Making Phishing Pages Visible with SEO

The internet index consists of some 5.27 billion webpages. These jostle against one another for visibility, doing their utmost to ensure that you click their “things to do on vacation in Prague” guide rather than the second, third, or 5,000th alternative webpage. It’s a highly competitive game, and one of the chief tools in this battle is SEO. Standing for Search Engine Optimization, SEO refers to best practices when it comes to optimizing online content. This ensures your website shows at the top of search engine results such as Google. Because most users will only click the top few search results, and 75% don’t go beyond the first page of responses, SEO is important. SEO has become one of the most crucial weapons in the arsenal of businesses, organizations, and anyone else who operates a website or webpage.

Most of the time, SEO is used positively as a way to draw attention to a webpage its owner believes has genuine utility to the searcher. However, good SEO – meaning pages that optimize for search results – can also be used by bad actors. This opens up a new type of phishing attack which can be an extremely damaging cyber security threat.

The danger of phishing attacks

Phishing refers to a brand of social engineering attack. It exploits some aspect of human behavior in order to spread malware, steal login details, and more. A classic phishing attack is a fake email appearing to be from a source of trust, like a user’s bank. It might contain details of a fraudulent transaction that has supposedly taken place, and include a link that redirects the user to a website. The website then asks them to confirm their login details or prompts them to download a particular file.

SEO gives cyber attackers a new way of potentially carrying out a phishing attack. A recent example of an SEO-driven attack involves a payload delivery method for malware that harnesses what’s known as the Gootkit Remote Access Trojan (RAT) infection framework. In this attack, hackers use pages to spread malware in a cunning way that is not only tougher to detect but can also spread and deploy malware more rapidly. When users write a question using Google, these malware pages present highly in the search results due to the use of a Javascript-based infection framework that generates pages so that they verbatim reflect queries entered into a search engine.

For example, to return to the earlier example, a person writing “What should I do on a June vacation in Prague?” will have their search return with a link to what appears to be an online message board on which another user has asked that identical query. The infectious page, which generates the text string to match the user query, contains links to downloadable malware in the form of a .zip archive file. This contains a .js file. When this .js file runs, it then decrypts code to summon additional malware payloads. The approach spreads malware such as ransomware. Ransomware decrypts user files and systems. It only offers up a decryption key after the user pays the ransom to the attackers.

Exploiting human error

As a social engineering attack, phishing exploits human psychology. This is done by finding ways to scam users into making a security lapse of judgment. The first defense against phishing should therefore be education. While phishing attacks vary, users should be vigilant when they are online. Particularly when entering sensitive information or downloading files. Not every user can be a cybersecurity expert, but they can nonetheless be taught to better protect themselves online. Like how not everyone is a locksmith, but we know to lock our doors when leaving the house.

However, phishing attacks are getting smarter all the time. Scammers vary their approaches. So, when they have a particular target in mind, may use hyper-targeted attacks as part of the confidence trick. Even professional cybersecurity experts will frequently acknowledge that a well done phishing attack could fool them into making a mistake.

As a result, it’s important to also utilize the right tools to help. Two-factor authentication (2FA) can help counter phishing attacks by adding an extra layer of verification when accessing certain applications. It means that, even if a user does accidentally have their credentials stolen, they are not enough to gain entry to a particular system. Frequently changing passwords is a smart move for similar reasons.

Additionally advisable is the use of Web Application Firewalls (WAF). Firewalls work by blocking potentially malicious requests on the network edge. By deploying these measures, users can protect themselves effectively against phishing attacks.

Given the potential damage phishing attacks can cause, it’s essential that they should be on users’ radar. A large number of hacks involve human error as a key component of their success. By cracking down on that, users take a major weapon away from would-be hackers. It’s one of the smartest moves you can make from a cybersecurity perspective.