Black Hat SEO through Hacking
 |
| One vulnerable site can help many cyber criminals |
Security researchers have found that a single vulnerable website may be used by a number of cybercriminal organizations, each one altering the site to serve its own purposes.
Zscaler expert explained that once they overtake the site, the attackers rely on Blackhat SEO techniques to increase traffic towards their malicious plots.
In order to do this, they set up two different pages on the compromised domain. First, they create a spam page that search engines, security scanners and blacklisting mechanisms see as harmless. This page doesn’t contain any obfuscated code and performs the redirect via a PHP or .htaccess file.
The second page is the one that contains the redirect to a site that is in charge of performing the attack on users.
More recently, researchers have identified a number of overtaken websites that were designed to send users to Fake AVs, but were also infected with a malevolent piece of JavaScript which held an IFRAME injection that pointed to locations such as fbyvdtydyth.myfw.us/?go=2, or tds46.lookin.at/stds/go.php?sid=1.
Fortunately for internauts, this JavaScript, which is in most cases obfuscated, is flagged by search engines as being malicious fairly fast. That’s because the script is present on all the webpages and it’s placed before the original HTML code.
While in most cases users can protect themselves against such attacks by utilizing a lot of common sense and a reliable security solutions, website administrators and owners should also act responsibly and check their websites as often as they can for any type of misuse.
There are a number of pieces of software offered by security firms that can perform automated audits to check if a domain is clean or not.
 |
| Obfuscated Code placed on a site |
Regards,
Hardeep Singh
Comments
Post a Comment