SEO Injection

Search Engine Optimization (SEO) is a critical component in an organizations ability to be discovered by prospective customers and clients as they conduct online searches for information and products. It is a technique commonly employed by the largest and most sophisticated Internet businesses, and a key component of their online business strategy.

Unfortunately the nature of the SEO algorithms, and the subsequent modification of dynamic site content that they promote, means that they can often be manipulated by an attacker. Vulnerable Web applications can be used to propagate infectious code capable of compromising the organizations prospective customers and clients. This brief paper explains the technique referred to as SEO Code Injection or Poisoning, and the steps that may be taken to detect and mitigate the vulnerability.
Attack Objectives

Unlike standard SEO manipulation, which focuses on manipulating the relative page-rank positioning of results within popular search engines, SEO Code Injection attacks are designed to fool a Web application’s backend systems in to embedding malicious code within dynamically created page content. In a successful attack, any subsequent request for the targeted page (or related pages on the same site) will result in the attacker’s malicious code being included as part of the page content, and the code likely executed within the remote users Web browser during the page rendering process.

While an attacker could attempt to embed almost any kind of malicious code through a vulnerable SEO vector, in most cases the preferred method is to include short code segments that will cause a visitors Web browser to link to, and execute, more advanced malicious code elements hosted on external Web servers under the attackers direct control.
How it Works

In essence, SEO Code Injection is a fairly simple attack that targets Web site visitors by abusing poor application logic and exploiting content sanitization flaws within the backend Web application service.

For an attack to be successful, the Web application must provide three functions:

    *  The application must create page content dynamically based upon how the visitor initially reaches or finds a particular page, and embed elements of that data within a resultant page.
    * The application must “weigh” page content based upon the frequency of dynamic keywords; keywords that are typically used to optimize page ranking placement within search engine.
    * The application must fail to correctly sanitize user inputted data – in particular, data capable of containing HTML and scripting elements.

While the specific formulation of the attack can take on various forms depending upon the nuances of the vulnerable Web application itself, the process of conducting an attack is typically straight forward. The description below provides an explanation of the most common vectors used in attacks conducted in the first half of 2008.

   1.  Reconnaissance. To prepare for the attack, the attacker must first perform a degree of reconnaissance to identify the keywords and Web sites with vulnerable application services.

      A. Identify Keywords. The attacker identifies keywords that are likely to be searched for by potential victims of the attack. These words may be commonly searched for items (e.g. brand-name shoes, music bands, etc.) or, more commonly, keywords associated with major recent news events (e.g. drug overdoses, natural disasters, etc.).

      B. Identify Sites. The attacker identifies Web sites that consistently appear high in the page-ranking of search engine results. These are sites that typically refresh their page content frequently (e.g. News sites, blog sites, online sales sites, etc.), and already use dynamic SEO algorithms to affect search engine page-rank placements.

      C. Identify Vulnerabilities. The attacker tests the degree of data sanitization performed by the Web application logic. For example, what (if any) HTML tags are removed or filtered, and whether different forms of character encoding are allowed (e.g. escape encoding, Unicode encoding, UTF-8, etc.).
   2. Construction. Having performed their reconnaissance and decided upon the vulnerable Web sites to be targeted for the SEO Code Injection attack, the attacker must then construct the payload(s) that will be used to exploit the previously identified data sanitization flaws.

      A. REFERER Fields. Many SEO routines utilize the REFERER field contained within the HTTP header of a Web browser’s page request to decide upon which keywords should be included within page metadata. Whenever a user clicks on a link listed in the results returned by a search engine after inputting their search criteria, their resultant page request will contain a REFERER URL that not only contains information about the search engine they used, but also the keywords they were searching for.
      For example, a REFERER from the Google search for the words “Gunter Ollmann” may look like http://www.google.com/search?hl=en&q=Gunter+Ollmann while a query for “Günter Ollmann” may contain q=G%C3%BCnter+Ollmann within the REFERER.

      B. Site Search Criteria. Many popular sites also have local search engines for keyword searches within their own content. As site visitors utilize the local search capabilities, the Web application may monitor their keywords and record which specific content they subsequently viewed. If multiple keywords are searched for, and only a few of those keywords are contained within the most popular pages that visitors then go on to view, the SEO routines may selectively embed or cache these missing keywords in to the resultant page to increase the probability that the same page will be found in the future using the “missing” keywords.

      C. Malicious Keyword. Having decided upon the relevant SEO keyword injection vector, the attacker formulates the “keyword” he wishes to insert. In most recent public attacks, the “keyword” is a specially formatted link to an externally hosted malicious script; a script designed to exploit vulnerabilities within the victims Web browser and secretly install malware.
      Depending upon the degree of data sanitization of the vulnerable Web site and how it dynamically wraps additional keywords within the page content, the attacker may opt for links such as:
      >

Posted in: SEO