Colin's Blog My thoughts on everything.

US Government Website Running Chinese Malware!

This is either a very big deal – or it’s really nothing at all.

The other day while trying to find out how to register my half-breed children as US Citizens, I followed a link from one US government site to another US government site. Instead of getting the site I expected, though, I got a warning from Google’s Safebrowsing thingy saying the the site I was trying to reach had been compromised and was infecting users with malware.  Some of the malware in question is hosted on a .cn domain – which may or may not mean anything.

Here’s the actual text from the Google Safebrowsing page:

Safe Browsing

Diagnostic page for www.consular.canada.usembassy.gov

What is the current listing status for www.consular.canada.usembassy.gov?

Site is listed as suspicious - visiting this web site may harm your computer.

Part of this site was listed for suspicious activity 1 time(s) over the past 90 days.

What happened when Google visited this site?

Of the 8 pages we tested on the site over the past 90 days, 1 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2008-12-06, and the last time suspicious content was found on this site was on 2008-12-06.

Malicious software includes 1 scripting exploit(s). Successful infection resulted in an average of 0 new processes on the target machine.

Malicious software is hosted on 3 domain(s), including wowxman.com/, dbios.org/, yrwap.cn/.

1 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including yrwap.cn/.

Has this site acted as an intermediary resulting in further distribution of malware?

Over the past 90 days, www.consular.canada.usembassy.gov did not appear to function as an intermediary for the infection of any sites.

Has this site hosted malware?

No, this site has not hosted malicious software over the past 90 days.

I'm no internet security expert, but this can't be a good thing, right?

Related posts:

1. Index first, rank later!
2. Excluding Search Engines from Geo-Targetting Techniques
3. Twitterbowl Analysis
4. Google makes a change that just makes sense
5. A Website for the NoProrogue Movement