MAILE OHYE: Hi.
I'm Maile Ohye.
Moving forward in our series of videos on Hacked Site Recovery,
you're now ready to assess the damage.
This video is tailored to site owners
who received a message that their site was suspected
of being hacked with spam or phishing pages.
The video assumes you have a technical background
in viewing source code and running commands in a terminal.
If this description doesn't fit you,
please visit our Help for Hacked Sites
to locate more appropriate assistance.
For the rest of us, we're joined with Tiffany Oberoi, a software
engineer from our web spam team.
Tiffany is here to share her expertise in fighting spam.
TIFFANY OBEROI: Hi, everyone.
MAILE OHYE: Tiffany, great to have you here.
Thus far, we've quarantined our site,
verified ownership in Webmaster Tools,
viewed the hacked site message, and are
ready to assess the damage caused by the cyber criminal.
TIFFANY OBEROI: Sounds good.
MAILE OHYE: Thanks.
It seems that assessing the damage on our hacked site
is comparable to a doctor needing
to understand the full symptoms and progression of an infection
before actually prescribing treatment.
And once you help us with this crucial step,
the following steps will help to identify the vulnerability that
allowed the hacker to gain entry, then clean up our site,
and last, request a review to return
to a healthy display of our site in search results.
For now, though, the goal of this video
is to assess the damage and gain insight to the hacker's intent.
Can you help guide viewers through this process?
TIFFANY OBEROI: Of course.
As you just mentioned, having insight about the hacker's
motivation is important during the recovery process.
It helps highlight things to look for in our investigation
and will point to the proper method of cleanup.
Therefore, before we begin assessing the damage,
the higher level question to keep in mind
is, what was the hacker trying to do?
In many cases, the cyber criminal
was financially motivated.
However, instead of actually building a strong business,
the cyber criminal tried to unfairly benefit
from the good reputation of vulnerable sites on the web.
For example, she may have added visible text and advertisements
on your site to bring your users to her online business.
Or she may have added hidden text and links.
Hidden text is real text on the page,
but coded in a way that makes it difficult for humans
to see with their browser.
On the other hand, automated programs like search engines
continue to process the text without a problem.
This means that the user hidden spammy content on the page
can easily surface in search results.
The hacker may also use the deceptive tactic
called cloaking to add her spammy content on your site,
but avoid being detected by search engines.
Cloaking refers to the practice of presenting
one set of content to users but a completely different set
of content to search engines, all for the same URL.
The text isn't coded to be visibly hidden.
It's actually programmed so that regular users are never
served the spammy content.
Only the search engines are served spam.
Cloaking makes it difficult for site owners
to diagnose the hack, because whenever they view a web page,
everything looks normal.
Again, it's only the search engines
that are served pages with spammy text and links.
So far, these tactics involve a cyber criminal
using your site's good pages to rank and display
the spammy content.
Another tactic is using your site
not to host the spammy content but to boost the search engine
rankings for their online business.
MAILE OHYE: It's easy to understand that a cyber
criminal would be motivated to hack a site so
that their content can act as a parasite on good pages.
But can you explain more about how hacking
my site could actually improve the ranking of pages
on a cyber criminal's site?
TIFFANY OBEROI: Sure.
One ranking signal is the quantity and quality
of inbound links to a page.
This increases the page's trust and authority,
because adding a link to an external resource
is like vouching for the content.
MAILE OHYE: Right.
The cyber criminal is trying to manipulate the ranking signal
of merited links by hacking good websites
and then adding links back to her own.
TIFFANY OBEROI: Yes.
And these can even be hidden links,
just like the hidden text we discussed earlier.
Being hidden can make assessing the damage more difficult.
Later, I'll show a few techniques
that reveal otherwise hidden content that
was cloaked to search engines.
MAILE OHYE: OK.
So thus far, you've covered that the cyber criminal might
have been financially motivated to hack my site
to show spammy advertisements, or often, hidden spammy
links and text.
TIFFANY OBEROI: Yes.
And there's even more.
In other cases of hacked sites, again, motivated by greed,
the cyber criminal tries to steal sensitive user
information.
For example, she might be after login credentials
and personal information of you or your users.
One nefarious technique of this sort is called phishing.
Phishing is when the hacker publishes pages
on your site that are impostors of legitimate businesses,
like a banking website, to steal the login and password
from users who fail to notice the difference.
Then, as one could imagine, once the cyber criminal
has possession of logins and passwords,
they're able to wreak havoc by logging into sites
as if they were the true user.
If your site was compromised with phishing content,
you'll likely have seen a message in Webmaster Tools.
In this case, you'll also have further actions
to perform later in the recovery process.
MAILE OHYE: Thanks, Tiffany.
To summarize, it appears that sites are most often
hacked for financial gain.
The hacker may either add new, visible, spammy advertisements,
hidden content or links to manipulate rankings,
or pages that steal personal information by phishing.
TIFFANY OBEROI: Correct.
And it's easier to determine which, or all of the above, is
the hacker's motive once we investigate
the damage inflicted.
Just to prepare everyone, this investigation
is both technical and fairly lengthy.
I've broken the investigation into three main groups
of actions.
We'll begin by reviewing all the URL examples of hacked pages
provided in Webmaster Tools, whether that's from the Message
Center or in the Security Issues feature.
Next, we'll perform a site colon query
to get a sense for the scope of the visible effects.
Last, we'll end with a detailed investigation of the damage
by logging in directly to our server.
MAILE OHYE: Yes.
And if your site is currently offline,
go ahead and turn it back online for this exercise.
TIFFANY OBEROI: All right, everyone.
Let's start the first action in our investigation, which
is to review the hacked URL examples provided
in Webmaster Tools.
If your site was affected with phishing pages,
please begin your URL investigation
by making note of the example phishing URLs in the message.
Otherwise, please use the example
hacked URLs from Security Issues.
Given these URLs, whether from the message
or from security issues, I'll cover several methods
to help confirm the hacker's damage.
This includes, if it pertains to you,
reviewing additional details at Webmaster Tools Security
Issues, performing a cache colon Google search,
using Fetch as Google, and last, Wget or cURL.
This is a significant amount of work.
But by confirming the damage now,
we'll have an easier time with the in-depth investigation
we'll be performing later.
Remember, for every URL in your site
that you investigate, keep detailed notes
of the URL and its damage, as this list will aid in cleanup.
For those of you with sites that displayed example hacked
URLs in Security Issues, our first task
is to check out the details provided in this feature.
If your hacked site shows no information within Security
Issues, for example, if it was hacked for phishing purposes,
please stay with us for a minute as we
review this feature for the other viewers.
In Security Issues, we can start with the first listed category
of hacked URLs, such as code injection or content injection.
Afterward, continue this process with any remaining
hacked categories until all URL samples are exhausted.
Within each category, there may be example URLs of hacked pages
that were affected in the same manner by the cyber criminal.
Once you're able to diagnose the issue on the first URL,
it's likely the remaining pages within the category
will be similarly affected.
Security Issues also lists the date
the hack was detected for the page.
You can click for More Details on this category.
By viewing more details, you'll notice a very useful link
to the Help Center article about this category of hack.
There are possibly additional hacked sample URLs,
snippets of content inserted on the hacked page by the cyber
criminal, as well as a direct link to the Fetch
as Google feature.
I'll cover more on that feature in just a moment.
Using the information within Security Issues
to understand more about each of the hacked URL examples
is a helpful first task when confirming the damage
caused by the cyber criminal.
For instance, you can verify the unwanted content or links
that were inserted on your page.
We'll show you how to safely investigate
in the remainder of this video.
Whether you begin with Security Issues or the URLs from
the hacked message, let's say that the first URL you'd like
to investigate is www.example.com/page.html.
It may seem natural to want to see each of the example hacked
pages in a browser.
But we warn against doing so, because the cyber criminal
might have recently configured the page to distribute malware.
This means just opening the page in your browser
could damage your computer.
Besides, viewing a hacked page in a browser
often isn't that helpful during an investigation.
This is because, as mentioned earlier,
hackers may use the tactic of cloaking
so that the hacked page would still look normal to you.
To see the damage caused by the cyber criminal,
the site owner often needs the ability
to see what the search engine sees,
which brings us to the second technique
to confirm the cyber criminal's damage.
This is to perform a Google search
for the cached version of the hacked URL.
Cached version is a copy of the page that Google stores
for possible display in search results.
The cached version can help you see what the search engine saw.
To view the cached version, type cache then the colon
then the URL.
There should be no spaces, so that the query
looks like one long word.
I've done this with our first URL,
cache:http://www.example.com/page.html.
If Google has a cached version of the page,
you might notice that the cached page shows
the hacker's undesirable content.
But if not, try clicking Text Only.
What makes this a bit tricky is that
in some cases of hacked sites, Google Search
is able to restore some of your site's pages
to the last clean version before the cyber criminal's damage.
This allows pages on your site to remain
safely available to searchers.
One side effect of restoring content
is that using a cache colon search
may not reveal hacked information,
since Google Search has reverted to the clean version.
For these cases, usually the Details pop-up
in Security Issues provides a sample content snippet
containing some of the spam detected on the page.
Even if your site is clean in results,
you'll still want to complete the recovery process.
Why?
Because by reverting to an old version of your site,
the content is stuck in time.
It won't include any recent information
you've added to improve your site.
The third method that's very useful in investigating pages
for spam is to use the Fetch as Google
feature in Webmaster Tools.
Fetch as Google is available within the Show Details window
of Security Issues for Sample Hacked URLs.
You can also access it from cURL then Fetch as Google.
Here, you'll type the remainder of the URL that was hacked,
starting after your [? listed ?] site.
For instance, for my first URL, I'll just add page.html.
Keep the selection of Web for the web crawler,
and then hit Fetch.
This action signals Google's crawler, a part of the Google
search engine, to fetch the page.
This feature uncovers exactly what
the search engine sees in real time.
If your site is online and you correctly entered the URL,
the result will likely show success.
Go ahead and click the link to see the contents of the page.
Spammy text and links inserted by the cyber criminal
might be obvious as you scan the content.
Fetch as Google can reveal content that would otherwise
be hidden text, or never even served
to users due to cloaking.
If you don't notice anything spammy right away,
you can try searching for spammy words, like "cheap,"
"free," "casino," or "amateur."
Insertion of drug names and online poker terms
is a common hacker tactic.
If you still don't notice any damage,
be aware that the cyber criminal may have obfuscated their code
so the text looks like this-- eval, base 64, decode,
and some gibberish that when executed,
performs spammy actions.
And if you still can't detect the damage to the page,
it's possible the hacker used even more tricky tactics.
For example, she may have configured your site
to only serve the spammy page at certain times of the day,
or to only show the spammy page when a user clicks
from a search result, or to only show the page to users
of a particular browser.
The fourth method that's useful when
investigating pages for spam in cases such as these
is to use one of two freely available tools, Wget and cURL.
Both Wget and cURL make HTTP requests.
And they can be configured to include refer or browser
information, in case that helps replicate
the behavior of your hacked site.
Performing a search for Wget or cURL
should return resources explaining their usage
in more detail.
MAILE OHYE: Tiffany, to recap, the first action when
assessing the damage of spam is to investigate each
of the hacked URL examples provided by Webmaster Tools.
The investigative techniques include viewing more details
within the Security Issues feature, cache colon search,
Fetch as Google, and Wget or cURL.
TIFFANY OBEROI: Yes.
And after investigating the URL examples,
let's now gain a broader sense of the infected pages
with our second action, performing a site colon
search on Google.
Type site, then colon, then your site, most often your domain.
Like before, there should be no spaces in the query term,
so it looks like a single word.
The site colon operator returns results
limited to the pages that match your site.
Please note that if your hacked URL examples contained
a clean cache version in an earlier task, then
the site colon search may also only display clean pages.
In other words, this technique won't be as helpful.
However, if your site showed the cyber criminal's damage
with a cache colon search, then the site colon search
may also provide more results.
If the first page of search results looks clean,
please click to more pages of results
to check for additional evidence of a cyber criminal's harm.
You can also add additional query terms
to your site colon search.
For example, because hacks often contain spammy words
like pharmaceutical products, try
searching for site colon example.com, cheap
or free or Viagra or Cialis or casino or amateur.
MAILE OHYE: At this point, having performed action number
two, the site colon search, there
are likely more suspicious URLs uncovered.
To investigate, use the same techniques as before.
Check out the hack categories in Security Issues for pointers
to the type of damage caused by the cyber criminal.
Perform a cache colon search, use Fetch as Google,
or try Wget or cURL for each of the suspicious URLs.
TIFFANY OBEROI: Exactly.
Confirming that spam exists on these individual pages
is helpful in getting a sense of the hacker's motivation
and the effects of her damage.
For more detailed damage assessment,
we'll need to move to a third action,
taking a closer look at the file system.
MAILE OHYE: Definitely.
Since assessing the damage to your file system
is similar whether your site is hacked
with spam, phishing pages, or malware,
file system damage assessment will be an individual video.
Tiffany, can you also join us in this video?
TIFFANY OBEROI: I look forward to it.
MAILE OHYE: Everyone, investigating
your file system is a necessary, final action in this step,
Assess the Damage.
Tiffany, thank you for all your work so far.
We'll see the rest of you in File System Damage Assessment.