8

When I search in google for:

"sensors"

The two first results are:

"Sensors" "Publications"

If I click on these two lines (the second one for instance), I get to a defaced website (actually, there is an extra document.location() redirecting me to a Russian website).

However, If I go directly to the webpage :

http://index.php/en/publication/9-publications-2014

The website is perfectly fine, and does not look hacked.

I tried with several computers (Mac, linux and PC), and from different networks (using IPSec VPN tunnel) all results are the same.

How does this hack work? How can I fix it? Is it a google-side issue?

EDIT: After looking into the issue more deeply, I have found that the redirection seems to occur when google is set as the referrer. This could be a trick to hide the hack from the webmaster (who access the website directly) but show it to the rest of the world. Have you heard of such strategy?

Improve this question
1
  • Thanks to all for your help and your information emails. We recognized this problem last week. Now, we fixed the problem. Our page got double compromised. I recovered the wrong backup at the weekend. The recovered version was between both hacks. The frist hack was the reject hack to the spam page of the nfl shirts. There are other sites also infected: google.com/search?q=joomla+alt_ts+alt_id The hack included the main index.php and also the index.php from the theme and two other files which where uploaded to the root dir.
    – user61052
    Commented Nov 19, 2014 at 13:22

2 Answers 2

Reset to default
8

Yes, trying to hide hacks from the operator of a web site is common, and checking referer* is one way to do it. If you can find a contact for the web site, it would be polite to report the hack so they can remediate. Edit: I've sent email to the "info@" email address. If you know someone there, you might mail them directly, especially if you can write in German.

* I know it's correctly spelled with two Rs, but there's only one when it's a web "referer." Fun facts to know and tell your friends.

Improve this answer
6
  • Actually, I know someone there. He is sitting next to me. What is your diagnosis?
    – PeterG
    Commented Nov 18, 2014 at 14:34
  • The same as yours. Malicious code has been added to their web page. It is the code you found, which checks the referer and redirects the user if the referer was Google. From here, I have no way of telling how it got there, and that's what they'll need to find out.
    – Bob Brown
    Commented Nov 18, 2014 at 14:53
  • After you've talked to the people who run the web site, perhaps you could post another question with some information about the site (WordPress, PHP, etc.) and repeat your description of the malicious code. I may not know how the attack was done, but someone here is likely to know.
    – Bob Brown
    Commented Nov 18, 2014 at 14:57
  • Thanks. I have reported the issue to the webmaster (not present near me) with my diagnosis. I have no access to the server, hence I haven't seen the malicious code. Thus, as an immediate fix, I have suggested to detail any information related to the referee as soon as the php script starts. This lets more time to investigate the issue.
    – PeterG
    Commented Nov 18, 2014 at 15:32
  • 2
    Here's how I start with these issues: grep -R "eval" /var/www/domain.com/
    – David Houde
    Commented Nov 19, 2014 at 13:29
3

Your footer has links to rabidgeek.net which uses the title "cheap nfl jerseys".

The page tried to redirect me to cheapnfljerseysbest.com when I accessed it from google, but my work blocked it as spam.

The links in the left of the footer are transparent with opacity set to zero. They look suspicious, its unlikely that a user would click them on accident, so their purpose may be for redirect purposes.

enter image description here

enter image description here

I don't see any code that is redirecting to either the IP address or that domain name. It is possible that the malicious script is removing itself upon loading the page, cleaning up it's tracks.

Its also possible that it is an iis or apache redirect, in which case there would be no code to inspect.

My advice would be to follow the checkins related to those hidden links in the footer.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .