0

Recently, one of my website has been hacked in a very interesting way.

By doing some researches I've found that I wasn't the only one affected by the hack, but didn't find anything about it.

Note : I am going to describe my website but after looking at other hacked websites, they all have the same behavior and look like the hack has been spreading.

Few information about the website :

  • is using wordpress,
  • is executed by apache

Information about the hack :

The website hasn't changed of any way. I still have my only page with a clean source code, which hasn't changed at all.

The way I've noticed that something was wrong on the site is that the title and description on Google suddenly became in Japanese, with some keywords like iPhone, Samsung ans other popular brands.

I then tried to domain search it on Google like site:mywebsite.com. This gave me around 12k results (when there should be around 15 maximum), all being pages that redirect me to 404 with title and description in Japanese. All these pages have a cache version with different Japanese content.

When I try to look at the website "like Google" in the search console, I see the website being displayed like the cache version. There is some code in my website that targets Googles bot and create fake urls for it.

This looks like Pharma Hack, but the difference is that they are not trying to make any back-linking. There is absolutely no link that redirects to something else than my website (home or 404). Maybe it is more NSEO ?

I know that WordPress is one of the worse thing security-wise. But my question is more security oriented. Is this a known hack ? How does somebody target google's robot to make him see a totally different website that the one that I made ?

  • 1
    Have you tried impersonating the google bot to see what happens on your webserver ? are you redirected, what content are you served etc? – M'vy May 10 '17 at 15:39
  • ^ (what mvy said), and are you sure you're not looking at cached content at your end? – ndrix May 10 '17 at 19:03
  • @M'vy, I don't know what is "impersonating the google bot", I've done the "see the webpage like google through the search console assistant and it displays a japanese page that has no external link. There is absolutely no redirection to a different website, they are all relative links mywebsite.com/**support** as example but as I have no support page they are redirecting to my 404. ndrix, When I look at non-cached pages the website is normal and when i'm looking at cached pages the website is in japanese. – Relisora May 11 '17 at 8:01
  • I mean setting the user-agent of your browser to one of the known google bot user-agent, so that you browse the internet like you're a google bot. Have you check the apache access and error logs? Check the .htaccess file in your website directory, maybe there are conditional redirect. – M'vy May 11 '17 at 8:11
  • Sadly the website is made for a client so I made my best to make it as secure as possible and reinstalled everything. I did not keep saves from the "hacked" version and didn't know you could set the user agent to Googlebot. – Relisora May 11 '17 at 8:21
2

As mentioned in the comments, try this command to see if the malware is not returning different content to browsers and bots (just use your own URL):

curl -H 'User-Agent:Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)' \
  -H Pragma:no-cache \
  https://httpbin.org/user-agent

And the attack may have targeted Google for a number of reasons:

  • turn your page into a SEO backlink farm
  • attract traffic from specific user agents only (e.g. mobile browsers) and only show infected HTML to them

This also might not be an infection at all, these symptoms could be present in the following cases:

  • broken virtual host configuration on your web server - e.g. different page returned when accessing it through www.example.com and example.com because on of them is not configured explicitly to return your page and returns a default web server contents, which happens to be someone else's website (e.g. on shared server)
  • broken DNS configuration, resulting in Google bot speaking to a different server than you think it's speaking to

You might try to use some cloud-based web site scanners to see how your website is rendered from the outside world - e.g. scan it on WebCookies.org and see if the title and description matches your website.

  • 1
    Thank you for the answer. This was an attack as some files got modified and created on my ftp. Sadly I am not able to do tests anymore because the website has been fixed. I was more looking for information around the attack because I have never heard about this kind of mechanisms (attack specific user agent or directly google bot). – Relisora May 11 '17 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.