So I’ve Contacted You About Your Website – Georgia Tech Cyber Security

Who am I?

My name is Adam Arrowood and I work for the CyberSecurity team of Georgia Institute of Technology in Atlanta, GA USA. I specialize in web server and web application security.

What do I do?

One of my duties for Georgia Tech is to look for websites hosted on our campus, and on other University System of Georgia (GA USG) domains, that have been compromised and are serving ads for illegal pharmaceutical sales, counterfeit goods, illicit software sales, etc. These ads are known as “backlink spam” and I have authored a website about our effort to fight backlink spam at Georgia Tech.

How do I find compromised websites?

I search for compromised sites by making targeted searches at Google and Bing for terms and phrases that appear on sites serving spam ads. I normally limit these searches to domains that are a part of the GA USG. E.g.:

The terms and ad language phrases that I search for change; they complement each other in a feedback loop in which searching for terms in one category helps to find additional terms or phrases to search for. For example, a search for “viagra” will show results that include the phrase “best prices”; subsequently searching for “best prices” will show results that are advertising additional drugs.

Why am I contacting you about a website on your campus?

Most of the time, my searches are limited to domains that are part of the GA USG. However, in order to tune and expand my list of terms and ad language, I occasionally expand my searches to the entire .edu domain space (e.g. I might search for site:edu “canadian pharmacy”). If I come across a significant compromised website that belongs to a major university, I will usually try to contact them and let them know what I’ve found. If you are reading this web page, you are likely to be involved with one of the websites that I have found in my search results.

What do I want you to do?

The first thing you should do is to make contact with your University’s Information Security department and inform them of my contact with you and of the problem that I am reporting. They should be able to advise you on your next steps. If you don’t have an IS department and are on your own in dealing with the issue, you might want to start with a site that Google provides entitled Webmasters help for hacked sites.

If I ask for a copy of the malicious code that is on your site, why am I asking and what do I plan on doing with it?

If I believe that your site has code on it that was installed by hackers in order to serve spam ads, I might ask for a copy of the files containing (only) that code. My interest in the malicious code is threefold:

To observe what techniques are being used to serve the ads and the “business logic” involved in deciding which ads, if any, to show to website visitors. This, I hope, will help me find additional compromised websites.
To search the contents of many of our websites at Georgia Tech for the same or similar scripts. We host much of our external-facing websites on a central service and I can scan the contents of all of those sites for scripts matching what is found on your site.
To find the hostname/IP address of the master ad server that your website is likely contacting. On many compromised sites that are serving ads, the spam links and language being served is not present in any files on the server; instead, for each request to the compromised site, a separate, back-end request is made to a master ad server that sends back the ads or instructions on how the webserver should respond. By looking at netflow data across our campus network border, I would like to see if any of the websites on our campus are talking to the same master ad server as your site.

I will likely share that IP address with other GA USG Universities and with the various security organizations in which Georgia Tech participates. I will not identify your server as the source of the IP address.

If you don’t feel comfortable with sharing, or don’t wish to go to the effort to identify and share the code, that’s ok, too.

How do I contact you if I have code I’m willing to share or if I have further questions about your contact?

Feel free to reach me at adam.arrowood@security.gatech.edu or to call me at (404)-894-9629. If you are sending code and wish to use PGP to encrypt your message, you can find my key below.

Thanks,
Adam Arrowood