Malicious tracking script being served from google server to circumvent block lists

Question

I've found some bad JS that tries to open pop-unders and even deliver a likely malicious SWF file for a flash exploit.

Thing is, its stored on a google server in a directory it really shouldnt be. This allowed it to evade my block list.

Is there some way I can inform google about this? Can anybody with more experience tell me if I should do that?

It is served from storage.googleapis.com (https) in a directory for the prototype library. That, to me, seems not good. I have the JS code if anybody wants to see it, its really long so I dont want to put it here.

Answer 1

Firstly, you should establish whether it actually is malicious (or can be exploited maliciously by third parties).

Google has a dedicated page for reporting bugs, vulnerabilities, fraud and malware. There is more information on Google's security philosophy page.

I don't see a reason why you shouldn't inform them of this. However, before you do so, you should double check that it is not just an issue with your computer (i.e. local malware injecting content into your browser pages) and that it is reproducible.