Google Brands Malware Sites With ‘Repeat Offender’ Tag And 30-Day Timeout
Google has a message for webmasters serving up malware and it goes something like this: Fool me once, shame on you. Fool me twice, shame on me. Going forward, Google is plugging what it calls a "gap" in its online protection scheme that allowed sites serving up malicious content to become repeat offenders without much repercussion or warning to users.
In the past, sites that ran afoul of Google's "Malware, Unwanted Software, Phishing, and Social Engineering Policies" were temporarily branded with a warning to users. The brand would remain until Google could verify that the site is no longer serving up malicious content, and that verification service could be requested by the webmaster.
"However, over time, we’ve observed that a small number of websites will cease harming users for long enough to have the warnings removed, and will then revert to harmful activity. As a result of this gap in user protection, we have adjusted our policies to reduce risks borne by end-users," Google stated in a blog post.
The new policy brands repeat offenders for a longer period of time. Once Google's Safe Browsing mechanism flags a site as a repeat offender, the webmaster will no longer be allowed to request additional reviews for 30 days, during which time visitors to the site will continue to see warnings.
It's a step in the right direction, though it still leaves the process open to abuse. What this essentially does is prolong the process so that webmasters have to wait a month before cleaning up their site results in a clean bill of health from Google, at which point they can infect it again if they wish.
For website owners who are hacked, Google says don't worry, the new policy doesn't apply to compromised sites. Only websites that purposely post harmful content will be branded as repeat offenders and subject to Google's waiting period.
In the past, sites that ran afoul of Google's "Malware, Unwanted Software, Phishing, and Social Engineering Policies" were temporarily branded with a warning to users. The brand would remain until Google could verify that the site is no longer serving up malicious content, and that verification service could be requested by the webmaster.
"However, over time, we’ve observed that a small number of websites will cease harming users for long enough to have the warnings removed, and will then revert to harmful activity. As a result of this gap in user protection, we have adjusted our policies to reduce risks borne by end-users," Google stated in a blog post.
The new policy brands repeat offenders for a longer period of time. Once Google's Safe Browsing mechanism flags a site as a repeat offender, the webmaster will no longer be allowed to request additional reviews for 30 days, during which time visitors to the site will continue to see warnings.
It's a step in the right direction, though it still leaves the process open to abuse. What this essentially does is prolong the process so that webmasters have to wait a month before cleaning up their site results in a clean bill of health from Google, at which point they can infect it again if they wish.
For website owners who are hacked, Google says don't worry, the new policy doesn't apply to compromised sites. Only websites that purposely post harmful content will be branded as repeat offenders and subject to Google's waiting period.
