Websites that are listed at the top of search engine results may see a spike in traffic soon. AVG’s newly acquired tool, Linkscanner, goes into the links returned by search engines and inspects it for malware.

This wouldn’t be such a major issue if they didn’t pose as legitimate users surfing the websites in question. AVG chief of research Roger Thompson said that, “in order to detect the really tricky – and by association, the most important – malicious content, we need to look just like a browser driven by a human being.”

This is causing serious problems for legitimate sites. For example, The Reg experienced a noticeable rise in site traffic last month. Certain landing pages were experiencing double the traffic that they normally do. After further investigation, it turns out that these results were being driving by AVG Technologies.

According to the Register, Barry Parshall, director of product management at WebTrends, a popular web analytics firm, had this to say:

A situation like this where there is in effect false traffic, where something is generating what is bogus data, leads to wrong budget decisions and marketing activities. I completely get the value proposition [of Linkscanner], but it would be responsible of them to identify themselves, with agent code or whatever it might be, so legitimate businesses can serve their customers properly.

Fortunately, it seems that there is a way to identify AVG traffic. Webmaster World forum found out that the AVG program returns a specific user agent, “Mozillia/4.0 (compatible; MSIE 6.0; Windows NT 5.1;1813),” when it visits a site. By convention, most browsers return certain general identifying information, like the user agent, to describe the browser and its user.

However, this is a very vague solution for determining this kind of traffic at best. It’s very possible that a real user could return the same user agent as well. Plus, it would be very easy for hackers to insert 2-3 lines of scripting code into their malware to test for this user agent, and simply not run when requested.

Even if AVG found a better way to announce itself to a site, a hacker could take advantage of this and hide themselves, thus destroying the value of the system altogether.

Fortunately, this tool is only available on the newest version of AVG 8.0. However, there are already 20 million machines that have been armed with this free software. Plus, this number will more than double, if the other AVG users decide to upgrade. Then we’ll have a serious problem on our hands.

I totally agree with Barry Parshall on his opinion on Linkscanner. I can understand the value that AVG is trying to create, but as a web developer, I think it’s going to do more harm than good. Websites depend on their analytic software to tell them what their traffic is and how well their internet businesses are doing. It affects their marketing decisions, their affiliate system, landing pages, how the sites develop, what content people put up on the site…everything!

If they really want go ahead of their users and protect them from malicious content, then perhaps a good solution is to serve as a middleman for HTTP requests. When a user requests a webpage, then that request could be routed to AVG’s servers, which could simulate the user environment, and carry out the transaction on their behalf. Then, after scanning the page thoroughly, they could pass the page back to the user. They could even partner with ISPs to provide this service as a premium.

Unfortunately, if they keep using the Linkscanner tool, I don’t believe that anybody is going to win. The hackers will adapt, like they always do, the users won’t be protected, and webmasters will have to sift through their traffic logs removing AVG spam.

Related:

Google CHARGING for software? Urchin upgrade

Update: Google Analytics now with AdSense reporting & “Motion Charts”

Clearspring looks to tie the Web together with AddThis acquisition

AVG exec censures Norton and McAfee over safe search solutions

Barack Obama: The Internet’s President

Entry was posted on Saturday, June 14th, 2008 at 3:37 pm under Google, Internet, Malware.  Print This Post

Read more entries by TJ Kirchner.
Stumble It!