3

Someone uploaded (I don't know how how but I think via my Wordpress which was outdated for just a day...) a Google Search Console authentication to my server. I just realized this because Google Search Console sent me a mail about a new authentication to a script-generated email account (many numbers and characters as username).

What could be the potential purpose of such an attempt? I can't imagine anything besides maybe spam activities or something.

Note: I am not very deep into IT security in general, besides common sense and what I learned in my years of software development.

1

If they were able to authenticate to Google Search Console, it means they had, at least for some time, control of your website.

If the hacker were any good, they would've immediately setup an alternative access to get back into your site (perhaps a backdoor of sorts, preferably not easily detectable).

I have seen at least once instance where the hackers took control of a website, posted viagra ads, uploaded click-fraud code and even hosted malware for some time on the site. For that period, they used blackhat SEO techniques to promote the site (specifically the links they wanted) - which was how the Dentist (the victim) found out about the hack in the first place. A friend asked him why his site is in search results for the oddest things.

But almost everyone knows that Google will notify the site owner when a new email is added to site management - so in your case it doesn't make complete sense, but hopefully my answer will give you something to start with.

PS: You should look for what else the hacker could've done while (s)he was in control - especially alternative ways they can keep getting back in. If you have a way of logging events remotely, that's a great thing to do, even if it is a tad late now. You will come to know what the hacker is doing on your site if/when they return.

PPS: My product ActiFend was made for a different purpose, but it can do remote logging + we have security analytics dashboards internally; so if you are unable to make progress, let me know (through the app or just write to support at actifend dot come) and I'll see we can use our chops to find any elusive needle for you. This is just out of my curiosity, so no purchase needed. :)

  • "so in your case it doesn't make complete sense" - Which is the reason, I am asking this question. I am thinking, that even the costs of being revealed quickly are overshadowed by some temporary benefit, otherwise nobody would make such an attempt, right? So my question really focuses on the purposes of overtaking the google search console. For the other part I already took immediate actions together with my hoster. – Jankapunkt Jul 11 '17 at 13:55
  • Nothing in my experience along these lines, I'm afraid. I took a careful look at the SearchConsole, but didn't find anything really standing out there as "worth the risk of exposure" that can only be done from there. Google My Business claim might be something to redirect local customers. Merchant Center is not useful. Backlinks list might be useful, but too oblique. The best I can think of is that the person hadn't thought it through and made a mistake. – Sas3 Jul 11 '17 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.