Wade Ren's Bookmarks tagged seo →  View Popular

Here's how an attack would work: The attacker searches for popular keywords, such as "Paris Hilton," on the Web site's internal
search engine. But instead of conducting a normal search, the bad guy tacks an HTML command to the end of his search. This
command that opens up an invisible iframe window in the victim's browser that then redirects it to a malicious Web site, which then tries to install fake antispyware or a version of the Zlob Trojan Horse malware on the victim's PC.

In order to boost their Google rankings, Web sites often save a copy of these search results and submit them to Google. When
a victim searches Google for the keyword, these cached search results then pop up, with the malicious code now inside them.

"Malicious parties are actively poisoning these sites' search query caching feature to position the keywords among the top
ten search results, thereby infecting anyone coming across them," said Danchev, in an instant-message interview.

He believes that more than 1 million Web pages have been infected using this technique.

"The more keywords they submit with [malicious] script, the more pages with popular keywords the high page ranked sites would
cache," he said. This increases the chance that someone will see the search results hosted on the reputable site and click
on the malicious page.

The Web sites that have been hit with this attack could fix the problem by doing a better job of checking the search queries
on their internal search engines to make sure that there is no malicious code in them, Danchev said.

Hackers are increasingly looking for ways to install their code on trusted Web sites. In recent weeks, security vendors have
found hundreds of thousands of Web pages affected by this and other similar attacks.

• Always be on the lookout for something fishy. As SEO gets more competitive, these tactics will be used for more than just Viagra. A strange search result; an odd referral keyword; off-topic adsense ads; being banned… these are all things that may tip you off.


• Even if you trust the sites that you are linking to; can you trust that they haven’t been hacked? Better safe than sorry… check first.


• Wordpress is one of the best things that has happened to the internet since Google, IMHO, but it is also vulnerable to attack if you do not protect yourself by keeping the version up to date, locking your wp-admin directory, and renaming wp-login.php, wp-comments-post.php and wp-trackback.php.