37 ms·

How I recorded user behaviour on my competitor’s websites

766 points by lukestevens 8y ago

lukestevens 8y ago
This is an interesting yet disturbing case of blackhat SEO and phishing, where the site owner hijacks the back button and sends visitors to fake sites where he can observe their behaviour. FTA: Here’s what I did: 1. User lands on my page (referrer: google) 2. When they hit “back” button in Chrome, JS sends them to my copy of SERP 3. Click on any competitor takes them to my mirror of competitor’s site (noindex) 4. Now I generate heatmaps, scrollmaps, records screen interactions and typing.
- mrob 8y ago
  Yet another reason to browse with JS disabled by default.
  - confiscate 8y ago
    really? That seems extreme. Might as well say: "Yet another reason to not browse anything on the web"
    - LeoPanthera 8y ago
      It's a shame you're being downvoted, you're entirely correct. Most of the modern web is unusable with javascript disabled.
      - Nadya 8y ago
        >Most of the modern web is unusable with javascript disabled This isn't wrong - but it assumes most of the modern web is worth using. Most of the modern web isn't worth browsing, and every site I've ever come across that is worth reading works just fine without Javascript. I'll continue to browse the internet with Javascript disabled-by-default. It's a surprisingly good filter. With that being said - while this is "another reason" it is as minor of a reason as it gets...
        A2017U1 8y ago
        > assumes most of the modern web is worth using But it is, are you really going to ignore reading some huge breakthrough in physics because the site uses react? Also in many situations there's absolutely no other choice. Government sites, e-stores, banking. And then there's the buildup of recorded urls. Private browsing is somewhat less useful when your scipt blocker whitelist is full of porn sites. I use it for security in specific browsers but happily admit it's not an actual solution for normal people. Adding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use.
        dorgo 8y ago
        >dding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use. Yes, it is annoying. It reminds me each time how annoying websites are which use Javascript for things which could be done without. And it lets me search for alternatives or just abandon such websites.
        rauhl 8y ago
        > how annoying websites are which use Javascript for things which could be done without A good example of sites which use JavaScript for things they don’t really need are those GP mentions: ‘government sites, e-stores, banking.’ Government sites: the vast majority of government sites are simply informative text. There’s absolutely no need for me to grant the government permission execute code on my computer (which is what JavaScript does) in order to read the minutes of the latest council meeting. Even when interactivity is needed (e.g. an online tax-payment system), HTML forms (the sort we’ve had for over two decades) are a perfectly good solution for ‘enter information in a box and submit it.’ JavaScript can definitely lead to more attractive, more usable solutions — but it’s completely optional. Government sites are a great example of something which should work for anyone, even someone using an old BeOS box on the other end of a modem connexion running over a bit of wet string. E-stores: there’s simply no need for JavaScript to display pictures & descriptive text of goods in an attractive fashion. There’s simply no need for JavaScript to give me a form to enter my credit card information & mailing address. Again, JavaScript can make the experience better, but it is also a privacy and security risk. I seem to recall that Amazon made quite a lot of money before JavaScript was a thing; I imagine it could continue to do so. Banking: there’s no need for my bank to execute code on my computer to send me a statement of my accounts, nor to give me a form to pay bills or send money. Indeed, in my experience JavaScript just makes things worse, because instead of downloading a single HTML document from my bank’s servers I get to download dozens of trackers and bugs, as well as the code necessary to hit multiple APIs and stitch the page together out of its parts on my own desktop. I think I read something yesterday, here or elsewhere, about how client-side JavaScript really took off at the same time as server-side Ruby was a big thing, with the implication that the reason was that Ruby was so slow that websites had to offload as much computation as possible. I don’t know, now, if that was actually the case, but I do know that it’s 2018 and my desktop experience is slower than it was in 1998, thanks to JavaScript.
      - mrob 8y ago
        Many modern web pages work better with Javascript disabled now, because it avoids the GDPR/cookie popup spam.
        confiscate 8y ago
        fun fact Not browsing the web at all, also avoids the GDPR/cookie popup spam. That solution works 100% of the time. It blocks out 100% of the GDPR popup spam.
    - gear54rus 8y ago
      Lol. Downvoted for pointing out fanaticism. Why don't you guys remove all executables from your PCs too? Shouldn't PCs be just a glorified typing machine?
    - blitmap 8y ago
      The thing that concerns me is it's easy to wrap a JS API or unreference it if I know it's abused for ads/tracking. I don't know of good ways to go about tracking based on pointer events or scrolling. I'd put more research into generating fake events or limiting them for an untrusted site, so mouse behavior can't be used for "where are they looking" analysis.
  - caspervonb 8y ago
    I wish... even GitHub won't work properly without JavaScript enabled these days.
    - Deimorz 8y ago
      Completely disabling Javascript isn't feasible, but you can use uMatrix or NoScript with all scripts blocked by default, and only whitelist ones on sites/domains that you trust.
      - interfixus 8y ago
        Exactly. I've been browsing script-free for twenty years. It used to be a real pain switching on and off, until Opera introduced easy by-site settings. But then, back in the day most sites were perfectly servicable without any scripting whatsoever. And these days, uMatrix makes it all a snap.
    - jwilk 8y ago
      IME, most parts of GitHub work fine without JS enabled. (Though sometimes I have to disable CSS to get my hands on some forms…) This is unlike major competitors (GitLab, Bitbucket), which are completely broken.
      - btasovac 8y ago
        Hello everyone, GitLabber here! We had a similar issue about this [1], and we raised another one when deciding to further clarify our documentation regarding this question [2]. You can find out more about our motives behind this decision there. [1] - here https://gitlab.com/gitlab-org/gitlab-ce/issues/36754 https://gitlab.com/gitlab-org/gitlab-ce/issues/36754 [2] - https://gitlab.com/gitlab-org/gitlab-ce/issues/43436 https://gitlab.com/gitlab-org/gitlab-ce/issues/43436
        jwilk 8y ago
        Ironically, you have to enable JS to see comments for these issues…
  - wiether 8y ago
    In that case, just not using useless thing like "back" button will be perfectly fine. A good website don't need using this button. And to navigate between websites, using a tab for each website is fine. Especially when comparing results from Google.
    - rawTruthHurts 8y ago
      I agree. User experience is so overrated these day, right?
    - azeirah 8y ago
      ... Don't use the back button? What? I actually kind of like the ability to move between pages and domains with the back button.
      - wiether 8y ago
        A good website give you the ability to move without this button. It's like Android VS iOS. The first one has a back button, the other don't.
        deleted 8y ago
        [deleted]
        LyndsySimon 8y ago
        > A good website give you the ability to move without this button. I disagree, fairly strongly. Re-implementing behavior that the user already has in their client is at best superfluous, and at worst very confusing. > It's like Android VS iOS. The first one has a back button, the other don't. iOS apps implement history as part of their UI because iOS doesn't have provision for one in the default UI. This is changing, as gestures become more and more common. I don't think I've actually used a "back button" on my iPhone in months. I pretty much take its presence as communicating that it's possible to go back, not as a means to do so.
  - King-Aaron 8y ago
    That's a reasonable course of action until you need to use the internet for pretty much anything.
    - JdeBP 8y ago
      Experience teaches that that is a vastly exaggerated statement. There remains quite a lot of the World Wide Web that does not require Javascript. And of course it is pretty much not required at all for using the Internet outwith the World Wide Web.
      - kmbriedis 8y ago
        And then classic React enters the building
    - adrianN 8y ago
      Works pretty well for me.
    - eadmund 8y ago
      The Internet works just fine without JavaScript: DNS, FTP, SSH, SMTP, NNTP — none of them have ever required JavaScript. Indeed, HTTP works just fine without JavaScript. HTTP pages perform better without it. Granted, many broken and ill-programmed HTTP pages aren't useful without JavaScript. That's no an indication of how useful it is, but rather an indication of how poorly-skilled those webmasters are. Then there are web apps; they indeed don't work properly without JavaScript. Fortunately, there just aren't that many important web apps. To be honest, I can't think of one web app that I regularly use, other than Google Meet.
      - EdwardDiego 8y ago
        Your distinction between web pages and web apps is entirely arbitrary. Many web pages use JS in such a way that interacting with them without JS is a lesser, if not broken, experience.
        8y ago
  - dwild 8y ago
    Yeah I know, personally I prefer to use paper, way safer. I plan to just do the full TCP request by hand using the ethernet wire, morse-code-like, next./s Sure increasing the functionalities increase the risk, it doesn't means the risk isn't worth it or isn't mitigable. Worst case, he fake your back button.. it's not that bad seriously. Google will probably try back buttons and different similar situation now on their engine and deal with theses cases one by one.
- snaky 8y ago
  > noindex So, the browser extension indicating (with big red fonts) that this site is noindex could be a simplest solution? For not power users who don't know about any extensions that would be not so easy though. If that function will appear in Chrome enabled by default, that would raise questions about Google motives, obviously.
  - dorgo 8y ago
    I think noindex is nice to have but not neccessary for this trick. The only solution is to fix the back-button bug/vulnerability in Chrome.
    - baddox 8y ago
      It doesn’t seem like there is a fix, short of removing the history API.
      - dorgo 8y ago
        Maybe restrict the history API to the same-origin-policy? Javascript could/should be allowed to manipulate browser-history only for the same domain. Just an idea.
        SmellyGeekBoy 8y ago
        Why should anything be able to change the behaviour of the back button? If I click back it should take me back to the previous URL. If it breaks your one page 200MB JavaScript masterpiece then tough luck, come up with your own navigation.
        brlewis 8y ago
        Suppose we did what you said, and the back button only ever took you back to the previous URL. I could still make a JS app that, on your first interaction with the page, moved you forward from https://example.com/ https://example.com/ to https://example.com/#home https://example.com/#home. Then it sets a variable such that when you go back to https://example.com/ https://example.com/ it shows a fake SERP. This is not an easy problem to solve.
- laumars 8y ago
  I'm curious how many visitors did this. In my very limited sample set of myself and friends / work colleagues, we all use middle click to open a result in a new tab.
  - oblio 8y ago
    The vast majority of regular users I've seen go back and forth between search and search results. Heck, I do it from time to time. Most users are extremely "inefficient" by geek standards.
    - laumars 8y ago
      Interesting. Thanks for that. Sometimes we can get so caught up in our own tech-bubble that we don't really notice the usage patterns of the average user. So it's often nice to have a reminder like this.
    - donkeyd 8y ago
      > Most users are extremely "inefficient" by geek standards. How is that inefficient? I use both interchangeably and I don't see how it's any less efficient than opening a new tab and then having to close it if it's not what you want, or having to close useless tabs if the first one is all you need... On my Macbook, I just swipe right and I'm back at the search results.
      - drcoopster 8y ago
        You assume you're back at the search results. As OP proved that's not necessarily the case.
      - oblio 8y ago
        For a lot of things it helps to compare things in parallel. With this technique you only see 1 result at a time.
  - SmellyGeekBoy 8y ago
    I'm not sure my parents are even aware of the existence of tabs, to be honest.
glandium 8y ago
One more reason to kill the referer HTTP header, I guess.
- yborg 8y ago
  https://github.com/meh/smart-referer https://github.com/meh/smart-referer
moltar 8y ago
That’s genius
caffeinated_me 8y ago
This seems to have some fairly scary security implications if used maliciously, but I can't think of a good way to protect against this. Does anyone know of a browser extension to limit access to the history API?
- nerdponx 8y ago
  In my mind, not giving the user opt-in control over this setting is a bug in the browser.
- htgb 8y ago
  I started using NoScript a while back, just to see what the web is like without Javascript. My plan was to uninstall it when it got too annoying, but to my surprise it's actually not bad at all. I'm quite lax in whitelisting domains I actually trust, but even then it's nice that it doesn't load Javascript from all other umpteen domains, which is often the case. Of course it's a very blunt weapon for blocking abuse like what's described in this blog post, but for sure it works.
encoderer 8y ago
Disturbing, fascinating, obvious in hindsight. Here’s another angle: a “bounce” back to google too quick is a negative ranking signal. By keeping them from going back to google by making them think they in fact did makes this also black hat seo.
- lallysingh 8y ago
  But Google doesn't see the bounce back. The site bounces back to a copy of Google's result page.
  - Semaphor 8y ago
    That's what they said.
  - hokoto 8y ago
    That's the point: Google doesn't see the bounce back, so you won't be negatively affected.
  - bagels 8y ago
    That is what the parent comment points out. He benefits from the fact that users can't return to google.
- brador 8y ago
  The slashdot trick. Still works and is actively used right now.
  - thecatspaw 8y ago
    what exactly is the slashdot trick?
hw_penfold 8y ago
In many ways this is malicious deception. In any instance where a login form is included in the scraped mirror, that represents an attacked user, and a phishing attempt. If someone did this in the wild, in an uncontrolled situation involving random strangers, it risks serious misinterpretation, and worse.
- bhelkey 8y ago
  > I had this implemented for a very brief period of time (and for ethical reasons took it down almost immediately, realising that this may cause trouble) The author did this in the wild, involving random strangers.
aquarin 8y ago
It seems my habbit to open google links in new tabs with right click have more meaning now. I initialy used this to avoid referal information.
- deleted 8y ago
  [deleted]
- kristianp 8y ago
  That's not going to stop the referrer from being available to the page. In chrome hit F12 and in the console type document.referrer.
- wiether 8y ago
  Doesn't change the referer but avoid you falling in that current trap. Anyway, using a new tab for each new website you visit is the way to go I think.
  - rellui 8y ago
    Maybe it's a good trade off for this to become default behavior in browsers (in the background unseen by users).
    - dennisgorelik 8y ago
      If user does not see that she is operating in a new tab, she can still click "back" and would still be vulnerable to the "Fake Google Serp" trick.
- jsjohnst 8y ago
  Google even has a settings options where all SERP links open in a new tab. I personally use it myself.
yjftsjthsd-h 8y ago
I'm surprised he's willing to put his real name to this. I can't immediately see that it's actually illegal, but it still screams red flag for unethical behavior.
- adtac 8y ago
  Not just his name, his whole company even!
nsmog767 8y ago
This is easy to hate on, and certainly ethically dubious....but man do I love it.
- p1necone 8y ago
  My thoughts exactly. This guy is an asshole, but man do I love a clever hack.
  - dejanseo 8y ago
    Hey, that's not very nice.
    - deleted 8y ago
      [deleted]
paulryanrogers 8y ago
Why do browsers allow changing the back button history before the visitor arrived at the domain? Seems like a subtle cross origin attack if that is truly what's happening.
- lathiat 8y ago
  I can imagine you could work around that issue just by once redirecting onto your own site first. On the surface, sounds like a difficult problem to solve safely. On a related note, I often have the back button not work because I hit back and chrome cached a redirect to some other page and it immediately redirects again before i can even spam back again. Need to long press back to get a longer history to go back further. This is a really interesting "attack" to see.
  - lathiat 8y ago
    This is interesting knowledge: https://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html https://smerity.com/articles/2013/where_did_all_the_http_ref...
- tobyhinloopen 8y ago
  Easy, just push multiple history items.
- makomk 8y ago
  Most people are just going to hit back until it looks like they're at the right site, so I don't think you'd have to change the previous history, just add your own entry after the one for the site they came from.
  - paulryanrogers 8y ago
    That would require storing where they came from as well as waiting for--or forcing--them to visit at least one more page on the attacker's site. So it'd still make backjacking harder. Maybe pages that immediately redirect on first arrival should also not count toward back history. Now a more perfect solution would require browsers snapshot where the user cane from then block or warn about pages at the destination that look too similar. Though that seems unnecessarily complex for most users.
shruubi 8y ago
Honestly, it doesn't shock me in the slightest that someone who markets themselves as an SEO expert would not only do something as unethical as this, but also brag about it, as though they think they've done something they should be proud of.
- cyrusshepard 8y ago
  FWIW, Dan (the author) has an outstanding reputation for professionalism and integrity in the marketing world. If he says he did something for ethical reasons, to those who know him, he's earned the benefit to be believed. (If you don't know him, you'd be forgiven for being suspicious) And credit should be given to him for educating everyone on this exploit.
  - dejanseo 8y ago
    Thank you Cyrus. I thought it would be obvious that this isn't a practical tactic a reputable brand could risk doing.
    - jimbauwens 8y ago
      While it is clear that you did not have any bad intentions, you should never have published it on the web. Based on your earlier comment "It worked a little too well" it becomes clear that multiple users were tricked by your site and that you possibly even intercepted submitted forms ("I gasped when I realised I can actually capture all form submissions and send them to my own email."). You misled people and breached their privacy. This is as simple as it gets, even if it was for an experiment (though leaving the site online in some other form still raises a lot of question marks..). My advice for you is to perform future experiments locally, not on the web and make sure people participating in your experiment are aware.
      - iscoelho 8y ago
        The point of the experiment was the social engineering aspect. The fact that it would work technologically was obvious. The fact that it would work practically was what he set out to prove.
pasta 8y ago
Presenting yourself as someone else is called fraud in my book. Changing the back button might be clever but all the rest is just simple. But people don't do this because I think in a lot of countries this is illigal. There is a way you can protect your site a little from this: add canonical tags to all your pages. When an attacker updates the back button to Google they will have a hard time getting the cloned pages up in the results.
- cm2012 8y ago
  In this case he NoIndexed the clone pages anyway.
jeswin 8y ago
A couple of years back I was talking to someone who did SEO for a popular education network. The company was spending millions of dollars every month on SEO and advertising. Their module operandi went like this: 1. Offer money to license or buy a smaller competitor's content 2. If that doesn't work, crawl and clone the site 3. Pump a lot of money into Google Ads, so that the cloned site now appears as an ad above the legitimate site. Google makes such scam easier now by making the ads look like organic results - a non technical user would hardly notice. 4. The legitimate site just dies. I was asked to build a tool which crawls sites, which I refused. But I learned how professional SEO works.
- graeme 8y ago
  This is somewhat risky, no? It's a clear case of copyright theft, and would be trivial to sue unless they hit everything behind cutouts to the extent they weren't traceable. One would think the owner of the cloned site would notice lower traffic, search, and notice the ad scam. This strategy sounds like it would take months to execute before the competing site died, if not longer. Am I missing something? I've read lots of seo scams that seem very hard to undo. This one seems....slow, very avoidable, with large legal and reputational risks for the perpetrator.
  - baddox 8y ago
    It’s never trivial to sue.
    - graeme 8y ago
      No, but in a case with a clear paper trail it wouldn't be hard to send a very clearly worded cease and desist showing exactly what damages are expected and how easy it is to prove. Depending on the size of the company would also be possible to raise a big PR fuss, get on top of Hacker News, etc. Plus there is DMCA takedown, google's tools, etc. Those are trivial to use.
- iKevinShah 8y ago
  This is on the same level (IMO) like when Site A pays SEO company to make SITE B appear as SPAM (usually by spamming SITE B's links on commenting systems with some vague texts). Had read this on discussion forums a lot when "Scrapebox" and the likes were used (2010-12ish)
3eto 8y ago
> Record actual sessions (mouse movement, clicks, typing) > I gasped when I realised I can actually capture all form submissions and send them to my own email. How many bad actors have been doing the same and for how long? This doesn't sound like something Google should just brush under the carpet and expect no one else is doing it. Although I wish the author had reached out to Google first to see how they would have handled it, I thank him for publishing it.
- dejanseo 8y ago
  You're welcome.
digitalboss 8y ago
Update from site "Google’s team has tracked down my test site, most likely using the source code I shared and de-indexed the whole domain."
- londons_explore 8y ago
  They don't up/down ranking individual sites for stuff like this. They've probably implemented back-hijack detection for the whole web
  - lozenge 8y ago
    They didn't down rank it, they delisted it just like they would delist child porn or copyright material after receiving a dmca notice
  - Gustomaximus 8y ago
    I've read otherwise but couldn't find anything with a couple min free time. Anyone else read/know about this?
  - dejanseo 8y ago
    That would be marvellous.
  - solarkraft 8y ago
    They de-indexed the domain. I think they do do this on an individual basis from time to time, especially with sites distributing (links to) illegally obtained content.
  - dejanseo 8y ago
    I just added a screenshot from search console: https://dejanseo.com.au/competitor-hack/ https://dejanseo.com.au/competitor-hack/ There's no manual penalty notice.
jackgolding 8y ago
I've seen Dejan speak and I'd recommend following his work because he does very interesting black hat things like this in SEO. He has so many out of the box ideas like this which are brilliant.
everydaypanos 8y ago
1 Years years ago when I was learning web development I bought a TLD and just copy-pasted Amazon’s log in page to just check how it works. Amazon somehow found out about this and Google punished that TLD after that incident and it just couldn’t go up in rankings after that. If I remember correctly they had even put that TLD on sites that report/list “phishing” sites so if you Googled about that TLD you would also get the “they are fraud” results. 2 I think that most pro users just New-Tab everything and go from there. Seems to me that going in n out search results all in one tab is kind of slow too.
- scottybowl 8y ago
  Pretty simple to find out by logging the referring site that is requesting assets from your server. I used to do this all the time about a decade ago when it was common practice to steal entire site designs. My favourite moment was when we changed a picture that someone was hot linking to as part of their own website and they emailed us with a rant saying "how dare you change the image"
- pawal 8y ago
  You bought a TLD when learning web development? That seems extreme.
  - gammatrigono 8y ago
    This must be sarcasm.
    - trowway21 8y ago
      This is certainly sarcasm.
      - solarkraft 8y ago
        Yesterday I was learning about processors, so I bought a foundry. Doesn't everyone do this?
thedonkeycometh 8y ago
This is man in the middle, and illegal anyway under a multitude of US and international computer misuse laws. What is with people doing illegal stuff and questioning whether its actually illegal because they didn't get caught? Is this post truth? And I'm not crying a tear because he got delisted, should be prosecuted for doing it on live sites and I truly hope his "competitors" (victims) sue.
dejanseo 8y ago
Hi everyone! I did this. It was just a random cool idea I wanted to try. It worked a little too well and I quickly moved it to a disposable site to test if the page will get penalised by Google. I got busy with other things and forgot about it. When I bumped into it again I decided to write about it, for two reasons: 1) To me it's hard to believe that Chrome would allow for this to happen in the first place and 2) that Google wouldn't penalise a site doing this. Well, since the story was published Google tracked down my test page (most likely by using the source code I revealed on my blog) and completely de-indexed the whole domain.
- pakitan 8y ago
  Is Chrome the only browser this trick worked on?
- TekMol 8y ago
  Copying someone elses site and tricking their users to use your copy is a copyright violation and fraud. Nothing cool about it.
  - mosselman 8y ago
    Your statement is far too broad and lacks context. Where is this a violation and where is it considered fraud? There must be some countries where this isn't the case or at least where the article and non-commercial use of the technique are considered to be mitigating circumstances. Also, who doesn't find it cool? You don't seem to be saying that what is described in the article isn't cool, you seem to be making a broader claim that copyright violation and fraud aren't cool. Lets assume you find what is described in this article copyright violation and fraud, because after all, you said it is. Apparently some people on HN find what the author has done cool, judging by the comments. Ergo, some things that you, specifically, consider 'copyright violation and fraud' are in fact cool.
    - fabricexpert 8y ago
      He copied Google's SERP page, AND copied all of his competitors websites. That's definitely copyright infringement, you'd be livid if you were a competitor, and as a user you'd be pretty annoyed. It's still an interesting hack, so good to see it being talked about. But it is not ethical and definitely illegal in almost any jurisdiction.
WTFWORLD 8y ago
I see some Dickheads commenting against Dejan. He is so smart, fuck all other cunts who can't even rank a simple site. We all do black, nothing is white in this world. Everything needs tricks, you can't do all white way.
mixedbit 8y ago
Long time ago I wrote about this technique: http://mixedbit.org/referer.html http://mixedbit.org/referer.html Besides back button navigation, I also had ideas to use a fake malware warning or just take a victim directly to fake search engine results.
markdown 8y ago
While we're on this topic, I have a related situation and wonder if my case is common: I built a brochure site for a mom-and-pop business a decade ago. The domain expired some time ago, and it was snapped up by someone who repopulated it with the original content scraped from the Internet Archive. It looks and behaves exactly like it did when I controlled it, except that a phrase in the frontpage content now links to some supplement sale site. Is there a name for this SEO bullshitery? What can someone do who isn't American and who therefore can't file a DMCA.
- brosirmandude 8y ago
  Sounds like that old site got bought by someone building a PBN (Private Blog Network). They buy old domains, get the old content from archive.org, and then add a link in somewhere to their "money" site, or to another site in their tiered linking structure. It's a BS tactic that can sometimes still work, but it's a LOT of effort to really keep up with it. TBH it's much easier to just actually make a site people want to use and reach out to people who might be interested in sharing it. Hosting/managing 100's of sites just to prop up 1-2 money sites is too labor & time intensive for most of us. That said, there are some people making good money still using these tactics, as shady as they may be.
tralarpa 8y ago
This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did is illegal in most developed countries: copyright violation (copying web pages) and monitoring and storing user behavior without their consent (and, even worse, by phishing). It doesn't matter that he did it for a "very brief period of time (for ethical reasons)". LOL. If I tried this kind of stuff where I work, I would have a long unpleasant talk with our legal/ethics department afterwards. I cannot even do a network scan in the Internet without first notifying God and a couple of lesser gods. I am also wondering whether that's good publicity for the author's company. The author is basically saying: "We are doing things without being fully aware (or without caring) of the legal consequences. Are you sure you want to be our customer?".
- dvfjsdhgfv 8y ago
  When you do security work, that's an important part of your job. Sure, in many scenarios like traditional pentesting you can probably do fine within the legal boundaries in most jurisdictions, but as soon as you do serious security research when you actually test your ideas in practice, you're likely to cross the line sooner or later. It's a difference between "it should probably work" and "yes, it worked, I tried it." If you're afraid of the latter, don't get involved in security as you'll get burned sooner than later.
  - tralarpa 8y ago
    > you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who don't care about that. But they usually don't publish their results on a website with their real name.
    - dvfjsdhgfv 8y ago
      I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking their consent.
saintPirelli 8y ago
How does a person get so much flak for hacking - on Hacker News?
- SmellyGeekBoy 8y ago
  I'm not sure if you've noticed, but this isn't actually a website about hacking.
- MetalBuddha 8y ago
  Bunch of white knights. I love a good article about exploits, and I'm grateful to OP for this one.
- wu-ikkyu 8y ago
  Maybe because we're talking about Google? Seems like whenever Google is called into question on HN I've noticed a lot of appeals to authority and people defending them to a fault.
nmstoker 8y ago
What's concerning is that the post author seems not to see the problem with trying to sit on both sides of the fence at once. As others have said, the way this was done is likely to be against numerous laws in most major jurisdictions. If you wish to do this as a PoC then simply put a notice up on the page that initiates it and use dummy "competitor" content, so you've got some semblance of user content/transparency without copyright infringement. That would work just as well for flagging it up as a concern to others. Or if being up-front about it is not the side you are on, do this fully admitting that it's wrong and face any consequences (it doesn't sound like this was the post authors aim, esp given follow up comments). For a "very brief period of time" doesn't cut the mustard here, just as it wouldn't with briefly stealing something from a bank or briefly kidnapping someone (both crimes where one could sometimes argue there may not be permanent damage, although even that likely isn't true in many cases)
- ddalex 8y ago
  The problem I'm seeing is not that the author did something un-ethical (there are plenty black hats out there with no such concerns), but that the content can modify the browser chrome behaviors, and that the users trust the browser chrome a lot more than the content (as it should). As a workaround, I recommend using separate Firefox containers for big sites, as the big sites are the main attack surface of a lot of people. I.e. Firefox containers for Google, Facebook, Microsoft. This attack would be stopped by using a Google container as the back button will not work once you step out of the container to go to the result page. Sure, it won't help you on a targeted attack, but will help a lot with this kind of drag-net attack.
  - lysium 8y ago
    I don’t think your proposed workaround would help. The user stays on the malicious domain. Unless your container is clearly marked visually, only the url shows the savvy user that something is off.
- sigi45 8y ago
  Not sure what you read, i read about a guy who was aware of it and handled it good enough.
Syzygies 8y ago
The big issue here is: Who does our browser work for? People worry that self-driving cars will take us to "promoted" coffee, if we're not specific. More generally, software agents as a rule are loyal to their creators, not to us. That we put up with this is absurd. Browsers should be intelligent agents that are entirely loyal to the person browsing. For example, no site should be able to tell whether we see ads or not. As one site-by-site option, process the ads exactly as if they're reaching our senses, but don't actually render them so they reach our senses. Not even having a back button loyal to us? That's obscene. Copyright infringement is the MacGuffin in this movie; the real story is that we're wusses for having totally lost this balance of power struggle in our personal software.
- prepend 8y ago
  OSS is our best bet because the users can be the creators. Firefox is a mixed bag on this. What I want is like the equivalent of fiduciary duty [0] but for AI and software. This is why I don’t like the idea of “free” agents driven by ad revenue. Currently I have to manually review and build my own stuff. Not sustainable. [0] https://en.wikipedia.org/wiki/Fiduciary https://en.wikipedia.org/wiki/Fiduciary
deleted 8y ago
[deleted]
davidsergey 8y ago
Wow. A) You are a creep. B) However thanks for sharing this. C) I'm not sure if you shared this for google to fix, or to brag about it - so still a creep. D) Next time just apply for a bounty. E) Creep.
- sctb 8y ago
  We ban accounts that post like this so please stop and read the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
nkozyra 8y ago
I don't understand why you would have been expected to report this to Google. It's not an issue or bug with Google, it's a simple gray hat social engineering trick. People linking to fake sites as a dark pattern is nothing novel, you just did so too capture analytics instead of, say, installing a virus or taking someone's credentials. That said, you certainly could have done the latter and gotten views into your competitors' user portals. In my head that's not fundamentally different or more unethical from what you ended up doing. I don't necessarily begrudge you for trying it, but I don't think it's for a noble reason nor do I think it was particularly innovative and the end result is Google doing something unsurprising.
- UncleMeat 8y ago
  The expectation isnt to report to Google. The expectation is to not do this on live sites affecting real people.
  - nkozyra 8y ago
    the reference is to text in the article, not comments from HN. From the second paragraph: > Many are suggesting the right way is to approach Google directly with security flaws like this instead of writing about it publicly.
GedByrne 8y ago
I’d like to defend this guy. What he is doing is testing the trust mechanism. If he went to Google and said ‘I think the trust mechanism is broken’ Google would say: ‘We know, that’s why we are pushing to move everyone to https.’ ‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ ‘We don’t agree with that. Where’s your data?’ Google wouldn’t have accepted this. They have pushed full HTTPS hard, and suggesting that it has a negative consequence is unacceptable to them. His experiment has proven the problem. How else could it have been demonstrated? Ideally this would have been a large scale study done by academics. But this guy doesn’t have those resources. Nobody is going to fund this research. The depressing thing here is that everybody is more interested in calling this guy a jerk than dealing with the issues he has raised. Trust on the internet is broken. This guy did it with ease. Imagine what is being done by those who want to scam millions? But yeh, call him a jerk and then you can bury your unease beneath a big pile of outrage. It’s fine. Fine. He’s a jerk.
- chmike 8y ago
  It looks indeed like "The Emperor's New Clothes" story of Anderson [https://en.m.wikipedia.org/wiki/The_Emperor%27s_New_Clothes https://en.m.wikipedia.org/wiki/The_Emperor%27s_New_Clothes].
- Klathmon 8y ago
  So you are implying that HTTPS made this attack easier or more impactful? I don't buy it. This same attack would work the same with or without HTTPS having existed, and the only reason it wouldn't work as well in practice is because HTTPS is a baseline of security. It's like saying that airbags cause people to trust unsafe cars. An HTTP only site is a red flag now, but HTTPS just means it won't be instantly considered untrustworthy. HTTPS has massive benefits, and Google is already starting to "deprecate" the green padlock (IIRCthey have plans for HTTPS to be "normal" with no green padlock and HTTP to be marked as "unsafe").
  - palotasb 8y ago
    There is a similar debate about making wearing bicycle helmets mandatory. [1] One problem is basically that with cyclists wearing helmets, they and drivers around them might think that smaller safety margins are necessary. (Both physically as drivers drive closer to them and e.g., cyclists more likely to drive at unsafe speeds.) I think the argument here is the same: the green padlock makes people feel too safe. I could easily buy an argument that if HTTPS was not highlighted prominently as a SAFE thing by the browser, people would pay more attention to other indicators such as the domain when browsing the internet. [1] https://discerningcyclist.com/2018/05/mandatory-bicycle-helmets-laws-dont-make-cyclists-safer/ https://discerningcyclist.com/2018/05/mandatory-bicycle-helm...
nothrabannosir 8y ago
For context: Firefox greys out anything that is not the "real" domain, which remains black. So: google.com.fakesite.io/foobar becomes: (grey "google.com.")(black "fakesite.com")(grey "/foobar") This makes it at least a little more obvious you're not on Google. Although that's still a tricky one for non technical users to protect against. Aside from EV, I can't immediately think of anything else a browser could systematically do to guard against this, to be honest. Blacklists etc, but that's very unsatisfying. It's a pretty old problem, to be fair. I remember almost being phished this way myself back on Myspace, were it not for Firefox's blacklists catching the form submission. Domain names being little endian has been one of the most expensive web sec mistakes in history.
- Invictus0 8y ago
  > Domain names being little endian has been one of the most expensive web sec mistakes in history. Can you clarify what you mean by this?
  - SquareWheel 8y ago
    Presumably that authority works from right-to-left. .com, then domain, then subdomain. It would be easier to gauge trust if it were left-to-right.
    - Invictus0 8y ago
      Ah I see, thank you.
- test1235 8y ago
  just to illustrate: https://i.imgur.com/gzdStyw.png https://i.imgur.com/gzdStyw.png
- mrguyorama 8y ago
  I never noticed this but now that you point it out it's really nifty!
bo1024 8y ago
And people still think javascript is a good idea...
megous 8y ago
Is this kind of blatant censorship, where Google delists information it doesn't like common? It's not like the experiment was ongoing, is it.
Zalastax 8y ago
> I had this implemented for a very brief period of time (for ethical reasons) and then moved to one of my disposable domains where it still runs after five years and ranks really well, though for completely different search terms. Am I reading this correctly? He's been doing this since 2013 and still wants to use the white hat card?
- Zalastax 8y ago
  Instead of downvoting I'd love if you could reply instead...
chatmasta 8y ago
Somewhat related, Google AMP is also destroying the ability for users to trust URLs. In fact it’s kind of the inverse problem; the URL bar says google.com when the user expects to be on another website. I wouldn’t be surprised if observing the AMP pattern subconsciously made users less suspicious of the trick in OP. It’s also a bit rich to see all the outrage here and deranking by google, since hijacking/proxying to sites in search results is exactly what AMP does.
- digitaLandscape 8y ago
- joshuamorton 8y ago
  As far as I know, site owners essentially have to opt-in to AMP by restricting themselves to a subset of not-exactly-standard web design methods (and may need to explicitly opt-in, I forget). So I don't see a way to call AMP hijacking, since its done with developer permission.
  - technion 8y ago
    My blog was built when AMP was new and looked cool. It was done with my permission - but the content was not vetted by Google in any way. People have told me they asked Google to take down my blog, because they thought it was hosted there.
- cheeze 8y ago
  Wouldn't be a hn thread without someone mentioning how AMP is literally the worst thing ever.
gcb0 8y ago
fun fact: you can do the same thing again, but use the AMP version and call yourself an amp-provider, just like google does. technically they wont be able to complain because you can say providing amp content assumes they want to be served by you, and you can fiddle as much as you want (e.g. adding tracking code) just like google does when it serves someone else content as amp.
wu-ikkyu 8y ago
Will Google be pushing out a fix for this vulnerability?
danvoell 8y ago
Interesting hack. Sorry about the whole google de-indexing thing. My question would be, did you really gain any useful insights? From competitors, you can normally figure out which page is their most viewed and then figure out how they merchandise it on their homepage. Without "hacking" it.
Ajedi32 8y ago
Surprisingly few comments about the actual attack mechanism here. IMO discussion of whether the author's PoC was ethical is interesting but far less important than the question about how to handle the actual vulnerability; this kind of attack could be used for far more damaging things than just recording user behavior. (Such as phishing.) IMO "get rid of the browser history API" (as the article author recommends) isn't the right solution. The history API is important, as it's the only way to make the back button work as expected in single-page applications, or in multi-page applications that don't trigger a full page reload when you click a link. Rather, I'd suggest the following mitigations: 1. Require a user gesture for `History#pushState` and `History#replaceState` 2. Follow Firefox's example and highlight the most important part of the domain name in the browser UI 3. Don't label HTTPS sites as "Secure", as this can be misleading (Chrome's planning to do this starting next month https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html https://blog.chromium.org/2018/05/evolving-chromes-security-... ) 4. Give the back button a different icon when it's taking you to a different domain (maybe "Up" instead of "Back"?) Any other ideas?
- memory_grep 8y ago
  Those are great ideas. Would love to see those implemented in Chrome.
- yashap 8y ago
  Another possibility - if the referring page is a different domain, overriding back is ineffective (the browser just does a “real” back in these cases).
  - Ajedi32 8y ago
    I don't understand. Are you suggesting that if you arrive at a site from Google, the history API should just not work? For example, let's say a user arrives at a single-page application from Google, and clicks a link on that page to get more information. The site adds a history entry with pushState, but doesn't reload the entire page. Are you saying that in this case, when the user clicks back they should get sent back to Google instead of to the site's home page? If so, that seems like rather unexpected behavior. And if not, isn't the attack still viable?
gus_massa 8y ago
I just realized that it is not necessary to hijack the back button! 1) Watch out for users coming from Google (or Bing) using the referrer field. 2) Choose randomly In 5% of them are redirect them to your shady domain using a temporal 303 redirect. [If Google notice this, they will hate you.] 3) Host a copy of your competitors page in the shady domain, with all the tracking enabled. [This is illegal! You may get a lawyer C&D, nastygram or more.] I guess that when the user finds your site in Google and click the link, they will most of the time not be sure of with link they choose, so they will not notice the change. And if they realize that they went to the wrong site, they will click the back button and click the search result again, and get the normal page like the 95% of the people. This is probably more credible if the search field in the referrer doesn't have your site in it, so the user is looking for any generic site that includes you and your competitors. As I said before, this is shady and some parts are illegal, so don't do it. Google may demote your site, and also you can get some legal problems.
slim 8y ago
Bonus : you steal some ranking clout from competitor since they don't get that precious click on Google search results
tabtab 8y ago
If Chrome outright disables JavaScript's ability to alter the "Back" path, it may brake some (poorly designed) applications. A compromise is to prompt with a warning.
- jstarfish 8y ago
  Break them then, with no warning. Letting Javascript trump browser controls (or spam confirmation popups) is a problem that never should have been allowed to live beyond the 90s.
  - tabtab 8y ago
    But changing the behavior suddenly can make existing applications outright not function. That results in angry customers. A prompt is a decent compromise. Example prompt: "This website has altered the web address of the Back button. This can be risky. Do you want to use the application's version of the web address, or the original address? [Altered address, Original address, Cancel 'Back', More-info]"
jhoh 8y ago
That huge fixed navbar on mobile is just horrbile. Can't read the article because of it.
sattoshi 8y ago
Just remove the push state history api. Set state is fine. Push state is totally unnecessary since we already had a technology for this: anchors! Instead of site.com/my/page, it's site.com/#/my/page. What is wrong with this? It does literally everything you need and is supported by most routers out of the box!

766 points by lukestevens 8y ago

This is an interesting yet disturbing case of blackhat SEO and phishing, where the site owner hijacks the back button and sends visitors to fake sites where he can observe their behaviour. FTA: Here’s what I did: 1. User lands on my page (referrer: google) 2. When they hit “back” button in Chrome, JS sends them to my copy of SERP 3. Click on any competitor takes them to my mirror of competitor’s site (noindex) 4. Now I generate heatmaps, scrollmaps, records screen interactions and typing.

mrob 8y ago
Yet another reason to browse with JS disabled by default.
- confiscate 8y ago
  really? That seems extreme. Might as well say: "Yet another reason to not browse anything on the web"
  - LeoPanthera 8y ago
    It's a shame you're being downvoted, you're entirely correct. Most of the modern web is unusable with javascript disabled.
    - Nadya 8y ago
      >Most of the modern web is unusable with javascript disabled This isn't wrong - but it assumes most of the modern web is worth using. Most of the modern web isn't worth browsing, and every site I've ever come across that is worth reading works just fine without Javascript. I'll continue to browse the internet with Javascript disabled-by-default. It's a surprisingly good filter. With that being said - while this is "another reason" it is as minor of a reason as it gets...
      - A2017U1 8y ago
        > assumes most of the modern web is worth using But it is, are you really going to ignore reading some huge breakthrough in physics because the site uses react? Also in many situations there's absolutely no other choice. Government sites, e-stores, banking. And then there's the buildup of recorded urls. Private browsing is somewhat less useful when your scipt blocker whitelist is full of porn sites. I use it for security in specific browsers but happily admit it's not an actual solution for normal people. Adding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use.
        dorgo 8y ago
        >dding another 3 clicks, then another 2 for the inline JavaScript contained within after reload makes the internet incredibly annoying to use. Yes, it is annoying. It reminds me each time how annoying websites are which use Javascript for things which could be done without. And it lets me search for alternatives or just abandon such websites.
        rauhl 8y ago
        > how annoying websites are which use Javascript for things which could be done without A good example of sites which use JavaScript for things they don’t really need are those GP mentions: ‘government sites, e-stores, banking.’ Government sites: the vast majority of government sites are simply informative text. There’s absolutely no need for me to grant the government permission execute code on my computer (which is what JavaScript does) in order to read the minutes of the latest council meeting. Even when interactivity is needed (e.g. an online tax-payment system), HTML forms (the sort we’ve had for over two decades) are a perfectly good solution for ‘enter information in a box and submit it.’ JavaScript can definitely lead to more attractive, more usable solutions — but it’s completely optional. Government sites are a great example of something which should work for anyone, even someone using an old BeOS box on the other end of a modem connexion running over a bit of wet string. E-stores: there’s simply no need for JavaScript to display pictures & descriptive text of goods in an attractive fashion. There’s simply no need for JavaScript to give me a form to enter my credit card information & mailing address. Again, JavaScript can make the experience better, but it is also a privacy and security risk. I seem to recall that Amazon made quite a lot of money before JavaScript was a thing; I imagine it could continue to do so. Banking: there’s no need for my bank to execute code on my computer to send me a statement of my accounts, nor to give me a form to pay bills or send money. Indeed, in my experience JavaScript just makes things worse, because instead of downloading a single HTML document from my bank’s servers I get to download dozens of trackers and bugs, as well as the code necessary to hit multiple APIs and stitch the page together out of its parts on my own desktop. I think I read something yesterday, here or elsewhere, about how client-side JavaScript really took off at the same time as server-side Ruby was a big thing, with the implication that the reason was that Ruby was so slow that websites had to offload as much computation as possible. I don’t know, now, if that was actually the case, but I do know that it’s 2018 and my desktop experience is slower than it was in 1998, thanks to JavaScript.
    - mrob 8y ago
      Many modern web pages work better with Javascript disabled now, because it avoids the GDPR/cookie popup spam.
      - confiscate 8y ago
        fun fact Not browsing the web at all, also avoids the GDPR/cookie popup spam. That solution works 100% of the time. It blocks out 100% of the GDPR popup spam.
  - gear54rus 8y ago
    Lol. Downvoted for pointing out fanaticism. Why don't you guys remove all executables from your PCs too? Shouldn't PCs be just a glorified typing machine?
  - blitmap 8y ago
    The thing that concerns me is it's easy to wrap a JS API or unreference it if I know it's abused for ads/tracking. I don't know of good ways to go about tracking based on pointer events or scrolling. I'd put more research into generating fake events or limiting them for an untrusted site, so mouse behavior can't be used for "where are they looking" analysis.
- caspervonb 8y ago
  I wish... even GitHub won't work properly without JavaScript enabled these days.
  - Deimorz 8y ago
    Completely disabling Javascript isn't feasible, but you can use uMatrix or NoScript with all scripts blocked by default, and only whitelist ones on sites/domains that you trust.
    - interfixus 8y ago
      Exactly. I've been browsing script-free for twenty years. It used to be a real pain switching on and off, until Opera introduced easy by-site settings. But then, back in the day most sites were perfectly servicable without any scripting whatsoever. And these days, uMatrix makes it all a snap.
  - jwilk 8y ago
    IME, most parts of GitHub work fine without JS enabled. (Though sometimes I have to disable CSS to get my hands on some forms…) This is unlike major competitors (GitLab, Bitbucket), which are completely broken.
    - btasovac 8y ago
      Hello everyone, GitLabber here! We had a similar issue about this [1], and we raised another one when deciding to further clarify our documentation regarding this question [2]. You can find out more about our motives behind this decision there. [1] - here https://gitlab.com/gitlab-org/gitlab-ce/issues/36754 https://gitlab.com/gitlab-org/gitlab-ce/issues/36754 [2] - https://gitlab.com/gitlab-org/gitlab-ce/issues/43436 https://gitlab.com/gitlab-org/gitlab-ce/issues/43436
      - jwilk 8y ago
        Ironically, you have to enable JS to see comments for these issues…
- wiether 8y ago
  In that case, just not using useless thing like "back" button will be perfectly fine. A good website don't need using this button. And to navigate between websites, using a tab for each website is fine. Especially when comparing results from Google.
  - rawTruthHurts 8y ago
    I agree. User experience is so overrated these day, right?
  - azeirah 8y ago
    ... Don't use the back button? What? I actually kind of like the ability to move between pages and domains with the back button.
    - wiether 8y ago
      A good website give you the ability to move without this button. It's like Android VS iOS. The first one has a back button, the other don't.
      - deleted 8y ago
        [deleted]
      - LyndsySimon 8y ago
        > A good website give you the ability to move without this button. I disagree, fairly strongly. Re-implementing behavior that the user already has in their client is at best superfluous, and at worst very confusing. > It's like Android VS iOS. The first one has a back button, the other don't. iOS apps implement history as part of their UI because iOS doesn't have provision for one in the default UI. This is changing, as gestures become more and more common. I don't think I've actually used a "back button" on my iPhone in months. I pretty much take its presence as communicating that it's possible to go back, not as a means to do so.
- King-Aaron 8y ago
  That's a reasonable course of action until you need to use the internet for pretty much anything.
  - JdeBP 8y ago
    Experience teaches that that is a vastly exaggerated statement. There remains quite a lot of the World Wide Web that does not require Javascript. And of course it is pretty much not required at all for using the Internet outwith the World Wide Web.
    - kmbriedis 8y ago
      And then classic React enters the building
  - adrianN 8y ago
    Works pretty well for me.
  - eadmund 8y ago
    The Internet works just fine without JavaScript: DNS, FTP, SSH, SMTP, NNTP — none of them have ever required JavaScript. Indeed, HTTP works just fine without JavaScript. HTTP pages perform better without it. Granted, many broken and ill-programmed HTTP pages aren't useful without JavaScript. That's no an indication of how useful it is, but rather an indication of how poorly-skilled those webmasters are. Then there are web apps; they indeed don't work properly without JavaScript. Fortunately, there just aren't that many important web apps. To be honest, I can't think of one web app that I regularly use, other than Google Meet.
    - EdwardDiego 8y ago
      Your distinction between web pages and web apps is entirely arbitrary. Many web pages use JS in such a way that interacting with them without JS is a lesser, if not broken, experience.
      - 8y ago
- dwild 8y ago
  Yeah I know, personally I prefer to use paper, way safer. I plan to just do the full TCP request by hand using the ethernet wire, morse-code-like, next./s Sure increasing the functionalities increase the risk, it doesn't means the risk isn't worth it or isn't mitigable. Worst case, he fake your back button.. it's not that bad seriously. Google will probably try back buttons and different similar situation now on their engine and deal with theses cases one by one.
snaky 8y ago
> noindex So, the browser extension indicating (with big red fonts) that this site is noindex could be a simplest solution? For not power users who don't know about any extensions that would be not so easy though. If that function will appear in Chrome enabled by default, that would raise questions about Google motives, obviously.
- dorgo 8y ago
  I think noindex is nice to have but not neccessary for this trick. The only solution is to fix the back-button bug/vulnerability in Chrome.
  - baddox 8y ago
    It doesn’t seem like there is a fix, short of removing the history API.
    - dorgo 8y ago
      Maybe restrict the history API to the same-origin-policy? Javascript could/should be allowed to manipulate browser-history only for the same domain. Just an idea.
      - SmellyGeekBoy 8y ago
        Why should anything be able to change the behaviour of the back button? If I click back it should take me back to the previous URL. If it breaks your one page 200MB JavaScript masterpiece then tough luck, come up with your own navigation.
        brlewis 8y ago
        Suppose we did what you said, and the back button only ever took you back to the previous URL. I could still make a JS app that, on your first interaction with the page, moved you forward from https://example.com/ https://example.com/ to https://example.com/#home https://example.com/#home. Then it sets a variable such that when you go back to https://example.com/ https://example.com/ it shows a fake SERP. This is not an easy problem to solve.
laumars 8y ago
I'm curious how many visitors did this. In my very limited sample set of myself and friends / work colleagues, we all use middle click to open a result in a new tab.
- oblio 8y ago
  The vast majority of regular users I've seen go back and forth between search and search results. Heck, I do it from time to time. Most users are extremely "inefficient" by geek standards.
  - laumars 8y ago
    Interesting. Thanks for that. Sometimes we can get so caught up in our own tech-bubble that we don't really notice the usage patterns of the average user. So it's often nice to have a reminder like this.
  - donkeyd 8y ago
    > Most users are extremely "inefficient" by geek standards. How is that inefficient? I use both interchangeably and I don't see how it's any less efficient than opening a new tab and then having to close it if it's not what you want, or having to close useless tabs if the first one is all you need... On my Macbook, I just swipe right and I'm back at the search results.
    - drcoopster 8y ago
      You assume you're back at the search results. As OP proved that's not necessarily the case.
    - oblio 8y ago
      For a lot of things it helps to compare things in parallel. With this technique you only see 1 result at a time.
- SmellyGeekBoy 8y ago
  I'm not sure my parents are even aware of the existence of tabs, to be honest.

glandium 8y ago

One more reason to kill the referer HTTP header, I guess.

yborg 8y ago
https://github.com/meh/smart-referer https://github.com/meh/smart-referer

moltar 8y ago

That’s genius

caffeinated_me 8y ago

This seems to have some fairly scary security implications if used maliciously, but I can't think of a good way to protect against this. Does anyone know of a browser extension to limit access to the history API?

nerdponx 8y ago
In my mind, not giving the user opt-in control over this setting is a bug in the browser.
htgb 8y ago
I started using NoScript a while back, just to see what the web is like without Javascript. My plan was to uninstall it when it got too annoying, but to my surprise it's actually not bad at all. I'm quite lax in whitelisting domains I actually trust, but even then it's nice that it doesn't load Javascript from all other umpteen domains, which is often the case. Of course it's a very blunt weapon for blocking abuse like what's described in this blog post, but for sure it works.

encoderer 8y ago

Disturbing, fascinating, obvious in hindsight. Here’s another angle: a “bounce” back to google too quick is a negative ranking signal. By keeping them from going back to google by making them think they in fact did makes this also black hat seo.

lallysingh 8y ago
But Google doesn't see the bounce back. The site bounces back to a copy of Google's result page.
- Semaphor 8y ago
  That's what they said.
- hokoto 8y ago
  That's the point: Google doesn't see the bounce back, so you won't be negatively affected.
- bagels 8y ago
  That is what the parent comment points out. He benefits from the fact that users can't return to google.
brador 8y ago
The slashdot trick. Still works and is actively used right now.
- thecatspaw 8y ago
  what exactly is the slashdot trick?

hw_penfold 8y ago

In many ways this is malicious deception. In any instance where a login form is included in the scraped mirror, that represents an attacked user, and a phishing attempt. If someone did this in the wild, in an uncontrolled situation involving random strangers, it risks serious misinterpretation, and worse.

bhelkey 8y ago
> I had this implemented for a very brief period of time (and for ethical reasons took it down almost immediately, realising that this may cause trouble) The author did this in the wild, involving random strangers.

aquarin 8y ago

It seems my habbit to open google links in new tabs with right click have more meaning now. I initialy used this to avoid referal information.

deleted 8y ago
[deleted]
kristianp 8y ago
That's not going to stop the referrer from being available to the page. In chrome hit F12 and in the console type document.referrer.
wiether 8y ago
Doesn't change the referer but avoid you falling in that current trap. Anyway, using a new tab for each new website you visit is the way to go I think.
- rellui 8y ago
  Maybe it's a good trade off for this to become default behavior in browsers (in the background unseen by users).
  - dennisgorelik 8y ago
    If user does not see that she is operating in a new tab, she can still click "back" and would still be vulnerable to the "Fake Google Serp" trick.
jsjohnst 8y ago
Google even has a settings options where all SERP links open in a new tab. I personally use it myself.

yjftsjthsd-h 8y ago

I'm surprised he's willing to put his real name to this. I can't immediately see that it's actually illegal, but it still screams red flag for unethical behavior.

adtac 8y ago
Not just his name, his whole company even!

nsmog767 8y ago

This is easy to hate on, and certainly ethically dubious....but man do I love it.

p1necone 8y ago
My thoughts exactly. This guy is an asshole, but man do I love a clever hack.
- dejanseo 8y ago
  Hey, that's not very nice.
  - deleted 8y ago
    [deleted]

paulryanrogers 8y ago

Why do browsers allow changing the back button history before the visitor arrived at the domain? Seems like a subtle cross origin attack if that is truly what's happening.

lathiat 8y ago
I can imagine you could work around that issue just by once redirecting onto your own site first. On the surface, sounds like a difficult problem to solve safely. On a related note, I often have the back button not work because I hit back and chrome cached a redirect to some other page and it immediately redirects again before i can even spam back again. Need to long press back to get a longer history to go back further. This is a really interesting "attack" to see.
- lathiat 8y ago
  This is interesting knowledge: https://smerity.com/articles/2013/where_did_all_the_http_referrers_go.html https://smerity.com/articles/2013/where_did_all_the_http_ref...
tobyhinloopen 8y ago
Easy, just push multiple history items.
makomk 8y ago
Most people are just going to hit back until it looks like they're at the right site, so I don't think you'd have to change the previous history, just add your own entry after the one for the site they came from.
- paulryanrogers 8y ago
  That would require storing where they came from as well as waiting for--or forcing--them to visit at least one more page on the attacker's site. So it'd still make backjacking harder. Maybe pages that immediately redirect on first arrival should also not count toward back history. Now a more perfect solution would require browsers snapshot where the user cane from then block or warn about pages at the destination that look too similar. Though that seems unnecessarily complex for most users.

shruubi 8y ago

Honestly, it doesn't shock me in the slightest that someone who markets themselves as an SEO expert would not only do something as unethical as this, but also brag about it, as though they think they've done something they should be proud of.

cyrusshepard 8y ago
FWIW, Dan (the author) has an outstanding reputation for professionalism and integrity in the marketing world. If he says he did something for ethical reasons, to those who know him, he's earned the benefit to be believed. (If you don't know him, you'd be forgiven for being suspicious) And credit should be given to him for educating everyone on this exploit.
- dejanseo 8y ago
  Thank you Cyrus. I thought it would be obvious that this isn't a practical tactic a reputable brand could risk doing.
  - jimbauwens 8y ago
    While it is clear that you did not have any bad intentions, you should never have published it on the web. Based on your earlier comment "It worked a little too well" it becomes clear that multiple users were tricked by your site and that you possibly even intercepted submitted forms ("I gasped when I realised I can actually capture all form submissions and send them to my own email."). You misled people and breached their privacy. This is as simple as it gets, even if it was for an experiment (though leaving the site online in some other form still raises a lot of question marks..). My advice for you is to perform future experiments locally, not on the web and make sure people participating in your experiment are aware.
    - iscoelho 8y ago
      The point of the experiment was the social engineering aspect. The fact that it would work technologically was obvious. The fact that it would work practically was what he set out to prove.

pasta 8y ago

Presenting yourself as someone else is called fraud in my book. Changing the back button might be clever but all the rest is just simple. But people don't do this because I think in a lot of countries this is illigal. There is a way you can protect your site a little from this: add canonical tags to all your pages. When an attacker updates the back button to Google they will have a hard time getting the cloned pages up in the results.

cm2012 8y ago
In this case he NoIndexed the clone pages anyway.

jeswin 8y ago

A couple of years back I was talking to someone who did SEO for a popular education network. The company was spending millions of dollars every month on SEO and advertising. Their module operandi went like this: 1. Offer money to license or buy a smaller competitor's content 2. If that doesn't work, crawl and clone the site 3. Pump a lot of money into Google Ads, so that the cloned site now appears as an ad above the legitimate site. Google makes such scam easier now by making the ads look like organic results - a non technical user would hardly notice. 4. The legitimate site just dies. I was asked to build a tool which crawls sites, which I refused. But I learned how professional SEO works.

graeme 8y ago
This is somewhat risky, no? It's a clear case of copyright theft, and would be trivial to sue unless they hit everything behind cutouts to the extent they weren't traceable. One would think the owner of the cloned site would notice lower traffic, search, and notice the ad scam. This strategy sounds like it would take months to execute before the competing site died, if not longer. Am I missing something? I've read lots of seo scams that seem very hard to undo. This one seems....slow, very avoidable, with large legal and reputational risks for the perpetrator.
- baddox 8y ago
  It’s never trivial to sue.
  - graeme 8y ago
    No, but in a case with a clear paper trail it wouldn't be hard to send a very clearly worded cease and desist showing exactly what damages are expected and how easy it is to prove. Depending on the size of the company would also be possible to raise a big PR fuss, get on top of Hacker News, etc. Plus there is DMCA takedown, google's tools, etc. Those are trivial to use.
iKevinShah 8y ago
This is on the same level (IMO) like when Site A pays SEO company to make SITE B appear as SPAM (usually by spamming SITE B's links on commenting systems with some vague texts). Had read this on discussion forums a lot when "Scrapebox" and the likes were used (2010-12ish)

3eto 8y ago

> Record actual sessions (mouse movement, clicks, typing) > I gasped when I realised I can actually capture all form submissions and send them to my own email. How many bad actors have been doing the same and for how long? This doesn't sound like something Google should just brush under the carpet and expect no one else is doing it. Although I wish the author had reached out to Google first to see how they would have handled it, I thank him for publishing it.

dejanseo 8y ago
You're welcome.

digitalboss 8y ago

Update from site "Google’s team has tracked down my test site, most likely using the source code I shared and de-indexed the whole domain."

londons_explore 8y ago
They don't up/down ranking individual sites for stuff like this. They've probably implemented back-hijack detection for the whole web
- lozenge 8y ago
  They didn't down rank it, they delisted it just like they would delist child porn or copyright material after receiving a dmca notice
- Gustomaximus 8y ago
  I've read otherwise but couldn't find anything with a couple min free time. Anyone else read/know about this?
- dejanseo 8y ago
  That would be marvellous.
- solarkraft 8y ago
  They de-indexed the domain. I think they do do this on an individual basis from time to time, especially with sites distributing (links to) illegally obtained content.
- dejanseo 8y ago
  I just added a screenshot from search console: https://dejanseo.com.au/competitor-hack/ https://dejanseo.com.au/competitor-hack/ There's no manual penalty notice.

jackgolding 8y ago

I've seen Dejan speak and I'd recommend following his work because he does very interesting black hat things like this in SEO. He has so many out of the box ideas like this which are brilliant.

everydaypanos 8y ago

1 Years years ago when I was learning web development I bought a TLD and just copy-pasted Amazon’s log in page to just check how it works. Amazon somehow found out about this and Google punished that TLD after that incident and it just couldn’t go up in rankings after that. If I remember correctly they had even put that TLD on sites that report/list “phishing” sites so if you Googled about that TLD you would also get the “they are fraud” results. 2 I think that most pro users just New-Tab everything and go from there. Seems to me that going in n out search results all in one tab is kind of slow too.

scottybowl 8y ago
Pretty simple to find out by logging the referring site that is requesting assets from your server. I used to do this all the time about a decade ago when it was common practice to steal entire site designs. My favourite moment was when we changed a picture that someone was hot linking to as part of their own website and they emailed us with a rant saying "how dare you change the image"
pawal 8y ago
You bought a TLD when learning web development? That seems extreme.
- gammatrigono 8y ago
  This must be sarcasm.
  - trowway21 8y ago
    This is certainly sarcasm.
    - solarkraft 8y ago
      Yesterday I was learning about processors, so I bought a foundry. Doesn't everyone do this?

thedonkeycometh 8y ago

This is man in the middle, and illegal anyway under a multitude of US and international computer misuse laws. What is with people doing illegal stuff and questioning whether its actually illegal because they didn't get caught? Is this post truth? And I'm not crying a tear because he got delisted, should be prosecuted for doing it on live sites and I truly hope his "competitors" (victims) sue.

dejanseo 8y ago

Hi everyone! I did this. It was just a random cool idea I wanted to try. It worked a little too well and I quickly moved it to a disposable site to test if the page will get penalised by Google. I got busy with other things and forgot about it. When I bumped into it again I decided to write about it, for two reasons: 1) To me it's hard to believe that Chrome would allow for this to happen in the first place and 2) that Google wouldn't penalise a site doing this. Well, since the story was published Google tracked down my test page (most likely by using the source code I revealed on my blog) and completely de-indexed the whole domain.

pakitan 8y ago
Is Chrome the only browser this trick worked on?
TekMol 8y ago
Copying someone elses site and tricking their users to use your copy is a copyright violation and fraud. Nothing cool about it.
- mosselman 8y ago
  Your statement is far too broad and lacks context. Where is this a violation and where is it considered fraud? There must be some countries where this isn't the case or at least where the article and non-commercial use of the technique are considered to be mitigating circumstances. Also, who doesn't find it cool? You don't seem to be saying that what is described in the article isn't cool, you seem to be making a broader claim that copyright violation and fraud aren't cool. Lets assume you find what is described in this article copyright violation and fraud, because after all, you said it is. Apparently some people on HN find what the author has done cool, judging by the comments. Ergo, some things that you, specifically, consider 'copyright violation and fraud' are in fact cool.
  - fabricexpert 8y ago
    He copied Google's SERP page, AND copied all of his competitors websites. That's definitely copyright infringement, you'd be livid if you were a competitor, and as a user you'd be pretty annoyed. It's still an interesting hack, so good to see it being talked about. But it is not ethical and definitely illegal in almost any jurisdiction.

WTFWORLD 8y ago

I see some Dickheads commenting against Dejan. He is so smart, fuck all other cunts who can't even rank a simple site. We all do black, nothing is white in this world. Everything needs tricks, you can't do all white way.

mixedbit 8y ago

Long time ago I wrote about this technique: http://mixedbit.org/referer.html http://mixedbit.org/referer.html Besides back button navigation, I also had ideas to use a fake malware warning or just take a victim directly to fake search engine results.

markdown 8y ago

While we're on this topic, I have a related situation and wonder if my case is common: I built a brochure site for a mom-and-pop business a decade ago. The domain expired some time ago, and it was snapped up by someone who repopulated it with the original content scraped from the Internet Archive. It looks and behaves exactly like it did when I controlled it, except that a phrase in the frontpage content now links to some supplement sale site. Is there a name for this SEO bullshitery? What can someone do who isn't American and who therefore can't file a DMCA.

brosirmandude 8y ago
Sounds like that old site got bought by someone building a PBN (Private Blog Network). They buy old domains, get the old content from archive.org, and then add a link in somewhere to their "money" site, or to another site in their tiered linking structure. It's a BS tactic that can sometimes still work, but it's a LOT of effort to really keep up with it. TBH it's much easier to just actually make a site people want to use and reach out to people who might be interested in sharing it. Hosting/managing 100's of sites just to prop up 1-2 money sites is too labor & time intensive for most of us. That said, there are some people making good money still using these tactics, as shady as they may be.

tralarpa 8y ago

This is really a good example why it is so difficult for security experts to do research and experiments where real users are involved. What Mr. Petrovic did is illegal in most developed countries: copyright violation (copying web pages) and monitoring and storing user behavior without their consent (and, even worse, by phishing). It doesn't matter that he did it for a "very brief period of time (for ethical reasons)". LOL. If I tried this kind of stuff where I work, I would have a long unpleasant talk with our legal/ethics department afterwards. I cannot even do a network scan in the Internet without first notifying God and a couple of lesser gods. I am also wondering whether that's good publicity for the author's company. The author is basically saying: "We are doing things without being fully aware (or without caring) of the legal consequences. Are you sure you want to be our customer?".

dvfjsdhgfv 8y ago
When you do security work, that's an important part of your job. Sure, in many scenarios like traditional pentesting you can probably do fine within the legal boundaries in most jurisdictions, but as soon as you do serious security research when you actually test your ideas in practice, you're likely to cross the line sooner or later. It's a difference between "it should probably work" and "yes, it worked, I tried it." If you're afraid of the latter, don't get involved in security as you'll get burned sooner than later.
- tralarpa 8y ago
  > you're likely to cross the line sooner or later. That's basically the opposite of what security researchers working for companies and research institutes are doing. Document everything, get written consent of involved parties and sometimes even inform the police about a planned action. Make sure that you (a) don't cross the line or (b) move the line legally further away. Of course, there are security experts who don't care about that. But they usually don't publish their results on a website with their real name.
  - dvfjsdhgfv 8y ago
    I'd argue the most interesting and important research is done in this way. It's not that these security experts "don't care", it's just the very nature of certain problems that you need to test them against real users (as opposed to, say, testing an exploit against a system). Consider, for example, honeypot research the very nature of such scenarios is that you can't even hint that users are tracked, let alone asking their consent.

saintPirelli 8y ago

How does a person get so much flak for hacking - on Hacker News?

SmellyGeekBoy 8y ago
I'm not sure if you've noticed, but this isn't actually a website about hacking.
MetalBuddha 8y ago
Bunch of white knights. I love a good article about exploits, and I'm grateful to OP for this one.
wu-ikkyu 8y ago
Maybe because we're talking about Google? Seems like whenever Google is called into question on HN I've noticed a lot of appeals to authority and people defending them to a fault.

nmstoker 8y ago

What's concerning is that the post author seems not to see the problem with trying to sit on both sides of the fence at once. As others have said, the way this was done is likely to be against numerous laws in most major jurisdictions. If you wish to do this as a PoC then simply put a notice up on the page that initiates it and use dummy "competitor" content, so you've got some semblance of user content/transparency without copyright infringement. That would work just as well for flagging it up as a concern to others. Or if being up-front about it is not the side you are on, do this fully admitting that it's wrong and face any consequences (it doesn't sound like this was the post authors aim, esp given follow up comments). For a "very brief period of time" doesn't cut the mustard here, just as it wouldn't with briefly stealing something from a bank or briefly kidnapping someone (both crimes where one could sometimes argue there may not be permanent damage, although even that likely isn't true in many cases)

ddalex 8y ago
The problem I'm seeing is not that the author did something un-ethical (there are plenty black hats out there with no such concerns), but that the content can modify the browser chrome behaviors, and that the users trust the browser chrome a lot more than the content (as it should). As a workaround, I recommend using separate Firefox containers for big sites, as the big sites are the main attack surface of a lot of people. I.e. Firefox containers for Google, Facebook, Microsoft. This attack would be stopped by using a Google container as the back button will not work once you step out of the container to go to the result page. Sure, it won't help you on a targeted attack, but will help a lot with this kind of drag-net attack.
- lysium 8y ago
  I don’t think your proposed workaround would help. The user stays on the malicious domain. Unless your container is clearly marked visually, only the url shows the savvy user that something is off.
sigi45 8y ago
Not sure what you read, i read about a guy who was aware of it and handled it good enough.

Syzygies 8y ago

The big issue here is: Who does our browser work for? People worry that self-driving cars will take us to "promoted" coffee, if we're not specific. More generally, software agents as a rule are loyal to their creators, not to us. That we put up with this is absurd. Browsers should be intelligent agents that are entirely loyal to the person browsing. For example, no site should be able to tell whether we see ads or not. As one site-by-site option, process the ads exactly as if they're reaching our senses, but don't actually render them so they reach our senses. Not even having a back button loyal to us? That's obscene. Copyright infringement is the MacGuffin in this movie; the real story is that we're wusses for having totally lost this balance of power struggle in our personal software.

prepend 8y ago
OSS is our best bet because the users can be the creators. Firefox is a mixed bag on this. What I want is like the equivalent of fiduciary duty [0] but for AI and software. This is why I don’t like the idea of “free” agents driven by ad revenue. Currently I have to manually review and build my own stuff. Not sustainable. [0] https://en.wikipedia.org/wiki/Fiduciary https://en.wikipedia.org/wiki/Fiduciary

deleted 8y ago

[deleted]

davidsergey 8y ago

Wow. A) You are a creep. B) However thanks for sharing this. C) I'm not sure if you shared this for google to fix, or to brag about it - so still a creep. D) Next time just apply for a bounty. E) Creep.

sctb 8y ago
We ban accounts that post like this so please stop and read the guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.

nkozyra 8y ago

I don't understand why you would have been expected to report this to Google. It's not an issue or bug with Google, it's a simple gray hat social engineering trick. People linking to fake sites as a dark pattern is nothing novel, you just did so too capture analytics instead of, say, installing a virus or taking someone's credentials. That said, you certainly could have done the latter and gotten views into your competitors' user portals. In my head that's not fundamentally different or more unethical from what you ended up doing. I don't necessarily begrudge you for trying it, but I don't think it's for a noble reason nor do I think it was particularly innovative and the end result is Google doing something unsurprising.

UncleMeat 8y ago
The expectation isnt to report to Google. The expectation is to not do this on live sites affecting real people.
- nkozyra 8y ago
  the reference is to text in the article, not comments from HN. From the second paragraph: > Many are suggesting the right way is to approach Google directly with security flaws like this instead of writing about it publicly.

GedByrne 8y ago

I’d like to defend this guy. What he is doing is testing the trust mechanism. If he went to Google and said ‘I think the trust mechanism is broken’ Google would say: ‘We know, that’s why we are pushing to move everyone to https.’ ‘That isn’t enough. The padlock on the https page gives users a false sense of security.’ ‘We don’t agree with that. Where’s your data?’ Google wouldn’t have accepted this. They have pushed full HTTPS hard, and suggesting that it has a negative consequence is unacceptable to them. His experiment has proven the problem. How else could it have been demonstrated? Ideally this would have been a large scale study done by academics. But this guy doesn’t have those resources. Nobody is going to fund this research. The depressing thing here is that everybody is more interested in calling this guy a jerk than dealing with the issues he has raised. Trust on the internet is broken. This guy did it with ease. Imagine what is being done by those who want to scam millions? But yeh, call him a jerk and then you can bury your unease beneath a big pile of outrage. It’s fine. Fine. He’s a jerk.

chmike 8y ago
It looks indeed like "The Emperor's New Clothes" story of Anderson [https://en.m.wikipedia.org/wiki/The_Emperor%27s_New_Clothes https://en.m.wikipedia.org/wiki/The_Emperor%27s_New_Clothes].
Klathmon 8y ago
So you are implying that HTTPS made this attack easier or more impactful? I don't buy it. This same attack would work the same with or without HTTPS having existed, and the only reason it wouldn't work as well in practice is because HTTPS is a baseline of security. It's like saying that airbags cause people to trust unsafe cars. An HTTP only site is a red flag now, but HTTPS just means it won't be instantly considered untrustworthy. HTTPS has massive benefits, and Google is already starting to "deprecate" the green padlock (IIRCthey have plans for HTTPS to be "normal" with no green padlock and HTTP to be marked as "unsafe").
- palotasb 8y ago
  There is a similar debate about making wearing bicycle helmets mandatory. [1] One problem is basically that with cyclists wearing helmets, they and drivers around them might think that smaller safety margins are necessary. (Both physically as drivers drive closer to them and e.g., cyclists more likely to drive at unsafe speeds.) I think the argument here is the same: the green padlock makes people feel too safe. I could easily buy an argument that if HTTPS was not highlighted prominently as a SAFE thing by the browser, people would pay more attention to other indicators such as the domain when browsing the internet. [1] https://discerningcyclist.com/2018/05/mandatory-bicycle-helmets-laws-dont-make-cyclists-safer/ https://discerningcyclist.com/2018/05/mandatory-bicycle-helm...

nothrabannosir 8y ago

For context: Firefox greys out anything that is not the "real" domain, which remains black. So: google.com.fakesite.io/foobar becomes: (grey "google.com.")(black "fakesite.com")(grey "/foobar") This makes it at least a little more obvious you're not on Google. Although that's still a tricky one for non technical users to protect against. Aside from EV, I can't immediately think of anything else a browser could systematically do to guard against this, to be honest. Blacklists etc, but that's very unsatisfying. It's a pretty old problem, to be fair. I remember almost being phished this way myself back on Myspace, were it not for Firefox's blacklists catching the form submission. Domain names being little endian has been one of the most expensive web sec mistakes in history.

Invictus0 8y ago
> Domain names being little endian has been one of the most expensive web sec mistakes in history. Can you clarify what you mean by this?
- SquareWheel 8y ago
  Presumably that authority works from right-to-left. .com, then domain, then subdomain. It would be easier to gauge trust if it were left-to-right.
  - Invictus0 8y ago
    Ah I see, thank you.
test1235 8y ago
just to illustrate: https://i.imgur.com/gzdStyw.png https://i.imgur.com/gzdStyw.png
mrguyorama 8y ago
I never noticed this but now that you point it out it's really nifty!

bo1024 8y ago

And people still think javascript is a good idea...

megous 8y ago

Is this kind of blatant censorship, where Google delists information it doesn't like common? It's not like the experiment was ongoing, is it.

Zalastax 8y ago

> I had this implemented for a very brief period of time (for ethical reasons) and then moved to one of my disposable domains where it still runs after five years and ranks really well, though for completely different search terms. Am I reading this correctly? He's been doing this since 2013 and still wants to use the white hat card?

Zalastax 8y ago
Instead of downvoting I'd love if you could reply instead...

chatmasta 8y ago

Somewhat related, Google AMP is also destroying the ability for users to trust URLs. In fact it’s kind of the inverse problem; the URL bar says google.com when the user expects to be on another website. I wouldn’t be surprised if observing the AMP pattern subconsciously made users less suspicious of the trick in OP. It’s also a bit rich to see all the outrage here and deranking by google, since hijacking/proxying to sites in search results is exactly what AMP does.

digitaLandscape 8y ago
joshuamorton 8y ago
As far as I know, site owners essentially have to opt-in to AMP by restricting themselves to a subset of not-exactly-standard web design methods (and may need to explicitly opt-in, I forget). So I don't see a way to call AMP hijacking, since its done with developer permission.
- technion 8y ago
  My blog was built when AMP was new and looked cool. It was done with my permission - but the content was not vetted by Google in any way. People have told me they asked Google to take down my blog, because they thought it was hosted there.
cheeze 8y ago
Wouldn't be a hn thread without someone mentioning how AMP is literally the worst thing ever.

gcb0 8y ago

fun fact: you can do the same thing again, but use the AMP version and call yourself an amp-provider, just like google does. technically they wont be able to complain because you can say providing amp content assumes they want to be served by you, and you can fiddle as much as you want (e.g. adding tracking code) just like google does when it serves someone else content as amp.

wu-ikkyu 8y ago

Will Google be pushing out a fix for this vulnerability?

danvoell 8y ago

Interesting hack. Sorry about the whole google de-indexing thing. My question would be, did you really gain any useful insights? From competitors, you can normally figure out which page is their most viewed and then figure out how they merchandise it on their homepage. Without "hacking" it.

Ajedi32 8y ago

Surprisingly few comments about the actual attack mechanism here. IMO discussion of whether the author's PoC was ethical is interesting but far less important than the question about how to handle the actual vulnerability; this kind of attack could be used for far more damaging things than just recording user behavior. (Such as phishing.) IMO "get rid of the browser history API" (as the article author recommends) isn't the right solution. The history API is important, as it's the only way to make the back button work as expected in single-page applications, or in multi-page applications that don't trigger a full page reload when you click a link. Rather, I'd suggest the following mitigations: 1. Require a user gesture for `History#pushState` and `History#replaceState` 2. Follow Firefox's example and highlight the most important part of the domain name in the browser UI 3. Don't label HTTPS sites as "Secure", as this can be misleading (Chrome's planning to do this starting next month https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html https://blog.chromium.org/2018/05/evolving-chromes-security-... ) 4. Give the back button a different icon when it's taking you to a different domain (maybe "Up" instead of "Back"?) Any other ideas?

memory_grep 8y ago
Those are great ideas. Would love to see those implemented in Chrome.
yashap 8y ago
Another possibility - if the referring page is a different domain, overriding back is ineffective (the browser just does a “real” back in these cases).
- Ajedi32 8y ago
  I don't understand. Are you suggesting that if you arrive at a site from Google, the history API should just not work? For example, let's say a user arrives at a single-page application from Google, and clicks a link on that page to get more information. The site adds a history entry with pushState, but doesn't reload the entire page. Are you saying that in this case, when the user clicks back they should get sent back to Google instead of to the site's home page? If so, that seems like rather unexpected behavior. And if not, isn't the attack still viable?

gus_massa 8y ago

I just realized that it is not necessary to hijack the back button! 1) Watch out for users coming from Google (or Bing) using the referrer field. 2) Choose randomly In 5% of them are redirect them to your shady domain using a temporal 303 redirect. [If Google notice this, they will hate you.] 3) Host a copy of your competitors page in the shady domain, with all the tracking enabled. [This is illegal! You may get a lawyer C&D, nastygram or more.] I guess that when the user finds your site in Google and click the link, they will most of the time not be sure of with link they choose, so they will not notice the change. And if they realize that they went to the wrong site, they will click the back button and click the search result again, and get the normal page like the 95% of the people. This is probably more credible if the search field in the referrer doesn't have your site in it, so the user is looking for any generic site that includes you and your competitors. As I said before, this is shady and some parts are illegal, so don't do it. Google may demote your site, and also you can get some legal problems.

slim 8y ago

Bonus : you steal some ranking clout from competitor since they don't get that precious click on Google search results

tabtab 8y ago

If Chrome outright disables JavaScript's ability to alter the "Back" path, it may brake some (poorly designed) applications. A compromise is to prompt with a warning.

jstarfish 8y ago
Break them then, with no warning. Letting Javascript trump browser controls (or spam confirmation popups) is a problem that never should have been allowed to live beyond the 90s.
- tabtab 8y ago
  But changing the behavior suddenly can make existing applications outright not function. That results in angry customers. A prompt is a decent compromise. Example prompt: "This website has altered the web address of the Back button. This can be risky. Do you want to use the application's version of the web address, or the original address? [Altered address, Original address, Cancel 'Back', More-info]"

jhoh 8y ago

That huge fixed navbar on mobile is just horrbile. Can't read the article because of it.

sattoshi 8y ago

Just remove the push state history api. Set state is fine. Push state is totally unnecessary since we already had a technology for this: anchors! Instead of site.com/my/page, it's site.com/#/my/page. What is wrong with this? It does literally everything you need and is supported by most routers out of the box!