Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Google Warns About Search-Spammer Site Hacking

CmdrTaco posted about 5 years ago | from the secure-your-borders dept.

Google 59

Al writes "The head of Google's Web-spam-fighting team, Matt Cutts, warned last week that spammers are hacking more and more poorly secured websites in order to 'game' search-engine results. At a conference on information retrieval, held in Boston, Cutts also discussed how Google deals with the growing problem of search spam. 'I've talked to some spammers who have large databases of websites with security holes,' Cutts said. 'You definitely see more Web pages getting linked from hacked sites these days. The trend has been going on for at least a year or so, and I do believe we'll see more of this [...] As operating systems become more secure and users become savvier in protecting their home machines, I would expect the hacking to shift to poorly secured Web servers.' Garth Bruen, creator of the Knujon software that keeps track of reported search spam, added that some campaigns involve creating up to 10,000 unique domain names."

cancel ×

59 comments

Somebody say TACO? (-1, Offtopic)

Anonymous Coward | about 5 years ago | (#28882457)

Where's ma taco!!

Re:Somebody say TACO? (-1, Offtopic)

Anonymous Coward | about 5 years ago | (#28882523)

I ates it.

wat (0)

heptapod (243146) | about 5 years ago | (#28882491)

Link to the original source at the bottom of the article goes to the same article near the beginning of the article.

And what about search farms? (5, Insightful)

vintagepc (1388833) | about 5 years ago | (#28882501)

I don't know about you, but something else that REALLY annoys me is pages that contain lists of words just so they come up on many searches... with no actual content. Or sites like "Buy *search term* at low prices" and they don't even sell what you're looking for. What's being done about those?

Re:And what about search farms? (1)

Krneki (1192201) | about 5 years ago | (#28882637)

You have an "X" near the search result, if you don't like it, report the stupid web site.

Re:And what about search farms? (2, Interesting)

Shakrai (717556) | about 5 years ago | (#28882843)

Does that actually "report" it or does it merely remove it from your search results?

Re:And what about search farms? (3, Insightful)

D-Cypell (446534) | about 5 years ago | (#28883433)

While I don't know for absolute certain, I *strongly* suspect that that data is collected and operated on. Most of the big sites are about so called 'collective intelligence', or collecting information about person A so that you can have a better idea of what you want to be providing to person B. This goes into what links are cicked, at which times of the day, how long people spend on a site or page etc etc. To have a function that is so incredibly explicit as 'This is crap, don't show me it again', and to *not* use that to refine future page generations would be deeply stupid, and stupid is one thing the guys at google aint.

Re:And what about search farms? (2, Informative)

Yvan256 (722131) | about 5 years ago | (#28882863)

I don't see any "X" (or any other icons) with my search results.

Re:And what about search farms? (0)

Anonymous Coward | about 5 years ago | (#28883887)

Try logging in.

Re:And what about search farms? (2, Interesting)

sys.stdout.write (1551563) | about 5 years ago | (#28883927)

Are you logged in to your Google account?

Re:And what about search farms? (1)

Yvan256 (722131) | about 5 years ago | (#28884803)

I find it funny that you assume that I have a Google account.

Re:And what about search farms? (1)

edalytical (671270) | about 5 years ago | (#28882973)

That's not a "report" button, its a "customize my results for the future button" and it is really stupid. The elephant in the room is that Google is exploitable just like every other search engine. People are noticing the quality of their searches declining and there doesn't seem to be much Google can do or is willing to do. Most of the shitty sites that have no value are loaded with AdSense. Pretty much Google needs to start filtering results or they need to replace PageRank which is fundamentally the problem. Either that or someone else needs to build a better search engine.

Re:And what about search farms? (1)

Jurily (900488) | about 5 years ago | (#28883511)

That's not a "report" button, its a "customize my results for the future button" and it is really stupid.

Agreed. At least, I never found a use for it anyway. I just don't bother to filter my search results manually, and it's not my job anyway: if it gets too much, I'll give Bing a chance.

People are noticing the quality of their searches declining and there doesn't seem to be much Google can do or is willing to do.

That's because they index everything ("Results 1 - 10 of about 15,280,000,000 for a. (0.07 seconds)") and then they try to rank the crap lower. A much better option would be to create a new search space on top of this one containing only sites recommended by humans, and rank those up automatically, like they did with wikipedia. Of course this would be slow to build up, since all the entries should be added manually by a Google employee, but it would be well worth it: judging content without humans is impossible until we have true AI. PageRank is nice, but like all algorithms, it's vulnerable to tweaked input designed to get a specific (class of) output.

Re:And what about search farms? (2, Informative)

sabernet (751826) | about 5 years ago | (#28884609)

If that really worked, I wouldn't still see so many damn "experts-exchange" results since I'm sure I've 'x'ed at least 5 dozen of them.

Re:And what about search farms? (1)

Krneki (1192201) | about 5 years ago | (#28884617)

I concur, this is the single most annoying site on the net.

Re:And what about search farms? (1)

Magic5Ball (188725) | more than 4 years ago | (#28890139)

http://www.customizegoogle.com/ [customizegoogle.com] will filter out ExpertSexChange (and other useless sites) from your Google results.

Re:And what about search farms? (1, Interesting)

Anonymous Coward | about 5 years ago | (#28883093)

What's being done about those?

Google is making money off of them. [google.com]

I'm sorry, but you simply cannot offer a "service" like this and at the same time claim relevant search results are your top priority. These two things are inherently at odds with each other.

Re:And what about search farms? (0)

Anonymous Coward | about 5 years ago | (#28884369)

Problem is if the results get more and more polluted with garbage, users won't use them then no one will give Google money.

Re:And what about search farms? (2, Informative)

0100010001010011 (652467) | about 5 years ago | (#28883263)

CustomizeGoogle is a firefox plugin(which hasn't been updated for 3.5 yet) lets you ignore domains.

I had a ton on there.

http://www.fixya.com/ [fixya.com] seems to have risen up now that I'm searching on how to fix some lawn equipment I inherited.
"Yard Machines fix belt" and it comes back with http://www.fixya.com/tags/yard_machines_deck_diagram_belt [fixya.com]

Of course this is 100% useless.

Those sites are fun to mess with friends. "Dude, did you know that there's an entire webpage on fixing your impotency?"

Re:And what about search farms? (2, Insightful)

ex0a (1199351) | about 5 years ago | (#28884465)

CustomizeGoogle is a firefox plugin(which hasn't been updated for 3.5 yet) lets you ignore domains.

From the CustomizeGoogle page [mozilla.org] the reported version allowed is up to 3.6a1pre for anyone reading this not checking into the addon because of the parent. This addon is really handy.

Re:And what about search farms? (1)

skeeto (1138903) | more than 4 years ago | (#28895961)

If it's a Google search, you can report the site here [google.com] , though I don't think they look at these reports very often.

Universal Authentication (4, Insightful)

ParticleGirl (197721) | about 5 years ago | (#28882621)

I found this pretty interesting: "Authentication [across the Web] would be really nice," says Tunkelang. "The anonymity of the Internet, as valuable as it is, is also the source of many of these ills." Having to register an e-mail before you can comment on a blog is a step in this direction, he says, as is Twitter's recent addition of a "verified" label next to profiles it has authenticated."

The idea of universal authentication [gnucitizen.org] has been tossed around for a while. I feel like the biggest drawback is privacy (we'd have to trust some universal authentication system to hold onto some identifier even if posting anonymously) and the biggest obstacle is the need for universal participation. It's kind of too late to make an opt-in system. But I've liked the idea ever since early sci-fi interwebs (read: Ender's Game) had SOME kind of authentication.

Re:Universal Authentication (2, Insightful)

truthsearch (249536) | about 5 years ago | (#28882799)

Authentication would of course help for properly secured web sites. But many sites have content injected nefariously. One common method is to break into shared hosting servers via ftp or ssh and place javascript or html at the bottom of every html file.

Re:Universal Authentication (1)

Shakrai (717556) | about 5 years ago | (#28882955)

One common method is to break into shared hosting servers via ftp or ssh

Slightly off topic, but I've noticed that in the last year or two that brute force ssh attempts seem to have become so common that they should be considered part of the regular internet background noise. My servers were regularly being probed from multiple IP addresses (most of them in China), sometimes reaching 5-10 ssh attempts per second. They'd go through whole dictionaries of possible usernames and keep trying to hit the root account as well.

I wouldn't run ssh these days without disabling password logins in favor of keyfiles and having some sort of rate-limit on the number of incoming connections. Here's two iptables rules that will do just that:

iptables -A INPUT -i INTERNET-INTERFACE -p tcp --syn --dport 22 -m hashlimit --hashlimit 15/hour --hashlimit-burst 3 --hashlimit-htable-expire 600000 --hashlimit-mode srcip --hashlimit-name ssh -j ACCEPT
iptables -A INPUT -i INTERNET-INTERFACE -p tcp --syn --dport 22 -j DROP

(Alternatively instead of "-j DROP" you can do "-j REJECT --reject-with tcp-reset" but I'd rather let their connection hang)

Re:Universal Authentication (1)

truthsearch (249536) | about 5 years ago | (#28883859)

I use denyhosts because I have the same problem. denyhosts watches for repeat failed attempts from the same IP and then blocks them. It's fully configurable (e.g. block after 5 failed attempts within one day, unblock an IP after 30 days, send email reports, etc.).

Re:Universal Authentication (1)

metaforest (685350) | more than 4 years ago | (#28893039)

Over a year ago: Using denyhosts I black holed IP addresses after two attempts and the entire subnet after 10 total attempts in 12 hours. I eventually gave up and took the host off port forwarding because I didn't need to access it remotely any more.

I was quickly heading to the point that all of Russia, China and the Koreas were going to be completely black-holed. Interestingly some areas of the US, especially the mid-west and central canada were getting fairly dark too.

If I ever need to put that host back on my PF.... I am going to use a "deny all except X" rule and avoid wasting all the extra electrons required to process 20+ freaking SSH auth attempts per second.

Re:Universal Authentication (1)

Tony Hoyle (11698) | about 5 years ago | (#28884119)

Isn't hashlimit designed to limit bandwidth? I'd rather just drop the initial connection..

-A public -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH
-A public -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 5 --name SSH -j DROP
-A public -p tcp -m tcp --dport 22 -j ACCEPT

You should also be protecting DNS and ICMP in the same way of course.

Re:Universal Authentication (1)

Shakrai (717556) | about 5 years ago | (#28885119)

Isn't hashlimit designed to limit bandwidth? I'd rather just drop the initial connection..

Umm, no? Its designed to limit the number of times it will match. It's based on number of packets seen in a defined interval. AFAIK it doesn't have anything to do with bandwidth or datarate. In fact, I've never seen iptables directly used to limit bandwidth, although I have seen it used to classify packets that then get shaped by the Linux traffic shaper.

I do like the rules that you use though.

Re:Universal Authentication (1)

Lumpy (12016) | about 5 years ago | (#28884169)

I ran a script that watched the log files and added drop rules for ANYTHING that tried to ssh in using root.

This was back in 2004-2005 and I was getting about 30-40 ip's banned a day from china and the former USSR. It's simply ramped up with a crapload of zombie machines out there doing it.

My solution was to screw it all and use only VPN.

Re:Universal Authentication (1)

skeeto (1138903) | more than 4 years ago | (#28897017)

This is an area of interest to me.

My home computer gets pinged with ssh password guessing attempts all day. Not quite as hard as you, but a guess every few seconds. Key-only logins are a bit too inconvenient for me right now, so I take other measures. I have root logins disabled so they have to guess a password and a username, and they've never even guessed a correct username so far. I also used DenyHosts to mitigate attacks by instantly blocking anyone trying root logins, and block anyone else after 3 wrong guesses. (This would inevitably get myself blocked after a couple months, but adding my main IPs to hosts.allow fixed that).

Even with DenyHosts I would still nervously scan my authlogs regularly. So I recently moved ssh to a different port, not even a high numbered one (below 1024), and the attacks completely stopped. 100% gone. Soon after I also threw up a home-crafted* ssh honeypot on port 22 so not only do they not go looking for my real ssh port, but I get them to waste their time as they try to do things in the honeypot.

Wasting time is important, because that's less time they can spend finding and exploiting a real vulnerable system. I think of this as one of my contributions to the Internet.

The honeypot is a very unprivileged user running Qemu running OpenBSD with most of the filesystem flagged schg or sappnd (not even root can modify files), with all outbound networking blocked. Only ssh in is allowed. Qemu is running at nice 20. And it's running in "snapshot" mode, so all writes to disk are temporary. Restart Qemu and it goes back to a fresh honeypot. I haven't done this yet but I will have a cron job restart Qemu every couple hours to wipe it clean (I want to work out better logging first).

I'm still a bit nervous about the honeypot, so I keep a close eye on it. There may something I might have missed that could let them get more control. To help my confidence I have had friends log in and try to break it, or trash it up. So far so good.

So far the attackers that have logged in haven't even tried to do anything. They just log in, and log out. It's really strange. Maybe they'll come back someday and try to send spam or something. Maybe it's an obvious honeypot?

But here's the best part: the password for root is "password" (OpenBSD's passwd was not very happy when I did this) and very few bots ever guess this. What are they guessing? I've even seen bots that properly guess "password", log in, log out, then continue guessing more root passwords (maybe checking if it's a honeypot?). So far these random attackers don't seem very bright.

*Yes, I've heard of Kojoney but I haven't been able to get it working. And I like mine better.

Re:Universal Authentication (1)

ComputerDruid (1499317) | about 5 years ago | (#28882871)

See OpenID: http://openid.net/ [openid.net]

Decentralized universal authentication.

Re:Universal Authentication (1)

skeeto (1138903) | more than 4 years ago | (#28896389)

I hate it when I read an article or a blog, want to leave a comment, but its locked behind some registration mechanism. Then I just don't bother. I'm not going to go through a tedious registration process just to leave one comment. Sometimes it's not even obvious how to register (I'm looking at you Wordpress). I imagine this costs these websites a lot of traffic. See The $300 Million Button [uie.com] .

No, anonymous commenting is too important. Throw up a captcha or something that anonymous commenters have to fill out, but registered ones don't (like Slashdot).

Not that I expect this kind of system, but if we did have some universal authentication I would want it to be cryptographically based rather than password login (like OpenID). Though managing keys would probably be too difficult for most people, and the system would be less flexible because users would need to carry their private keys around. With this system a user's identity is really just simply a public key, maybe with a "provider" attached to it like an email address. Once a website trusts your public key, due to a good comment, checking with some identity provider (like OpenID), or getting it from another trusted website, it doesn't need to do any more external verification. (This is how Freenet's forums work, for example.)

Confirmation (4, Interesting)

Drakkenmensch (1255800) | about 5 years ago | (#28882673)

Anyone who frequently uses google knows this already. Plug in any kind of search and you're bound to get a slew of crap results along the lines of:

Download [term] full version

Torrent [term] keygen

Torrent [term] latest version

Torrent [term] hacked no-cd

You'll get those even when searching for books.

Re:Confirmation (4, Informative)

IBBoard (1128019) | about 5 years ago | (#28882751)

Except that that's not what the summary mentions. The summary is talking about people hacking websites to get more "good" links to their site, rather than having to rely on standard link farms that are then blacklisted. It's like comment spam, only with hacking of servers instead.

Re:Confirmation (1, Interesting)

Anonymous Coward | about 5 years ago | (#28884467)

I've had my webpages up for years, but hadn't actually added anything new for a while so hadn't felt the need to stop by my site and do maintenance. This spring, Google sent me an email warning me that they were taking my site off their search engine for spamming. (Though they did suggest it had probably been hacked.)

It was horrible. My pages had indeed been hacked and had "invisible" links written all over them. Some of them actually had all their real content deleted in favor of what looked like nothingness. New pages and directories had been added, sometimes imitating my own pages and sometimes not bothering, all filled with these spam links. And even better, none of the links actually led to the spammers' site! They all led to hundreds of other dormant websites, all on my own ISP, so I couldn't even block traffic. Sickening. They'd even come back in various months and added new layers of spam links. Brazen. And my own inattention had made it possible.

What I didn't realize was that my ISP had made some supposedly "user-friendly" modifications in settings that had opened up pretty much everything on my account to any little annoyance who came knocking. I complained to them, explained how many other pages were affected that they were hosting, and pretty much got nothing in return.

I could clean things up and change that, and I did. I could get Google to put me back on the search engine, and I did. I can resolve to leave my ISP next time I'm up for renewal, and I will. But the nuisance and violation of it all was horrible. Also, there's no guarantee that the spammers won't come back, with better cracking software, and mess up my pages again. One less bit of peace of mind for me, and no trouble at all for them.

We don't need more authentification. We need to catch the people who do this and throw them in prison; and if they're in foreign countries, we need to get them extradited or convicted where they live. And nations ought to cooperate over this. On their own scale, and without any motive but profit, these sorts of spammers are destroyers of all they touch and enemies of all mankind. (After all, they are seriously messing up everybody's results and traffic, not just being an annoyance at my site.) If there was no profit and much loss in doing this, I think this sort of person would leave everybody's webpages alone.

Re:Confirmation (1)

Ihmhi (1206036) | about 5 years ago | (#28884029)

I was always a bit puzzled by "Coheed & Cambria Latest CD no-cd"...

Re:Confirmation (0)

Anonymous Coward | about 5 years ago | (#28884711)

what were you looking, again? for crap?
no wonder you got plenty of it!

Only a year now? (1, Interesting)

Nick (109) | about 5 years ago | (#28882689)

Or perhaps he meant it's only been popular in the last year or so. I've seen this going on for the last three years at the least.

PageRank is a bullseye (2, Insightful)

spyrochaete (707033) | about 5 years ago | (#28882947)

If your website's front page has a PageRank score of 3/10 or higher it is a prime candidate for hijacking. Google gives extra clout to hyperlinks from sites with a high PageRank (aka "link juice"), so it's easiest for a malicious party to hijack a small number of high-ranking sites than a large number of low-ranking sites. The higher your PageRank the greater your risk.

Google could stop this, but.. (1)

moon3 (1530265) | about 5 years ago | (#28883423)

The funniest part of this is that Google itself seams to fund them and has the ability to stop this MFA sites, link fraud sites -- this is a connected issue, but for some (very obvious) reason keeps it quiet.

Re:PageRank is a bullseye (1)

Dullstar (1581331) | about 5 years ago | (#28884193)

My website is probably a PageRank 1 or something. Just to get it to appear in the results you have to put the name in quotes. However, I think that's just a problem with the name considering the results you do get, so I'm going to redesign the whole site and give it a new name.

What you said about PageRank reminds me of the April Fool's joke they did once (PigeonRank).

Easy to spot? (1)

T Murphy (1054674) | about 5 years ago | (#28883091)

I am assuming you can produce a list of candidate sites that may be benefitting from this by tracking for sudden rapid growth in links. From there you should be able to come up with an algorithm that looks at what the beneficiary site is about and what the linking sites are about. I would assume the hacked sites will have a random distribution of topics and sources- or a highly clustered distribution if a certain type of site is most often hacked. Regardless the distribution should be markedly different from a typical site.

NB: I am not very familiar with search engine algorithms so there is sure to be room for +5 comments whether you explain why this can work or can't work.

Re:Easy to spot? (2, Insightful)

Shadow-isoHunt (1014539) | about 5 years ago | (#28883273)

That doesn't work, because you can't possibly determine whether they're legitimate links or not(if the linking is done properly). For example, how do you differentiate inbetween something that starts as a result of an independently reported news event(or a slashdotting...), or something that starts as the result of hacking? If you want to waste the cycles, you can start mapping the event to find it's potential point of origin to see if it's a news site or something, but it's still going to hurt the little guys.

Google needs to look at their financial stock page (1)

Dan667 (564390) | about 5 years ago | (#28883137)

If you look at the discussion for almost any stock, they are all stock scam span. Having seen Google catch most of my email spam and news groups are pretty clean so this is a bit surprising.

Flying pigs (1)

demachina (71715) | about 5 years ago | (#28883159)

"and users become savvier in protecting their home machines"

And when pigs fly...

Re:Flying pigs (1)

vintagepc (1388833) | about 5 years ago | (#28883655)

+1 optimistic. I think pigs will fly long before that happens.

Re:Flying pigs (1)

goofyspouse (817551) | about 5 years ago | (#28883697)

Dammit...I was just going to post that gem.

Google needs web spam to profit. (3, Informative)

Animats (122034) | about 5 years ago | (#28883777)

Google can't solve this problem because their business model requires web spam.

Google is in the advertising business, not the search business. Search is a traffic builder for the ads. Google's customers are their advertisers, not their search users. They have to maximize ad revenue. The problem is that more than a third of Google's advertisers are web spammers, broadly defined. [sitetruth.net] All those "landing pages", typosquatters, spam blogs, and similar junk full of Google ads are revenue generators for Google. Every time someone clicks on an AdWords ad, Google makes money, no matter what slimeball is running the ad. Google can't crack down too hard, or their revenue will drop substantially. Google does have some standards, but they're low.

Google went over to the dark side around 2006. In 2004 and 2005, Google sponsored the Web Spam Summit [technorati.com] , devoted to killing off web spammers. From 2006, Google sponsored the Search Engine Strategies [searchengi...tegies.com] conference, where the "search engine optimization" people meet. That was a big switch in direction, and a sad one.

As we demonstrate with SiteTruth [sitetruth.com] , it's not that hard to get rid of most web spam if you're willing to be a hardass about requiring a legit business behind each commercial web site. Google can't afford to do that. It would hurt their bottom line.

However, cleaning up web search results with browser plug-ins is a viable option. Stay tuned.

Re:Google needs web spam to profit. (0)

Anonymous Coward | more than 4 years ago | (#28888985)

Haha, searching for google in SiteTruth is all negative.....are you getting paid for searches on that site!

Yo Grark

I've seen one of these hacked sites (2, Informative)

maccallr (240314) | about 5 years ago | (#28884177)

I saw this in the wild a few weeks ago. I had a google email alert running for my bank, which pointed me to a page which was blog-like but when you looked closer it was completely auto-generated gibberish. They had built the whole thing based on a list of banks and insurance companies. As it was under envsci.rutgers.edu I guessed they had been compromised.

I reported it to the webmaster and I see that it is gone (both from Google's index and the server). Not a word of thanks though. How long does that take...

Maybe someone here will give me a medal instead?

Re:I've seen one of these hacked sites (0)

Anonymous Coward | about 5 years ago | (#28885565)

Nope.

Re:I've seen one of these hacked sites (0)

Anonymous Coward | about 5 years ago | (#28885767)

If you're helping others hoping for a reward, you're thinking about it wrong.
Check your motivation :)

Re:I've seen one of these hacked sites (0)

Anonymous Coward | more than 4 years ago | (#28887685)

I'll give you a free hug!

Re:I've seen one of these hacked sites (1)

maccallr (240314) | more than 4 years ago | (#28890633)

Thanks Anonymous Cowardon! (as rendered in FF 3.0.x)

Re:I've seen one of these hacked sites (0)

Anonymous Coward | more than 4 years ago | (#28892995)

Maybe someone here will give me a medal instead?

FUCK YOU!

Re:I've seen one of these hacked sites (1)

skeeto (1138903) | more than 4 years ago | (#28897281)

I've give you a coupon for one free internets, but I can't find the image.

greasemonkey (0)

Anonymous Coward | about 5 years ago | (#28884321)

theres a greasemonkey script for that // ==UserScript== // @name No Experts Exchange // @namespace userscripts.org // @description Hide Expets-Exchange.com Results From Google // @version 0.1 // @include http://google.com/search?* // @include http://www.google.com/search?* // @include http://*.google.com/search?* // ==/UserScript==

var url = document.URL;
if(!url.match('-site%3Aexperts-exchange.com')){
        var urlArray = document.location.toString().split("q=");
        var queryArray = urlArray[1].split('&',1);
        var newQuery = queryArray[0] + '+-site%3Aexperts-exchange.com&';
        window.location.replace(url.replace('q=' + queryArray[0],'q=' + newQuery));
}

Rampant hijacking of .edu domains (1, Interesting)

Anonymous Coward | about 5 years ago | (#28885081)

This is particularly bad at the .edu domains. It is shocking and inexplicable that the IT departments at these universities don't know what's going on with their own servers and in their own zone files. There are literally thousands of hijacked subdomains under valid .edu domains. How can the network administrators not know what's going on? Don't they check their logs? Don't they see the google referrers for this spammy content? Could they be responsible for it themselves, or maybe getting a payoff for looking the other way? Just look at the results of this google search and see just how bad it is:

http://www.google.com/search?hl=en&safe=off&q=%22low+cost+payday+loans%22+site%3A.edu&aq=f&oq=&aqi= [google.com]

These schools are required by law and regulation to protect their student's private information. If their servers are so badly compromised, how can their students and employees trust them with their personal and financial information? It displays shocking disregard for security or utter incomptence, or perhaps even corruption on the part of the IT staff, and seriously needs to be investigated, and corrected, without delay!

I'll admit to being hacked before... (1)

WoTG (610710) | more than 4 years ago | (#28892227)

IMHO, it's mostly script kiddies doing this "hacking". Over the years I have had a few sites developed and largely left to sit for posterity. Unfortunately, the ones that were running off-the-shelf packages such as phpNuke (CMS) or WordPress (blog) or phpBB (forum) have been hacked, or overrun by spammers, at least once. All of those packages had security flaws over the years... some worse than others.

Yes, I should have keep them up to date, but, no I didn't and lot's of people don't.

I want to keep the blog for a crazy project up for kicks, I don't want to keep updating WordPress on every release just to have that privilege.

Anyway, it's getting better these days, all the major packages are much more security aware.

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...