An advanced and large-scale search engine optimization SEO Campaign, which uses SQL injections to attack targeted websites, has come to light!
According to the Akamai Technologies Threat Research Division, affected websites will distribute hidden HTML links that confuse search engine bots and affect page rankings.
Over a two-week period in Q3 2015, Akamai analyzed data collected by the Akamai Intelligent Platform and published the findings. While searching the web for HTML links used as part of the SEO Campaign, Threat Research identified hundreds of web applications containing these malicious links. In total, attacks were observed on more than 3,800 websites and 348 unique IP addresses.
https://www.secnews.gr/100274/%CF%84%CE%BF-android-bankosy-trojan-%CE%BA%CE%BB%CE%AD%CE%B2%CE%B5%CE%B9-%CE%BA%CF%89%CE%B4%CE%B9%CE%BA%CE%BF%CF%8D%CF%82-%CE%B1%CF%80%CF%8C-%CF%86%CF%89%CE%BD%CE%B7%CF%84%CE%B9%CE%BA%CE%AD%CF%82/See also: Android.Bankosy Trojan steals passwords from voice calls
Akamai also found that the attacks manipulated search engine results. When searching for a combination of common words like “cheat” and “story,” the “cheating stories” application appeared on the first page of results across all major search engines.
And it's true: Akamai looked at Alexa analytics and the ranking of the "cheating stories" application had increased dramatically during the three months of the campaign.
In terms of mitigation, the attacks in the campaign demonstrated a unique understanding of search engine operations, and as such, Akamai recommends that web application developers implement proper input validation checks for all user-supplied data that will be used in a back-end database query. They should also only use prepared statements with parameterized queries when constructing SQL queries based on user-supplied data.
https://www.secnews.gr/100248/clickjacking-campaign-eu-cookie-law/Read more: Clickjacking Campaign exploits European Cookie Law
