By Tom Petryshen
More businesses than ever now depend on their website to act as the face of their business. For e-commerce and web based companies, their websites are the business. Downtime of any type or length can have a catastrophic effect on sales and the bottom line.
While most website downtime is caused by technology malfunctions or human error, there is a more sinister concern that is waiting to wreak havoc. And rather than waiting for you to stumble across their websites, criminals are increasingly going where the traffic is by targeting legitimate websites. In fact, the rising tide of malware is causing chaos for companies of all types.
Every website, including those from businesses you know and love is potentially a threat as hackers increasingly exploit vulnerabilities in web servers to plant their malware for unsuspecting visitors.
In addition to the initial clean up and lost revenue from downtime, your brand may be tarnished and any investment in Search Engine Optimisation (SEO) lost.
Over the past three months, we've been called in to help clean up the mess left by hackers for two businesses that depend heavily on their websites for marketing and sales. In addition, we've also seen hackers change the links on the website of a large, well known Australian retailer to redirect visitors to their own infected websites.
Tricks And Techniques Employed By Hackers To Break Into Your System
The first, most common technique used by hackers is scanning. Hackers have created tools that scan computers for weak spots. It can be an operating system that hasn't been upgraded or a port in the computer that it is open without the knowledge of the user.
Hackers use this 'open window' to get inside your computer in order to do whatever they want to do. The interesting thing about this is that these hacker tools are available for free via the Internet. So, with a couple of hours of instructions, almost every computer user can become a hacker.
Another way that hackers can access your machine is through malware: programs designed to capture vital information from your computer, like login users and passwords. Malware could be hidden in a PowerPoint presentation sent by email or even in an innocent Instant Messenger message window.
In the first example, hackers were able to exploit known issues in old database software to gain control of the server. Once in, they created thousands of content pages containing sexually explicit and drug related material and hid the content out of sight. They then added hidden links in the code of the company's actual product pages that pointed to their new content.
While the links and content was not visible to the visitor, it was easily discovered by Google. After finding the hidden links, Google then found and indexed the hacker's content. After only a few short weeks, Google started to display these pages in the search results and deliver traffic to them.
While no malware was installed on the website, the hacker's attempt at creative literature had a negative impact on the company's search engine rankings and the corresponding traffic and sales. If left unfound, the long term impact on the company's investment in Search Engine Optimisation (SEO) would have been even greater.
In a second example, hackers were able to gain access to the web server of a nine month old business by exploiting the code of a Content Management System and in doing so installed malware directly to the server. Unsuspecting visitors were then infected with the virus.
While the malware was quickly discovered by Google, the website had to be taken down for three days in order to clean and test the server. Unfortunately this downtime led to lost business, not to mention the hidden cost to the brand for those that were infected.
Finally, in a more high profile case, hackers were able to exploit the server used to display ads on a large electronics retail business. In this case, the hackers changed the links on the ads that were displayed on the retailer's website. Visitors who clicked on the ads were then directed to a website that contained malware. While the e-commerce website was not directly affected, the fallout from customers who became infected would have been devastating to the brand.
Whether it's malware, links to websites with malware or actual downtime the real costs to business for any downtime today are high. For companies that depend on their website for leads and sales, the fallout from hackers and their handiwork can be costly.
Follow these seven steps:
1. Ensure your hosting company has the latest software installed on their servers. Hackers tend to look for and exploit known vulnerabilities in older software. If the software is updated it drastically reduces the chances of them gaining access.
2. Sign up for Google's and Bing's Webmaster Tools. Both search engines now provide alerts and notification if they find malware on your website.
3. Scan your website using free tools from McAfee (www.siteadvisor.com) and AVG (linkscanner.avg.com) to detect threats.
4. If your website is mission critical consider using one of the paid website monitoring service from Binary Canary (www.binarycanary.com), HackAlert from Armorize (hackalert.amorize.com) or Purewire from Barracuda Networks (www.purewire.com).
5. Don't use a common password that can be easily guessed and change it every six months or when staff turn over.
6. Ask your developers or web hosting company to hide website errors. Hackers are able to use the error messages to exploit holes in any databases you might be using.
7. Keep your own virus software up to date so that you don't inadvertently give the hacker your passwords via a key logging malware.
Tom Petryshen is the chief executive officer and founder of Amplify.
amplify.com.au
