I recently had the displeasure of learning that one of my .edu client’s websites had been hijacked by Viagra/Cialis/Levitra spammers. An alert to the University’s IT department received quick attention and response.
How the Hijacking Became Apparent
I make it a habit to periodically check my cilents’ sites in Google Webmaster Tools. Lo and behold, wouldn’t you know it – some of the seach queries that were most frequently used for the client’s site to come up in search were:
- order viagra online
- viagra online without prescription
- buy levitra
You get the idea. Searching for “order viagra online” revealed the following SERP in Google (I’ve circled some of the many phony results and in most cases identified who controls the legitimate domain):
Why Sites Were Targets
Obviously, the great majority of the sites have strong domain authority. Of course, if spammers can get their pages on a domain with this kind of authority, their chances of ranking well, they’ll likely get listed much farther up in the SERPs. But is it really necessary?
There were only 5.9 million results in Google when I conducted the search. While some may think that’s very competitive, it’s not, really. But as hard as it is to get links these days, I suppose it’s much easier and faster to get rankings this way than by using “traditional” website promotion methods.
The Problem with Doing This
Besides the fact that it’s just flat out wrong to do this, other problems arise. What organization that has a legitimate purpose would in any way want to be associated with a Canadian pharmacy out to sell ED drugs illegally? Especially when you consider who’s on the list – like the University of Kentucky, Missouri, Penn State, Southern Illinois and other education institutions as well as other finely regarded sites, such as the Washington Sculptors Group and the International Alliance of Women.
How the Domain Hijack Took Place
I’m not about to provide enough details to allow the practice of domain hijacking to spread. Suffice it to say, that a directory was found on which permissions were set so that the world could write to the directory. Rogue .htaccess files were created on the client’s server that would redirect every request to an index.php file with binary code that when decoded grabbed content off a remote web server and constructed its own set of pages. My first tip off came when I found the world-writeable directory and alerted the client.
In this client’s case, entry was made through a blog directory. Several of the results in the sample SERPs show typical blog URLs – others show index.php files, so it looks like similar vulnerabilities on these servers were used to hijack the domains.
Do They Even Know?
I suppose the scary thing is that most of the hijacked sites don’t even know this is going on. Unless an IT person, a faculty member or someone else associated with the hijacked domain, ends up searching for Viagra and happens to see their site listed, most of this goes unnoticed and uncorrected for substantial periods of time.
Certainly this is not a new technique. It’s been going on for quite some time. I can only hope more and more people will discover it and shut these people down. Of course, more will jump up into their place. I’ve alerted Google to the crappy, hijacked search results and I’m putting out the word – I don’t know what else I can do, but I’d like to see it stop.
Lessons Learned: A Couple of Warning Signals
What did I learn from this? To watch out for a few warning signals that domain hijacking is taking place. For this specific type of attack, to watch for directories that are writeable to the world and to watch for binary index.php files. Continuing to monitor sites with great tools like Google Webmaster Tools doesn’t hurt either.
