Connect with us

Tech

Hackers exploit websites to give them excellent SEO before deploying malware

Published

on

Hackers exploit websites to give them excellent SEO before deploying malware
Spread the love

….Climbing up Google’s ranks is key to this new technique.

Cyberattackers have turned to search engine optimization (SEO) techniques to deploy malware payloads to as many victims as possible.

According to Sophos, the so-called search engine “deoptimization” method includes both SEO tricks and the abuse of human psychology to push websites that have been compromised up Google’s rankings.

SEO optimization is used by webmasters to legitimately increase their website’s exposure on search engines such as Google or Bing. However, Sophos says that threat actors are now tampering with the content management systems (CMS) of websites to serve financial malware, exploit tools, and ransomware.

In a blog post on Monday, the cybersecurity team said the technique, dubbed “Gootloader,” involves deployment of the infection framework for the Gootkit Remote Access Trojan (RAT) which also delivers a variety of other malware payloads.

The use of SEO as a technique to deploy Gootkit RAT is not a small operation. The researchers estimate that a network of servers — 400, if not more — must be maintained at any given time for success.

ALSO READ:  Zuckerberg Set To Review Facebook Policy Over Trump Controversy

While it isn’t known if a particular exploit is used to compromise these domains in the first place, the researchers say that CMSs running the backend of websites could have been hijacked via malware, stolen credentials, or brute-force attacks.

Once the threat actors have obtained access, a few lines of code are inserted into the body of website content. Checks are performed to ascertain whether the victim is of interest as a target — such as based on their IP and location — and queries originating from Google search are most commonly accepted.

Websites compromised by Gootloader are manipulated to answer specific search queries. Fake message boards are a constant theme in hacked websites observed by Sophos, in which “subtle” modifications are made to “rewrite how the contents of the website are presented to certain visitors.”

ALSO READ:  Apple Sets To Replace "Siri" Female Voice With Two New Voices In The US

“If the right conditions are met (and there have been no previous visits to the website from the visitor’s IP address), the malicious code running server-side redraws the page to give the visitor the appearance that they have stumbled into a message board or blog comments area in which people are discussing precisely the same topic,” Sophos says.

If the attackers’ criteria aren’t met, the browser will display a seemingly-normal web page — that eventually dissolves into garbage text.

A fake forum post will then be displayed containing an apparent answer to the query, as well as a direct download link. In one example discussed by the team, the website of a legitimate neonatal clinic was compromised to show fake answers to questions relating to real estate.

screenshot-2021-02-26-at-17-36-36.png
Victims who click on the direct download links will receive a .zip archive file, named in relation to the search term, that contains a .js file.

ALSO READ:  How We Tracked Woodberry Via iPhone, Whatsapp, Bitcoin Transactions – FBI

The .js file executes, runs in memory, and obfuscated code is then decrypted to call other payloads.

According to Sophos, the technique is being used to spread the Gootkit banking Trojan, Kronos, Cobalt Strike, and REvil ransomware, among other malware variants, in South Korea, Germany, France, and the United States.

“At several points, it’s possible for end-users to avoid the infection, if they recognize the signs,” the researchers say. “The problem is that, even trained people can easily be fooled by the chain of social engineering tricks Gootloader’s creators use. Script blockers like NoScript for Firefox could help a cautious web surfer remain safe by preventing the initial replacement of the hacked web page to happen, but not everyone uses those tools.”

Respect: Zdnet.com Source

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

FG Does Not Understand Paystack And Flutterwave, Only How To Borrow Money from CBN – Chidoka

Published

on

By

FG Does Not Understand Paystack And Flutterwave, Only How To Borrow Money from CBN – Chidoka.
Spread the love

Former Minister of Aviation, Osita Chidoka, on Saturday said the Federal Government does not have a grasp of how technology start-ups make money.

Mr Chidoka, who is a member of the opposition Peoples Democratic Party, was speaking at The Platform, a televised event hosted by the Senior Pastor of Covenant Nation, Poju Oyemade and which seeks to spark conversations that can aid national development.

“What is the average age of our cabinet,” Mr. Chidoka said. “Our cabinet does not reflect Nigeria. They cannot understand Paystack, they cannot understand Flutterwave. They cannot understand Kobo360.

“They don’t know how to tax them. The tax authorities are taxing their revenues, because they think that all the money received by Kobo360 is revenue. No, it is money they are receiving as an aggregator.

ALSO READ:  Apple Sets To Replace "Siri" Female Voice With Two New Voices In The US

“So we need young people like you to be the Chairman of the FIRS. That’s what we need. We need people who understand.

“We can’t help them. Mr. President cannot understand it. The APC government does not understand it. They are too old to understand it. What they understand is borrowing money from the Central Bank.”

Mr. Chidoka explained that the relatively new crop of technology innovators are part of a new Nigeria he described as ‘Naija’.

“We need to unlock Naija,” he said. “It is not the responsibility of the structuralists. They are deceiving us, to make us keep looking at that day when we will change our constitution and El-Dorado will come. No, they are planning how they will take over in that new El-Dorado. “

Continue Reading

Tech

NIN: BLS International Seals Biometric Services Deal For Nigerians Living In UK

Published

on

By

NIN: BLS International Seals Biometric Services Deal For Nigerians Living In UK
Spread the love

A partnership deal has been struck between outsourcing service provider BLS International and data and digital enrolment services firm Files Solutions Limited to help Nigeria’s National Identity Management Commission (NIMC) offer biometric enrollment services to Nigerians residing in the United Kingdom, BLS said in a press release.

There are an estimated 205,000 Nigerians in the UK, with about 97,000 of them living in London.

Per the three-year deal, BLS will enable NIMC to enroll the biometrics and biographical data of the Nigerians for the issuance of national identification numbers (NINs) as part of a digital identity database enrolment program which is also ongoing back home.

ALSO READ:  Pay-As-You-Go Billing Method Technically Not Feasible- MultiChoice

According to the BLS announcement, its center in London will soon begin handing out NINs, as well as the General Multi-purpose Cards (GMPCs) which will be used by Nigerians abroad for various purposes including passport issuance, voter registration, and the opening of a bank account, among others.

The biometrics-backed NIN is also mandatory for certain services in Nigeria such as for delivery of driver’s licenses and registration for entrance into public universities.

Shikhar Aggarwal, joint managing director for BLS International, expressed delight after the deal was concluded, saying the company looks forward to offering streamlined services for NIMC.

“We are delighted to support the initiative by National Identity Management Commission, Nigeria by assisting them to streamline their identity management services for Nigerian citizens. Our domain expertise and tech-enabled services will help in seamless roll out of the project and making it successful. We are delighted by strengthening our footprint with newer partnerships serving global as well as local client governments,” said Aggarwal.

ALSO READ:  Information Minister Agrees on Immediate Reversal of DSTV Subscription Price Increase.

As part of this ID services management process, helplines, an email contact address and a website will be put at the disposal of users in the days ahead, the announcement says.

This activity is not new to BLS International, as it has executed identity management and verification projects for the governments of Canada, Afghanistan and Egypt.

Continue Reading

Tech

Meet The 23-Year-Old Nigerian US Private, Commercial Pilot

Published

on

By

The 23-Year-Old Nigerian US Private, Commercial Pilot
Spread the love

Meet Miracle Izuchukwu, 23-year-old Nigerian born Private Pilot, Commercial Pilot (candidate) and Flight Attendant at American Airlines.

She recently joined the elite group of 7% of females and 1% of black female Pilots in the world.

“I who grew up in a society that did not encourage young girls to dream big, career-wise. I remember watching lots of TED Talks to give myself more insights on possible careers that might interest me…to no avail,” said Miracle.

In 2019, she had an encounter with an Airline Pilot while working as a customer service rep. He opened her eyes to the possibility of becoming a Pilot. A few weeks later, she went on a discovery flight that sealed it for her.

ALSO READ:  Lagos To Switch From Analogue To Digital TV Broadcasts By April 29

“I came home that day, called my father, and told him I was considering becoming a Professional Pilot.

He said, and I quote: “if he gets on a plane and sees a woman as the Pilot, he would get off the plane” words cannot explain the pain and confusion I felt. I needed that validation,” she narrated.

“What if, in raising children, we focus on ability instead of gender?

In a world that wants us to whisper, I choose to shout,” concluded Miracle.

Continue Reading

Trending