"Within hours of these reports, research project manager Ivan Macalintal discovered a couple of malicious URLs that turn up when users key in the search terms 'heath' and 'ledger,' " said Bernadette Irinco, a security researcher for Trend Micro, in a blog post. "This is very similar to the poisoned Google searches reported last Christmas."
Clicking on any of the malicious links redirects the victim to an unexpected site, which attempts to get the user to download a "new version of ActiveX Object." Anyone doing is inviting a number of malicious programs onto his or her computer.
With the commencement of the holiday season last year, Trend Micro observed that spammers and scammers had poisoned the Google index so that search terms like "christmas gift shopping" returned a significant number of sites carrying malware.
Search index poisoning is the malicious form of search-engine optimization, the practice of trying to create Web sites that appear at or near the top of search results pages for a given set of search terms. Whereas legitimate search-engine optimization strives to make sites that are relevant and easily indexed, its illegitimate form relies on, among other methods, creating large numbers of interlinked, auto-generated Web pages that create the illusion of relevancy to game search-engine ranking algorithms.
Google's PageRank algorithm, for example, considers a hyperlink to a given Web page to be a vote of confidence in the page's relevancy. Google poisoning thus can be thought of as a form of ballot stuffing. Google routinely removes malicious pages from its index, but new malicious pages can be easily created.
Other recent events such as the assassination of former Pakistani Prime Minister Benazir Bhutto also have been used to trick people into opening malicious e-mail or visiting malicious Web sites. And a year ago, the infamous Storm worm used similar tactics to spread.
According to Trend Micro, the malicious Heath Ledger URLs appear to point to the servers of a Czech Web hosting provider that was recently hacked.