5 ms·
It's Been a Year and Georgia.gov Continues to Be Hacked
- djoldman 2y agohttps://www.google.com/search?q=site%3A.gov+%22As+of+my+last+knowledge+update%22 https://www.google.com/search?q=site%3A.gov+%22As+of+my+last...
- internetter 2y agoHere’s another one: https://oawp.va.gov/forums/general-discussion/15a1e35b-13a2-ee11-a81c-001dd80658fd?page=1 https://oawp.va.gov/forums/general-discussion/15a1e35b-13a2-... At least this time, it appears to just be a user on some forum, as opposed to something cooked directly into the server
- deleted 2y ago[deleted]
- darkwater 2y agoLooking into those results, the Department of Veteran Affairs forum [1] is an hilarious meeting point for bots :D [1] https://oawp.va.gov/forums/general-discussion https://oawp.va.gov/forums/general-discussion
- DangitBobby 2y ago[deleted]
- batch12 2y agoThese looked like cached search results. I am not seeing the IOCs on the live site unless I am missing it or they're only showing them to googlebots. One can see the results by searching google for the domain and the "gold" string from the article.
- internetter 2y agoClicking the link from the google search results continues to work, I just tested it on my phone. Visiting the page directly continues to redirect for me
- wil421 2y agoIf you think the site is still serving the redirects I’m going to make a phone call to a publicly available number of some Cyber Crime division for Georgia’s GBI.
- internetter 2y agoTest it yourself: https://www.google.com/search?q=team.georgia.gov+%22kamagra%22 https://www.google.com/search?q=team.georgia.gov+%22kamagra%...
- mdorazio 2y agoI tried the first 5 links and none of them showed the hacked content in the resulting page. At least for me the Google results were all old caches.
- internetter 2y agoCould you try setting the referrer to google.com in the WGET? https://shottr.cc/s/1CXn/SCR-20240426-cm4.png https://shottr.cc/s/1CXn/SCR-20240426-cm4.png
- ldoughty 2y agoNote that browsers/extensions/settings that hide your referrer might prevent you from encountering this redirect
- qingcharles 2y agoWorked for me with no changing of any referrer or other HTTP settings. Clicking on the first georgia.gov resulted redirected me to the spam site. (Win11 + Chrome)
- internetter 2y agoThank you for bringing this up! The plot thickens: https://shottr.cc/s/1CXn/SCR-20240426-cm4.png https://shottr.cc/s/1CXn/SCR-20240426-cm4.png
- ceejayoz 2y agoThis is why it's fairly common for people to say "Google says my site is hacked, but when I check it's fine!" on webdev forums.
- eli 2y agoThis is standard practice for hacked wordpress sites. They only serve the compromise to organic search traffic.
- ljp_206 2y agoYes, I have heard this called a link cloaking hack, methinks.
- caymanjim 2y ago[flagged]
- internetter 2y agoWhat? I have proof it’s not dynamically generated. The rest of the website is powered by Wordpress, but this redirect is entirely powered by Apache. If users can do that, that’s absolutely a problem. And it absolutely is still there. I’ve clicked the links on a multitude of different browsers, and they continue to work. One comment lead me to discover that it only works if you are referred by google.com: https://shottr.cc/s/1CXn/SCR-20240426-cm4.png https://shottr.cc/s/1CXn/SCR-20240426-cm4.png You’re the one who needs to get over yourself. A government website acting as referral spam for over a year is absolutely noteworthy
- echelon 2y agoAnd just because they chose spam, doesn't mean they couldn't serve malware instead. From a government website.
- xandrius 2y ago[flagged]
- caymanjim 2y agoWoke up on the wrong side of the bed.
- WaitWaitWha 2y agoI do not read any industry standard disclosure details for this. Was this reported to the site owners (https://gema.georgia.gov/get-involved/report-cybersecurity-eventincident https://gema.georgia.gov/get-involved/report-cybersecurity-e...) and appropriate government law enforcement agencies (https://www.cisa.gov/report https://www.cisa.gov/report)? I do see a call to share other incidents to the blog owner.
- internetter 2y agoAs stated in the post, I contacted the listed email exactly one year ago. I did not contact law enforcement — I did not consider it to be my place Edit: and I’m not sure standard disclosure even applies. I’m just talking about IOCs, not the actual attack vector (which I do not know)
- devmor 2y agoIf you’re interested in getting more eyes on it, might I suggest reaching out to the newspaper the Atlanta Journal Constitution?
- DanAtC 2y agoFull disclosure if you're a good guy, no disclosure if you're bad. "Responsible" disclosure is anything but.
- WaitWaitWha 2y agoCan you elaborate on your note? Asking because I had multiple bad experiences with responsible disclosure, yet I do not believe full (public presumably) disclosure is the right initial path.
- DanAtC 2y ago"Responsible" disclosure at best results in an embargo where "trusted" parties get to sit on it while the general public remains at risk. Worst case you get the cops knocking at your door. (Full disclosure should be done anonymously to prevent the latter from happening anyway)
- rstat1 2y ago[flagged]
- internetter 2y agoI published this post a few hours ago — still plenty of time :-)
- cqqxo4zV46cp 2y agoHuh? How does this have a partisan angle? This is the usual MO, like, anywhere.
- observationist 2y ago[flagged]
- mattfields 2y agoThis seems to fall under the category of "inflammatory political commentary", regardless of including both parties in it. IMO seems borderline on flag-worthy.
- whamlastxmas 2y agoOnly if you disagree
- tyingq 2y ago> This indicates to me that someone with access to Georgia’s servers did this on an Apache level, instead of within WordPress Assuming you've breached WordPress, and can run arbitrary php, you can produce that kind of result. I think that path is more likely/common.
- tyingq 2y agoYeah, they appear to have gotten into WordPress: "The state’s goal is for citizens to lose one million pounds, and httpx://sanyuwu.com/index.php?top-lesbian-dating-sites-pii the website even suggests ways to get the family dog involved. Trainers and nutritionists will be" Bottom of this page: https://team.georgia.gov/georgia-news/state-parks-fitness-challenge-combines-great-outdoors-with-healthy-living/ https://team.georgia.gov/georgia-news/state-parks-fitness-ch... And this query: https://www.google.com/search?q=site%3Ateam.georgia.gov+viagra+-inurl%3Amedicicnes https://www.google.com/search?q=site%3Ateam.georgia.gov+viag...
- internetter 2y agoWhats fascinating to me is that the content seems to have been removed from most of these pages. Some staff member is likely manually deleting them and didn't think to escalate the situation
- deleted 2y ago[deleted]
- nojvek 2y agoreferrer google or user agent google bot is a great way to have google specific shenanigans to rank higher in search. Google says it's against their policy but plenty of sites do that. Plenty of sites let their paywalls down just for GoogleBot to the ranked in search but real users have to pay. Some sites don't load ad crap to show GoogleBot how fast they are. We should all become GoogleBot.