#NoHacked: A year in review

Monday, March 20, 2017

We hope your year started out safe and secure! We wanted to share with you a summary of our 2016
work as we continue our #NoHacked campaign. Let’s start with some trends on hacked sites from the
past year.

State of Website Security in 2016

First off, some unfortunate news. We’ve seen an increase in the number of hacked sites by
approximately 32% in 2016 compared to 2015. We don’t expect this trend to slow down. As hackers
get more aggressive and more sites become outdated, hackers will continue to capitalize by
infecting more sites.

On the bright side, 84% webmasters who do
apply for reconsideration
are successful in cleaning their sites. However, 61% of webmasters who were hacked never received
a notification from Google that their site was infected because their sites weren’t verified in
Search Console. Remember to register for
Search Console
if you own or manage a site. It’s the primary channel that Google uses to communicate site health alerts.

More Help for Hacked Webmasters

We’ve been listening to your feedback to better understand how we can help webmasters with
security issues. One of the top requests was easier to understand documentation about hacked
sites. As a result we’ve been hard at work to make our documentation more useful.

First, we created new documentation to give webmasters more context when their site has been
compromised. Here is a list of the new help documentation:

• Top ways websites get hacked by spammers
• Glossary for Hacked Sites
• FAQs for Hacked Sites
• How do I know if my site is hacked?

Next, we created clean up guides for sites affected by known hacks. We’ve noticed that sites often
get affected in similar ways when hacked. By investigating the similarities, we were able to
create clean up guides for specific known type of hack. Below is a short description of each of
the guides we created:

Gibberish Hack:

The gibberish hack automatically creates many pages with non-sensical sentences filled with
keywords on the target site. Hackers do this so the hacked pages show up in Google Search. Then,
when people try to visit these pages, they’ll be redirected to an unrelated page, like a porn
site.
Learn more on how to fix this type of hack.

Japanese Keywords Hack:

The Japanese keywords hack typically creates new pages with Japanese text on the target site in
randomly generated directory names. These pages are monetized using affiliate links to stores
selling fake brand merchandise and then shown in Google search. Sometimes the accounts of the
hackers get added in Search Console as site owners.
Learn more on how to fix this type of hack.

Cloaked Keywords Hack:

The cloaked keywords and link hack automatically creates many pages with non-sensical sentence,
links, and images. These pages sometimes contain basic template elements from the original site,
so at first glance, the pages might look like normal parts of the target site until you read the
content. In this type of attack, hackers usually use cloaking techniques to hide the malicious
content and make the injected page appear as part of the original site or a 404 error
page.
Learn more on how to fix this type of hack.

Prevention is Key

As always it’s best to take a preventative approach and secure your site rather than dealing with
the aftermath. Remember a chain is only as strong as its weakest link. You can read more about how
to identify vulnerabilities on your site in our
hacked help guide. We also recommend
staying up-to-date on releases and announcements from your Content Management System (CMS)
providers and software/hardware vendors.

Looking Forward

Hacking behavior is constantly evolving, and research allows us to stay up to date on and combat
the latest trends. You can learn about our latest research publications in the
information security research site.
Highlighted below are a few specific studies specific to website compromises:

• Cloak of Visibility: Detecting When Machines Browse a Different Web
• Investigating Commercial Pay-Per-Install and the Distribution of Unwanted Software
• Users Really Do Plug in USB Drives They Find
• Ad Injection at Scale: Assessing Deceptive Advertisement Modifications

If you have feedback or specific questions about compromised sites, the
Webmaster Help Forums
has an active group of Googlers and technical contributors that can address your questions and provide additional technical support.

Posted by Wafa Alnasayan, Trust and Safety Analyst and Eric Kuan,
Webmaster Relations