One of the things you probably do the most when on the internet is using a search engine. These websites scan millions of pages for your query terms, all within a matter of seconds. Businesses spend time and money on search engine optimization, a set of methods by which they can improve their ranking in search engine results. A better ranking in search engines can translate into more web traffic for businesses, and in turn more revenue.
From a hacker’s point of view, this poses an opportunity. Instead of legitimate sites reaching the top of the results page, what if a compromised site were to appear first? This could make the life of the hacker even easier, with those visiting the page potentially unaware that they are the victim of an attack; this is the reality when we examine search engine poisoning.
What is search engine poisoning?
In search engine poisoning, a cybercriminal will use the way search engines operate to try to carry out an attack of some kind. In the same way that businesses try to optimize keywords on their pages to attract visitors, so too could cybercriminals; by keeping up with current trends, a hacker could create a page relevant to a trending topic that is receiving lots of searches, like a new product or a developing story in the news. The result of this could be a seemingly innocuous search result that bombards the user’s machine with malware when opened.
How can I protect myself?
Search engine poisoning can be difficult to protect against, especially being that hackers can easily adapt to, or even fool, search engine algorithms. For example, advancements in technology have made it possible for the operators of these websites to tell if their site is being accessed by an automated search engine process, or rather by a genuine user. Where a search engine might see a perfectly legitimate site, the genuine user could be shown the compromised version of the site.
Search engines update their algorithms and security features periodically, but being that they may not even realize a page is compromised, it’s important to take your security into your own hands. Using anti-virus or anti-malware software can help detect a website affected by search engine poisoning, but other hallmarks of compromised pages, like pop-ups, redirects, and overly persistent ads can be used to identify an infected site. You can also compare the page to the times you may have accessed it before; if it looks significantly different or somehow altered, it could be compromised in some shape or form. Most browsers feature various safety measures to prevent obviously compromised sites from displaying at all – enabling these in your browser preferences can help prevent being a victim of search engine poisoning as well.
It’s important to stay abreast of ways you or your business might fall victim to a cyberattack. If you’re looking for a partner with whom to develop a comprehensive cyber security strategy, reach out to us at Cyber Sainik today!