0

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit.

Thing is, its stored on a google server in a directory it really shouldnt be. This allowed it to evade my block list.

Is there some way I can inform google about this? Can anybody with more experience tell me if I should do that?

It is served from storage.googleapis.com (https) in a directory for the prototype library. That, to me, seems not good. I have the JS code if anybody wants to see it, its really long so I dont want to put it here.

|improve this question
  • 2
    Why shouldn't you inform Google? If it's as serious as you think it is, I'm pretty sure it'd be better for everyone to inform Google. – tangrs Mar 28 '16 at 7:02
1

Firstly, you should establish whether it actually is malicious (or can be exploited maliciously by third parties).

Google has a dedicated page for reporting bugs, vulnerabilities, fraud and malware. There is more information on Google's security philosophy page.

I don't see a reason why you shouldn't inform them of this. However, before you do so, you should double check that it is not just an issue with your computer (i.e. local malware injecting content into your browser pages) and that it is reproducible.

|improve this answer
  • The danger with "establish if it can actually be exploited" is that unexperienced people will try to figure out how it works and end up getting infected: – Lucas Kauffman Mar 28 '16 at 7:28
  • It's definitely malicious. Or, at least it was in about 2008. It looks for very old vulnerable browsers and tries to exploit them. The SWF is served from a known malware domain. I checked it all out in a VM on a well-patched linux host with no flash, so no worries about self infection. Thanks for the link, my google-fu must have been weak. – jeremy Mar 29 '16 at 4:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.