I would imagine that every webmaster must have been the victim of a malicious cracker attack at least once in their online life.



I've been the at the receiving end of such unwelcome attention twice in the past. The first time was in 2005 after the bulk of developers left Mambo to join Joomla - I think perhaps I was the only person not to follow and continued using Mambo CMS. Within a few months a group of Turkish cyber-yobs defaced the site - and if they get into one site on a directory, they then rampage through the lot.

A few months ago I feel victim to a link injection attack. I noticed it pretty much as it was happening as the offender left quite blatant links in the footers of my sites. It was a nuisance, but I got the problem sorted after a few hours.

In this latter case I think it was because of an outdated Wordpress script - crackers will jump on a known security flaw in a popular CMS or blogging platform.

I've even heard of an attack where a cracker slipped into the victims site and then deleted everything - including the backup.

This is one reason why I back up my entire home directory at least once a week and then download the lot onto my own hard drive.

During the 2003 invasion of Iraq there were countless websites being broken into with pro or anti-war slogans subsequently left on their homepage.

Link injection, rather than defacement, is another form of cracker abuse.

The vast majority of webmasters and practitioners of SEO acquire their incoming links in a honest manner, but due to the sums of money available for reaching the number one spot for certain keywords (Viagra and porn for two) nasty people have been illicitly cracking open websites and inserting links using this criminal method.

Cracking open a website to insert links is a big problem across the World Wide Web - this isn't even blackhat SEO, it's criminal SEO!

It isn't always easy to spot when your site has been at the receiving end of a link injection attack as a clever cracker will disguise their links.

The other day I was examining the website of some nearby web design companies and agencies. I was looking at the pages indexed by Google for BrightCherry.co.uk and I noticed pages for Honda car parts listed.

Links such as this:

www.brightcherry.co.uk/reciva/recivahomepage2/images/bubble/hffvb/quarter-mile-time-honda-silverwing-scooter.html

www.brightcherry.co.uk/reciva/recivahomepage2/images/bubble/dhxtq/hood-1995-honda-accord-6-cylinder.html

www.brightcherry.co.uk/reciva/recivahomepage2/images/bubble/tpduf/buy-hydrocodone-without-prescription.html

That's weird for a web design site, I thought.

Clicking on these links then redirected me to hardcore porn sites.

It was immediately obvious that BrightCherry had been cracked open and an investigation of their code confirmed this - there were a lot of links in the HTML code but hidden from the human eye by the CSS display property.

In this case it seems that the attacked website was handcoded with PHP rather than it relying on an CMS script.

I was surprised though that the website still had a PageRank of 5 as cracked websites are penalized by Google pretty quickly - it must have just recently happened.

I emailed the webmaster to inform them of matters.

So you must keep a very close eye on your websites. Constantly check your Google Webmaster Console as they will tell you there if you are linking to dodgy places and do your best to keep your blogging or CMS script up to date with the latest security updates.