Google is expanding the way that its Safe Browsing API protects users against malicious content by blocking deceptive content on sites that is considered to be social engineering.
The change to Safe Browsing will focus on detecting and warning users about content that tries to trick users into downloading a piece of software or taking some other action that they wouldn’t normally take. A common example of this is a fake or deceptive download button on a site that’s included in a dialogue box warning about out-of-date software.
“You may have encountered social engineering in a deceptive download button, or an image ad that falsely claims your system is out of date. Today, we’re expanding Safe Browsing protection to protect you from such deceptive embedded content, like social engineering ads,” Lucas Ballard of Google’s Safe Browsing team said in a blog post.
Attackers often use malicious or deceptive ads that imitate legitimate download dialogues for software such as Adobe Flash or Microsoft’s Skype in order to trick users into downloading something else. That download could be a browser tool bar, malware, or some other unwanted software. To non-expert users, these ads or dialogue boxes can seem indistinguishable from authentic ones, which is exactly what fraudsters and attackers are counting on.
Google’s new effort to protect against social engineering takes much of that decision making out of users’ hands. The Safe Browsing API is used not just in Google Chrome, but also in many of the other major browsers, so the new protection will benefit those users, as well.
