Chrome to offer constant, real-time protection against malicious sites 24/7

Google is upgrading Chrome’s Safe Browsing security tool by allowing it to provide constant protection against suspicious websites in real-time.

Before going into the update itself, it’s worth covering the backstory. Safe Browsing gives the Chrome browser a list of thousands of well-known, unsafe websites on the internet. Whenever you visit a webpage, the software will check to see if it’s on the list. If it’s there, Chrome will immediately block it and bring up a warning page telling you to stay away. According to Google’s Security Blog, that list is updated every 30 to 60 minutes 24/7. However, the bad actors behind these malicious websites have adapted to the changing landscape.

Google states a majority of these unsafe web pages littering the internet are only around “for less than 10 minutes”. Because the list refreshes every 30 minutes or so, there is a blind spot within this time frame. Bad actors are exploiting the blind spot and slipping through Chrome’s defenses. It’s a small window of opportunity, but it’s enough to do a lot of damage. 

The solution here, as mentioned earlier, is to provide real-time protection.

Security boost

It's important to note the security boost is being made to Safe Browsing's Standard Protection mode. A company representative told us Enhanced mode already has these capabilities, but Google is essentially closing the gap a bit.

The way the new default will work is a little complicated, so here’s a quick breakdown.

Let’s say you visit a website not on Chrome’s list. The browser will then take the page’s URL, break it down into smaller bits of data, and send the packet to a third-party privacy server owned by Fastly, a company specializing in cloud computing. The server then analyzes the data and matches what it finds against its own database. If anything weird is found, Chrome is alerted and will warn you to stay away.

Of course, there’s more to it than that. We didn’t go over exactly how the browser breaks down the URL. If you want more details, we recommend checking out the blog post and Google’s URL hashing guidance page.

Activating the enhanced Safe Browsing does require more information than normal. But it's important to note that neither Google nor Fastly will receive any user identifiers. IP addresses will not be collected. All the security checks you send over are mixed in with requests from other people so it’s all one big mess. And because Fastly runs the server independently, Google has no access to the data.

Accessing the new Safe Browsing tool

The same representative from earlier told us the upgrade is live on Chrome for desktop and iOS, but not for Android. That's coming later on in the month.

Because it'll be the default, you don't have to manually activate it. To obtain the tool, start by clicking the three dots in the upper right corner. Go to Help, then select About Google Chrome. The installation will begin automatically. Relaunch the browser once prompted.

Return to the Settings menu, select Privacy and Security on the left, then go to the Security tab. Expand Safe Browsing and you should see Safe Browsing's standard mode with the updated text. We didn't receive the patch at the time of this writing, so the image below is still the old version. It's just an example of what you might see.

Chrome's Safe Browsing

(Image credit: Future)

Since the Android version isn't out yet, we can't show you its process although we suspect it'll be very similar to the desktop experience. 

It's unknown what kind of extra information Google will ask from its users. Presumably, the data it'll want will be the same listed under the Enhanced mode: system information, extension activity, and the like. We reached out to Google for more details. This story will be updated at a later time.

To learn how to further beef up your computer's security, check out TechRadar's roundup of the best antivirus software for 2024.

You might also like

TechRadar – All the latest technology news

Read More

The Web Foundation wants to kill malicious websites for good

While the web is a wonderful thing, there are those who want to take advantage of users through deceptive design choices or “dark patters”. 

The Web Foundation's Tech Policy Design Lab is working on some ideas to help reduce these practices, including by producing a portfolio of UX and UI website builder tools that can be used in place of deceptive practices. 

“Everything we do online is influenced by how the tools we use are built,” the project states. “Deceptive design are practices built into user interfaces that obscure or impair consumer autonomy or choice and can alter decision-making or trick users into taking actions they might not otherwise take. This harmful design phenomenon is unfortunately widespread today.” 

Dark patterns

“In the coming months, we’ll gather evidence of the harms of dark patterns, including who these practices impact the most, and how they affect the most marginalised communities in particular,” says the project. 

TechCrunch spoke to some of those behind the initiative, including Kaushalya Gupta, who leads the programme at the Policy Design Lab, who said the goal was to bring “human-centered design” to the web. 

The project will bring together various different organisations and groups to help work out some ideas. The end result should – hopefully – be some more user-focused decisions. The initiative was launched after polling thousands of organisations, whittling down 200 topics to “deceptive designs”. 

Analysis: Beware! Deception is everywhere

Deceptive designs, or dark patterns, are everywhere on the web. They occur so often that there's even a Twitter account, @darkpatterns, dedicated to documenting them. 

Newspapers such as The New York Times, for example, require users to actually call up to cancel a subscription that was started online. Amazon often pushes users towards signing up for Prime. Indian company Byju's offers subscriptions that look free but aren't. Adobe charges users huge fees to cancel subscriptions. 

The list goes on and on and the end result is that users lose – often monetarily. 

There is a long way to go, and perhaps this project will turn into nothing, but the increasing recognition of the problem, coupled with actual solutions, is definitely a step in the right direction. 

TechRadar – All the latest technology news

Read More

The Web Foundation wants to kill malicious websites for good

While the web is a wonderful thing, there are those who want to take advantage of users through deceptive design choices or “dark patters”. 

The Web Foundation's Tech Policy Design Lab is working on some ideas to help reduce these practices, including by producing a portfolio of UX and UI website builder tools that can be used in place of deceptive practices. 

“Everything we do online is influenced by how the tools we use are built,” the project states. “Deceptive design are practices built into user interfaces that obscure or impair consumer autonomy or choice and can alter decision-making or trick users into taking actions they might not otherwise take. This harmful design phenomenon is unfortunately widespread today.” 

Dark patterns

“In the coming months, we’ll gather evidence of the harms of dark patterns, including who these practices impact the most, and how they affect the most marginalised communities in particular,” says the project. 

TechCrunch spoke to some of those behind the initiative, including Kaushalya Gupta, who leads the programme at the Policy Design Lab, who said the goal was to bring “human-centered design” to the web. 

The project will bring together various different organisations and groups to help work out some ideas. The end result should – hopefully – be some more user-focused decisions. The initiative was launched after polling thousands of organisations, whittling down 200 topics to “deceptive designs”. 

Analysis: Beware! Deception is everywhere

Deceptive designs, or dark patterns, are everywhere on the web. They occur so often that there's even a Twitter account, @darkpatterns, dedicated to documenting them. 

Newspapers such as The New York Times, for example, require users to actually call up to cancel a subscription that was started online. Amazon often pushes users towards signing up for Prime. Indian company Byju's offers subscriptions that look free but aren't. Adobe charges users huge fees to cancel subscriptions. 

The list goes on and on and the end result is that users lose – often monetarily. 

There is a long way to go, and perhaps this project will turn into nothing, but the increasing recognition of the problem, coupled with actual solutions, is definitely a step in the right direction. 

TechRadar – All the latest technology news

Read More

Surge in Malicious QR Codes Sparks FBI Alert

QR codes have become a go-to staple for contactless transactions of all sorts during the pandemic, and the FBI is warning cybercriminals are capitalizing on their lax security to steal data and money, and drop malware.
Threatpost

Read More

There are more malicious domains online than ever before

Thousands of new domains are registered everyday so that businesses and individuals can build websites but new research from Palo Alto Networks has revealed that cybercriminals often register malicious domains years before they intend to actually use them.

The cybersecurity firm's Unit 42 first began its research into dormant malicious domains after it was revealed that the threat actors behind 2019's SolarWinds hack used them in their attack. To identify strategically aged domains and monitor their activity, Palo Alto Networks launched a cloud-based detector in September of 2021.

According to the findings of the firm's researchers, 22.3 percent of strategically aged domains pose some form of danger with a small portion being straight-out malicious (3.8%), a majority being suspicious (19%) and some being unsafe for work environments (2%).

The reason cybercriminals and other threat actors let a domain is age is to create a “clean record” so that their domain will be less likely to be blocked. Newly registered domains (NRDs) on the other hand are more likely to be malicious and for this reason, security systems often flag them as suspicious. However, according to Palo Alto Networks, strategically aged domains are three times more likely to be malicious than NRDs.

Detecting malicious domains lying dormant

When a sudden spike in traffic is detected, it's often the case that a strategically aged domain is actually malicious. This is because normal websites typically see their traffic grow gradually from when they're created as more people visit a site after learning about it through word of mouth or advertising.

At the same time, domains that aren't intended for legitimate purposes often have incomplete, cloned or questionable content and usually lack WHOIS registrant details as well. Another sign that a domain was registered and intended to be used at a later time in malicious campaigns is DGA subdomain generation.

For those unfamiliar, DGA or domain generation algorithm is a method used to generate domain names and IP addresses that will serve as command and control (C2) communication points used to evade detection and block lists. Just by examining sites using DGA, Palo Alto Networks' cloud-based detector was able to identify two suspicious domains each day.

During its investigation, the cybersecurity firm discovered a Pegasus spying campaign that used two C2 domains registered in 2019 that finally became active two years later in July of 2021. Palo Alto Networks' researchers also found phishing campaigns that used DGA subdomains as well as wildcard DNS abuse.

We've also highlighted the best web hosting, best endpoint protection software and best malware removal software

Via Bleeping Computer

TechRadar – All the latest technology news

Read More