Hacked Website Spam Running Rampant in Google Search Results
Tuesday, November 3rd, 2009
Over the past couple weeks, I have been seeing more and more hacked websites rank very well for topical keywords in the Google search results. It appears that all of the sites in question are in fact legitimate websites but somehow share a common vulnerability which enables them to be exploited by the hackers to easily rank for specific keywords and distribute malicious spyware.
For example, I just tried a search for more information on “Anthony Sowell” who is the serial killer in Cleveland that the evening news keeps covering. The screenshot below shows that the four websites ranked from the 6th to 9th positions are all compromised and share the same parameter “?kkk=anthony-sowell.”
If you click on any of those 4 results, you will be redirected to another domain that attempts to install the malware on your computer.
Want more screenshots? You got it.
I picked some more examples of trending keywords on Google Trends, such as the company “Coins for Anything” that was recently highlighted in the news. Five of the Top 10 results are spam.
And yet another one for some guy named “Robert Lozier.” In this case, 3 of the Top 4 results are spam.
I have seen other variations such as “?q” and “?loop” and “?mowp” so it’s not just the “?kkk” parameter.
Historically, I think Google has done a pretty good job of combating spam and malware sites in their search results, especially when compared to any of the other search engines, but it seems recently that the amount of spam has increased significantly. Please share your thoughts in the comments below.
- question: “Does Google manually edit its results?” Let me just answer that with our third philosophy: no manual intervention. In our view, the web is built by people. You are the ones creating pages and linking to pages. We are using all this human contribution through our algorithms. The final ordering of the results is decided by our algorithms using the contributions of the greater Internet community, not manually by us. We believe that the subjective judgment of any individual is, well … subjective, and information distilled by our algorithms from the vast amount of human knowledge encoded in the web pages and their links is better than individual subjectivity.