Slashdot Log In
Google 302 Exploit Knocks Sites Out
Posted by
CmdrTaco
on Tue Mar 15, 2005 08:16 AM
from the that-hurts-me dept.
from the that-hurts-me dept.
clsc writes "The exploit: Redirect via 302 to another page of your choice, then watch as the URL of your redirect script replaces the URL of that carefully selected page in Google's search results. Once this happens, feel free to redirect any visitor that is not Googlebot to any other page of your choice. Also applies to other search engines as well (not Yahoo! though)."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Yikes! (Score:5, Funny)
Re:Yikes! (Score:5, Funny)
"The exploit: Redirect via 302 to another page of your choice, then watch as the URL of your your redirect script..."
Parent
Re:Yikes! (Score:5, Insightful)
Parent
Splendid (Score:5, Insightful)
2. show a "random" ad (336px by 280 px) promoting 'google adsense' clearly stating "how to turn your website into a revenue generator in minutes" at said post.
3. $$$
goog (Score:5, Funny)
Re:goog (Score:5, Informative)
The basic issue is that not only can purposeful individuals kick you out of the serps with a simple 302 from a higher pagerank page, but people who use 302 redirects to track outgoing links from their site (and several content management software packages do this by default) can accidently do the same thing and there isn't anything the real webmaster can do about it.
It's been discussed in much greater detail in a thread at webmaster world [webmasterworld.com] for a while, as well.
Parent
yawn (Score:5, Funny)
Re:yawn (Score:5, Funny)
Parent
Fake Banks (Score:4, Insightful)
Parent
Re:Fake Banks (Score:5, Interesting)
Not news.
Parent
Re:Fake Banks (Score:5, Informative)
Not news.
I agree it's old, even the guy that wrote the article admits it goes back a few years. But you are wrong about how it works. These aren't just extra pages
Parent
Re:Fake Banks (Score:4, Informative)
Parent
Re:Fake Banks (Score:5, Insightful)
Parent
Re:Fake Banks (Score:5, Insightful)
You access your bank from a computer you don't have complete control of?
Have you considered tapdancing in minefields as an alternative?
Parent
Re:yawn (Score:5, Funny)
God knows, 14 year old boys need to be tricked to make them look at porn.
Parent
Re:yawn (Score:5, Funny)
"That's fine, but why is that wine bottle shoved in your ass?"
"It was a one in a million shot, I tell ya..."
Parent
Re:yawn (Score:5, Insightful)
Porn doesn't always mean nice shots of bare-breasted hotties. It ALSO can mean "married lactating grandmas doing their first anal with an underage donkey!"
If someone is doing a malicious redirect, I expect they would rather show you the latter and not the former. In either case, viewing ANY porn image can get you fired or otherwise in trouble in the right (wrong) situation.
Someone mentioned using the BACK button. Great thinking, assuming you know you've been redirected. If the page looks right and behaves properly, how many people will notice they have been redirected to www.nat1onalbank.com, and enter their personal info. Ooops! Oh well. The BACK button can let me take back my password, right?
Right?
Parent
Re:yawn (Score:5, Funny)
Parent
Re:yawn (Score:5, Insightful)
Parent
Re:yawn (Score:5, Insightful)
Research paper = good
Porn = bad
Young boy = Becomming a sexual being
Grand total = Neurotic young man who feels guilty for acknowledging his sexual feelings.
Why is it so hard for some people to acknowledge the simple fact that young people of all ages have sexual feelings that are natural. And to repress those feelings and smother them in guilt is a very very damaging thing to do.
OH ya, I forget, all the fundamentalist (pick any religion) know exactly how we are all supposed to feel. Excuse me while I go puke!
Parent
Re:yawn (Score:5, Insightful)
Sex is good. Frankly, sex is great. Honestly, it's one of the best things that I've ever experienced. :-) And since it is great, these vague notions of "fundamentalist religions" that you cite never actually say "sex is bad". They do put conditions on sex, but it's up to the individual to follow them and I get the impression you aren't bound by these conditions in any event.
Porn is porn. I'm not really going to put any moral value to it, but if you can watch it without unhealthily raising your expectations for real world women, or if you can be with real world women at that point without thinking of the porn... more power to you. Some couples say it helps their sex life, but then who are you really making love to? Your spouse or your fantasy?
There are a couple thousand different ways this conversation can go from here (including offtopic :-) but I'll quit for now.
Parent
Re:yawn (Score:5, Insightful)
Porn doesn't raise people's expectation of the habits of real women any more than romantic movies raise women's expectations of real men. They do a little, but then again there are a few real men and women who take a clue or two and get ideas from these media in order to help please their spouses, girlfriends, whatever.
As far as 14 year olds seeing porn is concerned (trying to get a little bit on topic), I'm firmly convinced that our country's simultaneous demonization and glorification of sex is one of the things that makes kids curious about it. I really wish that both groups would just stop it and start teaching children about sex as a natural human function that needs to be performed with caution and discression.
Parent
Re:yawn (Score:5, Insightful)
And if you can't, you'll probably have trouble getting/maintaining a real-life GF, which will make you d/l more porn, etc. ad. infinitum.
But so what? People can choose all sorts of ways to make themselves unappealing to the opposite sex. Maybe the moral majority should start a campaign against leisure suits.
Parent
Re:yawn (Score:5, Funny)
At first I thought you wrote "a real-life GIF". Talk about misreading!
Parent
Re:yawn (Score:5, Insightful)
Even though we are in serious OT territory here, I thought I would throw my two cents in. Before I start, let me make it very clear that I am a member of a "fundamentalist religion", I grew up Methodist, and have been part of a non-denominational congregation since I was 15. That said, I don't completely agree with everything the fundamentalists believe, and sex is one of the items at the top of the list that I have issues with.
Fundamentalists may not teach the "sex is bad", but they do strike a serious fear of sex in the minds of all of their teenagers. I grew up believing that having sex outside of marriage is probably the worst sin you could commit. Now I personally don't think teen sex is a good thing, really, who wants a baby at 17, but the church tends to go so far that they create (as anothe poster commented) this air for mystery about the whole thing. The church I went to often discouraged dating, kissing, being alone with someone of the opposite sex, anything that could possibly lead to sex. The problem with this is it also screws up much of a kid's psychological and sexual maturity. If you follow their rules, you never gain the experience needed to be succesful in relationships down the road. If you don't you are an outcast and a bad kid.
Why do you think that the Christian church in America has a higher divorce rate than the general population? These kids are taught that you have to be married to have sex, and it's evil to date, so they get married at 18 to the first nice christian girl the find, just so they can sleep together. Five years they figure out that they really don't like each other, or one of them wants to go sow some wild oats, so they get divorced. I've seen in many times.
I don't know what the right answer is, but the fundamentalist church is alienating itself from the common man by focusing on issues that either aren't important, aren't a sin or just aren't worth fighting about. They focus on things like sex, drinking, smoking, bad words and homosexuality, but ignore things like lying, cheating, stealing, and greed.
Parent
Re:yawn (Score:5, Insightful)
Then you are not a fundamentalist. Nor would I consider a "non-denominational congregation" a fundamentalist church in general.
Is mentioning porn = good and fundamentalist religion = bad the way to get modded up here now? Odd..
As for the GP the answer is yes because it is true.
Parent
Re:yawn (Score:5, Insightful)
Having the feelings is natural. Natural as in God gave them to us as a part of our physical being. There might be debate as to whether they are there for procreation only, which depends on your version of extremism. However, the feelings ARE natural and purposefully put there.
That does NOT mean that they should be acted on. As a fallen creature, we also have the urges to lie, cheat, steal, hurt others, and even hurt ourselves. These tendencies are seen negatively and should be. We do need to edit our responses to our feelings, sexual or not.
Choosing to feel how I want - now that's complete freedom. Unfortunately, we aren't given that freedom. Instead, we choose between right and wrong. A moral choice based on morality which can not be defined independly from God.
[/diatribe]
End product? Surpression is not the only alternative to acting on them. Elimination of temptation is a good way also. Don't watch that National Geographic special on that lost Amazon tribe. Don't buy the Sports Illustrated swim suit edition. (You should have seen the look on the Best Buy cashier's face (a guy), when I demanded that he remove the SI software/magazine display from the counter. It was offensive. He thought I was kidding. I was not. It was a priceless look.)
You can choose to avoid the temptation. Divert your eyes. Divert your thoughts. What are the guidelines? Not mine to say, but it can be done.
john.mull
Parent
Re:yawn (Score:5, Insightful)
You want to remove your temptations? Stay the fuck home and leave the rest of us alone then.
Parent
Re:yawn (Score:5, Insightful)
There is a definite difference between being certain in your faith (internally) and claiming as fact (externally) that which cannot be tested or demonstrated by human means. Yes, there are human limitations, but this is not my belief, since I can demonstrate it with the same solidity that I can use to demonstrate the facts of gravity:
For instance, we have an inability to know Pi with absolute precision. Perhaps a god could know Pi with perfect precision, or perhaps not... but there are proofs that it cannot be known within human experience. Another instance: not only can we not measure our ability to use our human imagination, we cannot even conceive of a yardstick that would allow such a measure. We are limited in our ability to comprehend this core part of our nature.
This argument has been presented so many times before, and in so many different formal logical systems, that it can be accepted as a kind of universal axiom (like Plank's Constant, for instance). You can get to it as an extension of the cosmologist's anthropic principle, but there are also ways to get to it from any world view that is not arbitrarily dismissive of new information about the world.
Someone needs to mod this as "-1 infantile philosophy". I think I've been suckered by trolls...
Parent
Re:yawn (Score:5, Insightful)
What the fuck is wrong with people in this country. Oh yea, sex is evil & a sin if it's not for procreation. Religion is the root of all evil.
Parent
Re:yawn (Score:5, Funny)
Parent
Re:yawn (Score:5, Funny)
"Son! What are you looking at? Is that
"I told you! I'm working on a report!"
"With naked women?!"
"It's a History report, so I hit the History button on your computer!"
Parent
Google can't be wrong (Score:5, Funny)
Oracle Application Server (Score:4, Interesting)
Most of the redirects are innocuous, for example with an application whose context-root is
Since the product can't be changed, I'd probably change Google's behavior.
Seems like (Score:4, Funny)
We haven't had a good exploit/0day in how long? Since the Webdav exploit? Or the RPC DCOM? Now we have to use Google, phishing techniques, and URL redirection. We are scraping the bottom of the barrell apparently.
Can I use this to knock out a fraudulent site? (Score:5, Interesting)
Fun (Score:5, Interesting)
Wow. That's a fun exploit... I can't wait to go tell my boss why our site links to a pron site on google.
All kidding aside this could be a major problem for some of the more controversial websites. Akin to the Googlebombing [slashdot.org] that was just mentioned yesterday this could be the next major attack scheme on the net. Imagine a pro-life site subverting a pro-choice site, Neo-nazi's subverting a site intended for Jewish children, the US government subverting Al Jazera...
Not a whole lot of fun IMHO. I trust google to return what I search for, if this changes I and a whole lot of other nerds are going to be left wandering aimlessly around the net.
Further Reading (Score:5, Informative)
This really is a big deal. (Score:5, Interesting)
Historically, good content meant good search engine placement. Now that this little trick is being more publicized, it just decreases the amount of time required for someone to hijack your entire site and remove it completely from the search engine results.
Wait... (Score:5, Funny)
Why This is Such a Big Deal (A Summary) (Score:5, Informative)
Suppose you have a small business under the domain http://xyz.com/, and search engines bring you a lot of traffic because you rank high for keywords in your market. You have a lot of people out there linking to you, a lot of satisfied customers, good content on your site. You're always in the top 10 somewhere when people search for "xyz widgets".
Well, this issue with Google makes it very easy -- incredibly easy -- for someone to knock your site out of the rankings entirely. And I mean for *everything*, to where searching for your own company name in quotes literally buries you hundreds of pages deep in the results. We're talking sites going from getting 1000 unique hits to 10 overnight.
And here's the kicker: It requires absolutely no technical knowledge, no time investment, and is perfectly legal...
All I have to do is have another domain handy that is roughly as popular as yours. And I make a "links" page, like one of those directory services, that lists your website. But instead of being a normal hyperlink, it's a CGI (or PHP or ASP or whatever) script that generates a 302 redirect to your domain... Now, these are very simple, common scripts. One-liners that you can download from cgiscripts.com and stick on your server. The original intent of these scripts is to track which links are being clicked on your site. But now they've found a new use, because when Google gets that 302, all hell breaks loose.
See, according to the HTTP spec, 302 is a *temporary* redirect, which means Google is supposed to interpret whatever content it finds at the 302 target (your site) as really belonging to the URL of the source (my site). Google is just obeying the spec strictly here, and with devestating results. Why? BECAUSE THE DUPE FILTER NOW KICKS IN! You see, Google has a "dupe filter" that says if the same exact content is found for two unique URLs, then one of the URLs is obliterated in the rankings. Because after all, searchers don't want to be finding the same content over and over. If that happens, they'll start using a different search engine. But Google, sticking strictly to the HTTP spec, doesn't know who the content really belongs to when it gets a 302.
So Google essentially flips a coin. And if it comes up tails, say bye-bye to your domain in the rankings. Your *entire* domain. Because the dupe filter isn't limited to just the page that the 302 is pointing to -- it applies across your entire domain.
These 302 "exit-link-trackers" are all over the web. They've been used by webmasters for years. But it's just recently that Google has started treating 302 this way, so it didn't have any bad effect before. But now it kills you.
The funny thing is, the solution seems pretty simple: Just stop treating 302s this way if they point to a different domain. But for whatever reason Google isn't listening. Hopefully the press that's being generated now will give them the kick in the ass that they need.
It happened to me.. (Score:5, Informative)
Well, I knew about the 302 bug (in fact, it's been known for months in professional webmaster circles).. so, I did an allinurl:mydomain.com/mypage.htm search on Google to find the culprit. Low and behold, it was some blog page about one PR below my page with a script that redirected through a 302. The catch was that this redirect script ONLY worked if you clicked on it from the blog itself - if you clicked on it from the Google SERPs you got a 500 server error.. so in effect, Google misidentified the redirect page as my actual page and then subsequently tried to spider it from the URL directly and got a 500 error.. the result being that I was dropped from the index. Was this malicious? Hardly - the webmaster had compiled a small list of cool, useful links - not knowing that his buggy redirector was killing those sites off.
So whaddya do? I tried emailing the webmaster but everything bounced. It looks like he was out of the country. I tried giving Google feedback, but frankly that's just like offering up a prayer to the Great Google God - so I also used the BASE HREF trick mentioned in the article, and after a few days the page came back in the index as normal. So, either that trick worked or the Google God answered my prayers. I'm guessing at the former.
301 and 302 have very different meanings. (Score:5, Informative)
This "exploit" isn't very interesting and the author really doesn't seem to have a good grasp of the HTTP protocol design, the end-to-end model, or the internet in general.
I'd be very careful before I blindly changed all my redirects to 301s. The semantics behind a 301 and 302 are VERY different and unless you want people to replace the original URI with the target in your 301s, forever, you might be entering a world of hurt.
From RFC 2616 -- HTTP/1.1 [ietf.org]:
10.3.2 301 Moved Permanently
The requested resource has been assigned a new permanent URI and any future references to this resource SHOULD use one of the returned URIs. Clients with link editing capabilities ought to automatically re-link references to the Request-URI to one or more of the new references returned by the server, where possible. This response is cacheable unless indicated otherwise.
10.3.3 302 Found
The requested resource resides temporarily under a different URI. Since the redirection might be altered on occasion, the client SHOULD continue to use the Request-URI for future requests. This response is only cacheable if indicated by a Cache-Control or Expires header field.
This is a common theme in the high-tech world; Joe Hacker figures out a problem and a 'solution'. Problem is, they don't understand all the implications of the solution. That doesn't stop them from yelling loudly about the solution. Without a comprehensive explanation of the impact of the 'solution' you might be just causing yourself harm in other areas down the road.
Education and thorough analysis are always a good idea when you are dealing with complex systems that might have emergent behaviors. This is certainly one of the bigger pet-peeves at the IETF [ietf.org] and with the IESG [iesg.org].
Sombody has to say it (Score:5, Funny)
"This isn't the webpage you are looking for."
Re:everybody uses 302 (Score:4, Insightful)
Parent
Re:everybody uses 302 (Score:5, Informative)
You use 302 to hijack someone else's page in Google's search results. Your bogus ad infested page shows up instead of the actual content the user was searching for (and thought they were going to see), while the real website that you hijacked doesn't get any more Google traffic. That's the exploit.
Dumbass.
Parent
Re:The dark path (Score:5, Insightful)
There are basically two schools of thought in SEO as I've seen it. You can either try and be everywhere (spamming by creating zillions of pages and links) or you can be interesting (like this blog; people want to come here, instead of needing to be tricked).
Unfortunately, most people are about as interesting as watching grass grow, and they know it. So they spam the search engines and aim for the lowest common denominator. Sad, really.
Parent
Re:WTF (Score:5, Insightful)
That is my understanding of the problem, and part of the reason why redirects appear to get higher rankings than simply copy and pasting somebodies content.
As for covert googlebots, I'm sure they exist as R&D items, but doubt they would be setup in the manner you describe.
Parent
Re:WTF (Score:5, Informative)
*it allows a hijacking website to replace pages belonging to target websites in the Search Engine Results Pages*
that's what it does. think about it for a while. sure they could have protection but at the time it seems they DO NOT.
*What does it look like?
The Search Engine Results Pages ("SERPs") will look just like normal results to the searcher when a page hijack has occured. On the other hand, to a webmaster that knows where one of his pages used to be listed, it will look a little different. The webmaster will be able to identify it because (s)he will see his/her page listed with an URL that does not belong to the site. The URL is the part in green text under listings in Google.*
a lot of people use google as a sort of bookmarks page(with keywords they remember), potentially this could hurt them. what it more likely happens if it isn't fixed is that advertisers start to pollute the results even more, eventually leading google to be useless.
Parent
Re:WTF (Score:4, Funny)
I didn't even realize that I did this until I read your post. Not that anyone cares, but I only have 4 or 5 regular bookmarks; the rest of the pages I need to goto I either a) remember because the url is so easy or i go there so much (e.g., slashdot, orderyourrussianwife.com, etc) b) do a search for them as needed (e.g. martin vetterli's homepage), or c) use the url auto-complete in the browser.
Parent