Site hacked -- pretty ingenious search engine hacking

Corporal Joined: Mar 12, 2004 Posts: 52

Hello all. So, my damn site got hacked again after a long run without a major hack. This one is pretty ingenious (did a search for this -- didn't find anything). If you go to my site: http://www.eastcoastbodyboarding.com, everything seems fine.

BUT, if you search for my site on Google (and this sucks because I am #1 on Google now for Bodyboarding), and click my link through there http://www.google.com/search?q=bodyboarding&sourceid=navclient-ff&ie=UTF-8&rlz=1B3GGGL_enUS231US231, you get this friggin page that a hacker set up on my site somehow that just lnks to a bunch of ad referral sites.

Questions:
1) How the heck do I fix this. Can't even tell where the problem is
2) How do I prevent this - most of my traffic is (was) Google driven
3) Since this hacker is making ad revenue through these ads, there mst be some way to trace him. I'd be willing to pay a few $ to trace it and bust this guy.

Thoughts? Please, please help. Thanks.

Site Admin Joined: Aug 17, 2003 Posts: 12342

I posted on another forum, but I will reply for anyone searching

Quote:

That is very interesting trick. When I go through Google first, it looks like the ad page loads and is cached. All subsequent requests go there until I do a hard fresh (alt-F5).

I don't see anything obvious in the HTML. So it must be something in the PHP files themselves... some code that tracks referrals and redirects them.

Probably no way to track, but get access logs anyway. Look for anything suspicious (I know its a real manual process.. but until you can find the vulnerability, you don't know much). He could easily hide under a proxy IP or another server he has hacked

It looks like his .htaccess was rewritten with rewrite rules to accomplish this

Corporal Joined: Mar 12, 2004 Posts: 52

Thanks evaders. Posted this thread on raven as well. Follow up there. Still trying to figure out how he accessed my htaccess