Comment by DanielBMarkham | Hacker News Reader

Comment by DanielBMarkham | Hacker News Reader

Wow. SEO hacking. Very scary stuff, and if he hadn't been greedy, sounds like he would have gotten away with it.

SEO continues to both amaze and frustrate me. The more money that gets traded hands based on search, the more brutal and intricate the cheaters are going to become. A lot of the black hat stuff we see now is heavy-handed bullshit, but something like this, if done very carefully, would both be extremely difficult to detect and very lucrative. The canonical thing is smart as hell. You could make that change and, unless site owners specifically went looking for it, nobody would ever see. I could imagine hackers breaking into dozens or hundreds of domains and then auctioning off as very small number of SEO links. This would provide the maximum value for the minimal footprint on the site. Heck, take it up another notch and rent out the space.

It's very common and very old. Someone did this to a site I ran back in 2005. He made the mistake of creating a new account using his gmail address and his gmail password.

I logged back into his gmail account using this information [this was before the time that Google started to flag logins from unusual IP addresses] and found out that he was doing this as contract work for several legitimate companies.

There in the email were messages back and forth between himself and various marketing managers at those companies about sites he'd attacked and placed spam links in.

Have to ask what software you were using, that it was so easy to get his password from out of his login account. This must have been in the days before passwords were hashed or something?

Passwords were not hashed in the database, because it made no sense for me (as the site administrator) to do that. As the site admin it's entirely beneficial for me (not for you) to see your password.

Of course if you're the sort of user who uses the same password on every site, then it benefits you a little bit if the site hashes the password. The site admin or an attacker can still easily steal your password when you log in, so the benefit is small. But by doing this you're trusting every site, which is stupid.

Users should use a completely different, randomly generated password for every site, then whether or not the site hashes the password doesn't matter.

That's actually very very common (blackhat seo spam).

Go further... modify something like openx to run your own 'hacked seo' ad exchange network, managing links via these exploits programmatically. :)

Reply on news.ycombinator.com