Google Search Results Spoofed To Create Fake News

A spoofing technique that creates fake Google search results has been uncovered, which could be used in political influence campaigns or for other nefarious purposes. The technique can be used to spread disinformation while leveraging the trust people have in Google’s search results.

In this age of fake news, people are more wary than ever of efforts to sway public opinion using disinformation, this has led to a wholesale questioning of news sources spread around on social media. It’s also prompted Facebook, Twitter and others to action in terms of cracking down on influence campaigns.

Less top of mind however are systems that we’ve come to trust and rely upon, namely, Google searches.

Despite some accusations that Google has gamed its search algorithms to return left-skewing news results (a charge it categorically has denied), most people trust the search engine to return relevant and accurate information. A spoofing technique takes advantage of Google’s perceived legitimacy to create more believable false information, by simply adding two parameters to any Google Search URL.

According to the independent Dutch researcher Wietze Beukema, the approach makes use of Knowledge Cards, which are boxes on the right-hand side of the screen that contain relevant information to whatever search query a user types into Google Search. For instance, a search for “MSNBC” offers regular search results along with a Knowledge Card with key facts about the news outlet.

Knowledge Cards are far from completely solid sources of information – according to the researcher, most information comes straight from Wikipedia and a mix of other sources like corporate boilerplate.

“Unfortunately, Knowledge Graph doesn’t tell you where it got the information from,” Beukema wrote in a blog post recently. “In addition, the algorithm sometimes mixes up information when there are multiple matches (e.g. people with the same name). This has led to a small number of incidents regarding the feature’s accuracy.”

Nonetheless, most people take the information at face value, opening the door to social engineering.

“People have effectively been trained to take information from these boxes that appear when googling,” said Beukema. “It’s convenient and quick – I have caught myself relying on the information presented by Google rather than studying the search results.”

It turns out that anyone can attach a Knowledge Graph card to their Google Search, which might be helpful if you want to share information provided in a Knowledge Graph card with someone else. Each Knowledge Graph has a unique identifier (the &kgmid parameter), which can be added to the URL for the original search query. An attacker can thus add any Knowledge Card they choose to run alongside search results for any given query:
“For instance, you can add the Knowledge Graph card of Paul McCartney (kgmid=/m/03j24kf) to a search for the Beatles, even though that card would normally not appear for that query,” explained Beukema.

It’s also possible to create a URL that only shows the Knowledge Graph card and omits any search results, by adding the &kponly parameter to the URL. The search bar will still be visible with the original query though, even if it has nothing to do with the Knowledge Card that’s being shown.

These two things combined can be leveraged to carry out propaganda efforts. For instance, a malicious actor could post a custom query URL on social media, supposedly showing real Google search results for a hot-button topic.

The researcher used the example of the query, “Who is responsible for 9/11?” After tampering with the URL, it’s possible to suggest that George W. Bush was responsible for the 9/11 terrorist attack.

While anyone who actually tries to replicate the search results with a query of their own would get a different answer (Osama bin Laden, of course), it can still be a powerful tool for spreading disinformation, particularly to those with a confirmation bias who may be simply scrolling through the News Feed, for instance.

“This allows you to trick others into believing something is true,” Beukema said. “After all, it is a legitimate Google Search link and since we have been trained to trust the answers provided by Google, there must be some truth in it, right?”

The researcher filed a bug report a year ago with Google, advocating the disabling of the &kponly parameter in particular; he said that the internet giant doesn’t consider the issue to be severe enough to be an addressable vulnerability.

“I disagree: in this day and age of fake news and alternative facts, it is irresponsible to have a ‘feature’ that allows people to fabricate false information on a platform trusted by many,” Beukema said.

However, a Google spokesperson told Threatpost that while allowing users to point to specific knowledge panels is part of the company’s mandate to make it easy to share information, it was indeed working to address it. “We share the concern about the potential for bad actors to create misleading distortions of our search results pages, and are working to fix this issue,” she said.

Threatpost:

You MIght Also Read:

Journalists Aim To Detect Deepfakes:

 

« US Vs. China - A Different Kind of Cyberwar
Global Cyber Attacks Up 63% Driven By AI »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Genie Networks

Genie Networks

Genie Networks is a leading technology company providing networking and security solutions for optimizing the performance of large networks.

National Cyber Security Centre (CNCS) - Portugal

National Cyber Security Centre (CNCS) - Portugal

CNCS is the operational coordinator and Portuguese national authority in cybersecurity working with State entities, and digital service providers

CryptTalk

CryptTalk

CryptTalk is an easy-to-use secure communication service.

Slovak Security Policy Institute (SSPI)

Slovak Security Policy Institute (SSPI)

Slovak Security Policy Institute is an independent non-governmental organization that focuses on research and analysis of security challenges including defence and cyber security.

Cyber Security Centre - Daffodil International University

Cyber Security Centre - Daffodil International University

Cyber Security Centre, DIU is a non-profitable organization which is focused on applied research in cyber security.

Callsign

Callsign

Callsign’s mission is to seamlessly power the identification of every web, mobile and physical interaction.

ShieldIOT

ShieldIOT

ShieldIOT delivers a complete AI-powered security solution across any IoT device, application and network.

Penten

Penten

Penten is an Australian-based cyber security company focused on innovation in secure mobility and applied AI (artificial intelligence).

Maritime Cyber Threats Research Group - University of Plymouth

Maritime Cyber Threats Research Group - University of Plymouth

The Maritime Cyber Threats research group of the University of Plymouth is focused on investigating marine cyber threats and researching solutions.

BlueHalo

BlueHalo

BlueHalo is purpose-built to provide industry capabilities in the domains of Space Superiority and Directed Energy, Missile Defense and C4ISR, and Cyber and Intelligence.

Mainstream Technologies

Mainstream Technologies

Mainstream Technologies is an information technology services firm specializing in custom software development, managed IT services, cybersecurity services and hosting.

SECUINFRA

SECUINFRA

SECUINFRA has been supporting companies in detecting, analyzing and defending against cyber attacks since 2010.

RevealSecurity

RevealSecurity

RevealSecurity's TrackerIQ detects malicious activities in enterprise applications.

Google Cloud

Google Cloud

Accelerate your digital transformation. Whether your business is early in its journey or well on its way to digital transformation, Google Cloud can help solve your toughest challenges.

Arista Middle East

Arista Middle East

Arista Middle East is part of Global Arista Technologies specializing in OT Cybersecurity.

Blind Insight

Blind Insight

Field-level searchable encryption plus fine-grained programmable access controls. All wrapped neatly in developer-friendly APIs and SDKs. Data protection perfection.