Managing Editor
Cybersecurity firm ESET is warning of a new malware-based scheme it calls GhostRedirector, which invisibly hijacks Windows-based internet servers to trick Google into promoting illegal gambling sites. According to the company’s blog, We Live Security, researchers say they believe with “medium confidence” that China-aligned hackers are responsible for the new threat, though its targets are largely in Brazil and certain South Asian countries.
They infer the geographical link based on the fact that a code-signing certificate issued to an unspecified Chinese company was used in the attack, and the presence of Chinese text strings in parts of the code.
The use of “black hat” tactics to promote unregulated gambling sites and attack competitors is not uncommon. This summer, numerous gambling affiliates found themselves the target of fraudulent DMCA takedown requests of unknown origin.
However, GhostRedirector’s victims are companies outside of the gambling industry. ESET found no particular pattern to the choice of targets. Per the blog, “it is likely that these were opportunistic attacks, exploiting as many vulnerable servers as possible, rather than targeting a specific set of entities.”
The end goal of the malware appears to have been to quietly redirect Google crawlers visiting infected websites, while leaving their appearance unchanged for human visitors. That meant there was no immediately apparent impact from the victims’ end — thus the “Ghost” moniker — but potential long-term SEO consequences for their sites if Google were to detect the scheme and impose a site penalty because of it.
How GhostRedirector Works, in a Nutshell
The researchers believe the initial entry point for the hackers was SQL injection.
SQL, or “Structured Query Language,” is a language used to interact with many types of databases. Injection refers to the insertion of SQL commands into text strings that might be accepted by a server for other purposes.
The XKCD comic “Exploits of a Mom” provides a comedic example of the concept. In it, the mother manages to delete the school’s database by naming her child “Robert’); DROP TABLE Students;–“.
The implication is that the school administration entered that string verbatim into its database, whereupon the server interpreted everything after the single-quote as an instruction to erase the list of students from the system.
Here, instead of deleting a database, the hackers used an SQL injection to gain a toehold to add other software to the system. This included “Bad Potato,” a piece of malware that allows the creation of new administrator accounts.
Finally, with full access to the system, the hackers installed the covert redirector. This would check the identity of inbound traffic to the website and, upon identifying a Google crawler, feed it a different version of the page. The phony page would include backlinks to the illegal gambling site, thereby boosting its credibility in Google’s eyes, without the site owner’s awareness.
