A Nearly Four-Year Longitudinal Study of Search-Engine Poisoning

Abstract

We investigate the evolution of search-engine poisoning using data on over 5 million search results collected over nearly 4 years. We build on prior work investigating search-redirection attacks, where criminals compromise high-ranking websites and direct search traffic to the websites of paying customers, such as unlicensed pharmacies who lack access to traditional search-based advertisements. We overcome several obstacles to longitudinal studies by amalgamating different resources and adapting our measurement infrastructure to changes brought by adaptations by both legitimate operators and attackers. Our goal is to empirically characterize how strategies for carrying out and combating search poisoning have evolved over a relatively long time period. We investigate how the composition of search results themselves has changed. For instance, we find that search-redirection attacks have steadily grown to take over a larger share of results (rising from around 30% in late 2010 to a peak of nearly 60% in late 2012), despite efforts by search engines and browsers to combat their effectiveness. We also study the efforts of hosts to remedy search-redirection attacks. We find that the median time to clean up source infections has fallen from around 30 days in 2010 to around 15 days by late 2013, yet the number of distinct infections has increased considerably over the same period. Finally, we show that the concentration of traffic to the most successful brokers has persisted over time. Further, these brokers have been mostly hosted on a few autonomous systems, which indicates a possible intervention strategy.

Scripting the crime commission process in the illicit online prescription drug trade

“…Example of a search-redirection attack. The first two results returned here are sites that have been compromised to advertise unlicensed pharmacies [4]. prevention, by placing the focus on the different stages of criminal events.…”

“…For example, the same traffic can be directed to other illicit online markets and to websites that can potentially infect their visitors with malware. Similarly, unlicensed online pharmacies can attract potential customers though means, such as email spam [34,51], and organic search results [4].…”

“…While our rationale for examining the illicit online pharmacies through CSA is rather straightforward given their role in monetizing this illicit activity, the decision to focus on the specific advertising vector-the search-redirection attack-is based on its extent and impact [4]. This type of attack allows certain visitors to compromised websites (which are under the control of an adversary with or without the knowledge of the legitimate owner)-those who come to such websites after searching for certain keywords-to be redirected to online stores selling pharmaceutical drugs without a prescription.…”

Cyberspace and Artificial Intelligence: The New Face of Cyber-Enhanced Hybrid Threats

“…Search engine poisoning or even a more sophisticated search engineering has been applied in the past by black hats to spread malware and fake contents [15,16].…”

Search + Seizure

“…More modern analyses have covered advances in detecting cloaking and poisoning techniques [19,22,27,35] as well as deeper studies of the particular campaigns and their operational behavior [15,36]. These efforts, which identify a range of technical behaviors implicated in abusive SEO, serve as the foundation for our own measurement work.…”