“Fetch as Googlebot” tool helps to debug hacked sites

http://www.mattcutts.com/blog/fetch-as-googlebot-tool-hacked-sites/

by Garbage • 14 years ago

65 24 14 years ago

Zenst3• 14 years ago

I know one approach from over 10 years ago was to have your editable site on a issolated server that would periodicaly copy its content to the hosting site. This meant that any changes to the hosted site would get stamped over by the master copy.

Still nothing is perfect and this is a good read about a issue alot of people are not aware of.

thaumaturgy4• 14 years ago

What's frustrating to me -- as someone who's getting closer and closer to publicly launching a shared hosting service -- is that this problem should be solved already: we have twice-daily backups for our websites, going back up to a year. It's all automated, and customers can access the backups directly. If your site's been hacked, you can log in to the backup server, view the changes for your site's directory, and download the most recent good copy.

For most sites that store their templates as regular files and their contents in a database, this is plenty good enough. For sites that store their content as regular files too, it only takes a few extra minutes to separate the good stuff from the bad stuff.

This is super easy to implement. Every web host should be doing it.

ars2• 14 years ago

What would be the point? If you got hacked once, after you restore the files you'll just get hacked again.

As a reporting tool it could be interesting though.

Zenst3• 14 years ago

I would urge some caution with regards to backups. If there easily accesable from the site then if your site is hacked then they are easily accesable to the hacker. It is a common overlooked area and can also be a weakness that I have seen in many hosted/colo sites were they have all the servers isolated and yet still linked via some all singing all dancing backup server.

ars2• 14 years ago

Another thing to do is the webserver should not have any write access to the files it serves.

The files must be created by a different account. For certain setups this can be problematic, but it's a good idea for most.

thaumaturgy4• 14 years ago

This completely falls over for popular packages like Joomla, unfortunately, which have miserably bad caching systems and file upload mechanisms and web-based upgrade functions and module installers and the like.

ThisIsADogHello• 14 years ago

... Wait. Your solution to secure a website against being hacked is to automate reverting any hacked content?

drivebyacct2• 14 years ago

The sad thing is, even people who ought not be amateurs, but are, fall for this trick. My mother's company's site was hosted on GoDaddy (I offered to move it and pay for the hosting as it's a non-profit, but she declined). They swore up and down for weeks and weeks that they were not responsible and there was nothing wrong when it was a hosted Wordpress instance.

Most of the time they (hackers, sorry pronoun overload) just naively check the referrer. Going to Google and searching for the site and clicking it is often sufficient

ben0x539• 14 years ago

Referrer header considered harmful yet? :-)

cantlin• 14 years ago

    $ curl -v -A Googlebot example.org
    $ curl -v -e www.google.com example.org

michaelmior2• 14 years ago

I was going to post the same thing. Fetch as Googlebot is nice but really nothing too special.

joshu• 14 years ago

You are wrong. Stop guessing and then acting like your guesses are facts.

RKearney• 14 years ago

Unfortunately this does not magically make your request come from Google's IP block for their web crawlers. Just as easily as the attacker put in User Agent checks, they could have put in source IP checks.

mef• 14 years ago

For the curious, the site mentioned in the article appears to be either Alanis Morissette or The Doors: https://www.google.com/search?q=Generic+synthroid+bad+you

essayist• 14 years ago

This may help clear up something that has puzzled me about a site I use and often search via Google.

https://www.google.com/search?num=100&hl=en&safe=off...

(In this case, I specifically put in "For Sale" to highlight the spammy drug ads, but they come up even without this).

Puzzle: I scan through looking for pages with "XYZ For Sale" in the title and then check out Google's cached version of the page. Sometimes, I see the spam in the cache, but often enough I don't.

So: how is it that the search result is different than google's own cache for that page?

Sukotto• 14 years ago

Interesting to learn that there's a communication method one can use to directly speak to a human at google and get a helpful same-day reply.

How do I, as someone outside of the music industry, gain access to that communication channel?

packetslave• 14 years ago

Become a paying customer

“Fetch as Googlebot” tool helps to debug hacked sites

Related Stories