspaper company’s web servers was targeted by an unknown attacker. The attack was first observed at 11 pm, and the attacker was able to serve malicious software to visitors on the website on 7 of its pages. According to Clarke, at about 2:30 am on Saturday “the malicious software was removed from the server and the weakness plugged by our technical staff along with the assistance of our Web Host.” The problem, Clarke explained, was solved using an automated system. He said too that efforts are ongoing to prevent such problems from recurring.

By the time the problem was fixed, Clarke said that Google’s Search Advisory had already scanned the infected pages and had begun notifying users of Mozilla Firefox as well as visitors arriving through search engine results that the Stabroek News website might be harmful to their computer. However, during this time, persons using Internet Explorer had no difficulty in accessing the Stabroek News website, Clarke pointed out.

Google in their latest diagnostic test of the website said that the last time suspicious content was found was on Saturday. It said too that “of the 360 pages we tested on the site over the past 90 days, 7 page(s) resulted in malicious software being downloaded and installed without user consent.” The last time Google visited the site was on Monday.

Clarke explained that the malicious software was linked back to the website dhfyjrud321.com which was established sometime on Friday. It is unclear whether this site was created locally, but Clarke said that this was a possibility.

An article appeared in last Sunday’s Guyana Chronicle captioned “Google warns against visiting Stabroek News website; paper sorting problem out with Google”. The article quoted one Michael Jebbs, a security adviser at Google Inc, as saying that “the company had launched an investigation into the operations of Stabroek News after receiving complaints from a U.S Internet Spyware watchdog and dozens of users in the United States alleging that Stabroek News has been installing spyware and malicious software onto the computers of visitors to their website.”

The Guyana Chronicle has to date not carried a follow-up story clarifying that the problem had been solved and was not attributable to SN.

Meanwhile, Clarke said that prior to Friday there had been two complaints from visitors to the Stabroek News website about them receiving spyware after visiting but that these were investigated and proven to be false. He said on both occasions, the spyware had come from other sites that the persons had visited.

SN Editor-in-Chief Anand Persaud said Guyana Publications Inc. will do whatever is necessary to further bolster the security of the website. He said the website is patronized by thousands every day both here and in the diaspora. He added that on a regular basis there are attempts to attack the website but these have been repulsed by the multi-layered security protecting the website and its servers. He said that since the Saturday incident website traffic has returned to normal. (www.stabroeknews.com