Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Great! I made a post recently where I mentioned that my system might be infected. Now something new came up. When I search for Stack Overflow on Google, I see that the URL is www.doioig.gov/. When I click that link, I am taken to a redirect page that says:

If you are not redirected automatically, please click the link to continue to the U.S. Department of the Interior Office of Inspector General which is actually http://www.doi.gov/oig/index.cfm.

Notice that the names of the URL in search results and hyperlink are different. I searched for a couple of bank sites to see if something similar happens. But nothing like this happened.

Here are my screenshots -

Search results for Stack Overflow

Pager redirect

share|improve this question
6  
That's awesome and crazy in equal measure –  Marc Gravell Mar 2 '13 at 22:43
3  
    
yes, its been fixed now. –  FirstName LastName Mar 3 '13 at 5:18
add comment

3 Answers

up vote 15 down vote accepted

You're not infected. I get the same result too. Based on the discussion here, it looks like somebody responsible for the US Department of the Interior web site used some code from StackOverflow without changing everything he/she needed to change.

share|improve this answer
add comment

Google is not the DNS.

When you enter "stackoverflow" in Google, you are asking Google to give you links to sites which are "relevant" to that search term -- with a notion of relevance which is never made explicit, but is known to change regularly. For that matter, it seems that the internal algorithms used at Google somehow chose to point at the Office of Inspector General, a US federal agency. It is not specific to you; I get the same result.

This is a reminder that software has bugs. This one is rather harmless. I suppose the people at Google are currently trying to work out why their algorithm does that.

share|improve this answer
    
I understand that goog is not the DNS. I save the trouble of typing full/partial wesbite names by searching them on google instead. :) Funny thing is that this search error did not happen before. –  FirstName LastName Mar 2 '13 at 18:37
    
If this issue can be replicated, do you think it can be used as phishing attack to less prudent users? (EBay, various banks, etc) For example does the Google Search Appliance merge data with the Google Datacenter? –  makerofthings7 Mar 2 '13 at 18:47
2  
I sent a ticket to security@google.com if this could be used as a phishing vector. –  makerofthings7 Mar 2 '13 at 19:12
add comment

Someone spammed the Google Search Engine with a fake site more than likely. It's the first result here as well.

Voluntarily visiting such sites that are obviously bad "Isn't a Good Idea TM" as they were stuck there for a purpose, often running links to infection engines if they're not simply fake search engine traffic attractors. Research the domain provided in the link before clicking it.

NOTE: Further cross references shows www.doioig.gov to be legitimate, however; the warning still stands. If something weird comes up in a search result, research the link before blindly clicking on it.

share|improve this answer
1  
then i guess its google's problem. maybe i am not infected after all :) –  FirstName LastName Mar 2 '13 at 18:30
1  
Still wouldn't hurt to run some anti-virus scans just to be sure. Of course, that's always true. –  Kevin Mar 2 '13 at 23:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.