reported attack site

reported attack site

Why do users ignore malware warnings?

Posted on February 26, 2014 - 16:03 by ccondon

At StopBadware, it's important to us to measure how different parts of the Web are responding to malware. One of the ways we do this is to look at data about users who ignore malware warnings. For instance: what kinds of content do Web users most often insist are not malicious? 

The following is a breakdown of the top kinds of sites for which Firefox users clicked through "Reported attack site" warnings in 2013. 

Content for which Web users most often ignore malware warnings

 

(Note: There are about 30 sites included in this data. Percentages are not representative of all Firefox users who clicked through malware warnings last year—only users who clicked through warnings for the top sites that referred traffic to StopBadware.)

Background: Firefox's link to StopBadware is a two-step process: a user must click "Ignore" on a warning and then click a separate button on a toolbar Firefox displays at the top of websites blacklisted by Google. The toolbar button says, "This isn't an attack site." When clicked, it prompts Firefox to redirect those users to StopBadware's landing page

It's also worth noting that a number of the sites represented in this chart were later found to have been compromised via infected ad networks. This is one of the reasons malvertising is so insidious: it's one of the most common ways big, high-traffic sites are compromised...and users are much more likely to ignore warnings for popular sites with which they're familiar.