Safe Browsing protection from even more deceptive attacks
November 13th, 2015 | Published in Google Chrome
[Cross-posted on the Google Online Security blog]
Safe Browsing has been protecting over one billion people from traditional phishing attacks on the web for more than eight years. The threat landscape is constantly changing -- bad actors on the web are using other types of deceptive behavior to trick you into performing actions that you didn’t intend or want, so we’ve expanded protection to include social engineering.
Social engineering is a much broader category than traditional phishing and encompasses more types of deceptive web content. A social engineering attack happens when either:
Below are some examples of social engineering attacks that try to trick you into thinking the content is delivered by Google or Chrome. Other trusted brands are also commonly abused for social engineering attacks.
Posted by Emily Schechter, Program Manager and Noé Lutz, Software Engineer
Safe Browsing has been protecting over one billion people from traditional phishing attacks on the web for more than eight years. The threat landscape is constantly changing -- bad actors on the web are using other types of deceptive behavior to trick you into performing actions that you didn’t intend or want, so we’ve expanded protection to include social engineering.
Social engineering is a much broader category than traditional phishing and encompasses more types of deceptive web content. A social engineering attack happens when either:
- The content pretends to act, or looks and feels, like a trusted entity — like a bank or government.
- The content tries to trick you into doing something you’d only do for a trusted entity — like sharing a password or calling tech support.
Below are some examples of social engineering attacks that try to trick you into thinking the content is delivered by Google or Chrome. Other trusted brands are also commonly abused for social engineering attacks.
This page tries to trick you into downloading and executing malware or unwanted software. It uses Chrome’s logo and name to confuse you into believing the site is operated by Google. Content like this may include an inconspicuous legal disclaimer that states it is not affiliated with Google. This does not change the deceptive nature of this content -- as always, use caution when downloading files from the web.
This is a fake tech phone support page. This page mimics a warning and may trick you into calling a third-party company that pretends to be Google or some other trusted entity, but charges a fee for support. (Chrome does not offer paid remote support).
This is a fake Google login page. It might trick you into disclosing your account login credentials. Other phishing sites like this could trick you into giving up other personal information such as credit card information. Phishing sites may look exactly like the real site -- so be sure to look at the address bar to check that the URL is correct, and also check to see that the website begins with https://. See more information here.
If we identify that a web page contains social engineering content, Chrome will warn you by displaying the following interstitial.
(If you believe Safe Browsing has classified a web page in error, please report it here.)
We'll continue to improve Google's Safe Browsing protection to help more people stay safer online. Check out the Safe Browsing Transparency Report to find out more.
Posted by Emily Schechter, Program Manager and Noé Lutz, Software Engineer