So this year I have taken it upon myself to dive deep into network internet security, website security and data security. In other words, i’m becoming educated in the art of how people break into websites and networks and how to keep them out! I never thought 7 years of designing websites would lead me into this. It’s certainly a breath of fresh air from developing and designing 🙂

Once in awhile, I get work requests to remove malware and malicious code from a clients website. Usually what happens is that your host might have scanned your server and found the files and alerted you to them. They might take them out themselves or they might tell you to hire a professional to do so.

How do you know your website has been hacked? Well, a lot of the time, you don’t. Most the time, they don’t want you to know what they’ve done. But, Sometimes they do! And they leave their mark loud and proud by defacing your entire website.

Some of hackers are nice, and do this to alert you to weaknesses in your system, leaving your core files alone. But not all of them are nice and they will destroy what they can for no reason at all. Or could there be a reason?

Why Do Hackers, Hack?

There are all kind of reasons people get into hacking.

• #1 For Fun: Hackers LOVE hacking. It’s a game. In fact, it’s better than a game, cause it’s real life. Which makes is super exciting to do. They might think it’s funny to take down an entire site and show off to the world what they did.
• #2 For the Challenge: Solving problems and cracking hidden codes and vaults. These hackers love a challenge. Tell them they can’t do something, they will figure out how to do it. Moral or Immoral. Legal or Illegal. Doesn’t matter. This is also partially, fun as well.
• #3 For Security, Repair & Protection (White Hat, Ethical Hacking): Generally these people taught themselves or got a degree in network security and actually hack for a living. Be it working for themselves or work for companies such as a bank, military, and corporations. It’s their job to remove malicious code from websites or lock down the bank’s network to keep vigilantes out.
• #4 For Shady Business (Black Hat, Illegal/Unethical Hacking): These are the “SEO COMPANIES” that are calling you. There are a lot of shady SEO companies that get involved with black hat hacking so they can fool their customers that they are doing a job, that they really aren’t doing. Not all SEO’s are like this, but you must be very careful about who you hire. real SEO is not cheap. Period. It’s hard work and very time consuming.
• #5 Vigilantes and Heroes: Vigilantes are the individuals stealing your identity and watching you thru your computer cameras or listening in on the mic. They are the ones doing super illegal behavior like distributing videos that exploit children or stealing all your bank accounts and documents and images and selling it all online in the deep web. These are the guys breaking into banks and large company networks. Then there are Heroes! The ones who are trying to stop the vigilantes from doing evil deeds. Heroes are taking down servers which are filled with exploited children or taking down government or enemy sites or exploiting secrets like Edward Snowden. There is a fine line between who considers a hacker a good guy or bad guy.

Generally, if your business website has been hacked, you’re noone special and the hacker wrote a script which runs automatically all the time and scans thousands and thousands of websites on the internet. Your website is being scanned right now for vulnerabilities. If the script finds a vulnerability, it then goes to the next step of injecting the malicious code. As you can see below, I use wordfence on my website. Wordfence gives me a quick overview of the traffic from malicious intent.

Unusual Activity in my Google Analytics

A few weeks ago, I noticed some unusual activity on my own website. The number of visits I was getting per month skyrocketed from the steady flow of nearly 3,0000 visits per month to over 13,000 in a month! I was astonished at this number. What could possibly be happening that my visitors increased so dramatically on my pretty quiet little space on the internet. Well, when I narrowed down what in the world was happening while digging thru my google analytics, I discovered the majority of them were all coming from on particular website from India. http://www.gonextmedia.com/

Since discovering this, I took action and with my developer magic my visits slowly went back down to normal. This was evidence of shady behavior by a so called web design and SEO company. It may have also been a DDOS attack. A DDOS attack is an attempt to take down my site by making the traffic on my site be too much for my server to handle. But I have great hosting services with Siteground. So my website didn’t even blink. Thank goodness.

Hackers, please don’t hack me. I’m a nice person. Most the time… 🙂

What I found Inside Hacked Websites

Cleaning websites of malicious software can be very simple or very complicated. They inject code in one file that’s only a few lines. OR they could inject code in hundres and hundreds of files. You knever know. And sometimes that code and replicate itself even if you remove it. It’s something different every time. Hackers get pretty clever. You can get an email and it will contain malicious code and you will never know it, because they’ve sneakily added it inside there and it’s untraceable to the naked eye. A harmless looking email could hold a vicious virus. They will also insert files with malicious code that look like normal files, but really are not.

Common “hacking” methods used to wreak havoc on the earth….

• Keylogger – recording your keystrokes.
• Denial of Service (DDoS/DoS) – Attempt to take down a site
• Waterhole Attacks – Attack from the most vulnerable source
• Fake WAP – Fake Wireless Access Points to get your info
• Eavesdropping (Passive Attacks) – Monitoring our computer without harming the system
• Phishing – Faking websites you visit often in an attempt to get your private info
• Virus, Trojan, Malware, Etc.. – Efforts to destroy your day or life….
• ClickJacking Attacks – Changing the direction of clicks to make you go where they want you
• Cookie Theft – Stealing the cookies from your computer/browser to steal passwords, usernames, private info, history
• Bait and Switch – making you run a program that you think is authentic but is really a malicious program

You can find out more about each of these common hacking techniques here.

How to protect yourself from cyber attacks & hackers

When designing a website, hire high quality developers when building your website. More often than not, they already have methods they put into action to help veer attacks from happening. Make sure to have excellent hosting with great support and great security methods. Get SSL installed on your website. You’ll also get a +1 from search engines like Google if you are concerned about SEO. And always make certain to have firewalls and antivirus running on your computers. You can protect and protect all day long and at the end of the day, there is probably someone out there already trying to crack thru some wall someone is creating. If big banks who spend millions of dollars on network security can get hacked, you better believe you can get hacked too. Here are some helpful articles if you want to learn more about protecting your network at home and business.

• https://blog.malwarebytes.com/101/2015/10/10-ways-to-protect-against-hackers/
• https://blog.instantssl.com/ssl/decoding-ssl-how-does-ssl-certificate-protect-against-hacking/
• http://www.lifehack.org/articles/technology/10-ways-prevent-your-mac-from-being-hacked.html
• http://www.pcworld.com/article/3093362/how-to-secure-your-router-and-home-network.html
• http://www.wpbeginner.com/wordpress-security/

Nifty Links Across the Web discussing Internet security, network security and data security.

• http://blog.shodan.io/tracking-hacked-websites/
• http://fortune.com/2017/01/19/facebook-hacker-bug-bounty/
• https://perishablepress.com
• http://fortune.com/2017/01/19/facebook-hacker-bug-bounty/
• https://nakedsecurity.sophos.com/2016/04/22/the-facebook-hacker-who-caught-a-facebook-hacker/
• http://thehackernews.com/2016/11/hack-google-account.html

A little diddy I found in a client’s hacked website. Enjoy 🙂