Revealing a Hidden Hack

Once in a great while, I find a site has been hacked and the owner doesn't know about it. The site works just fine — for them.

Generally, in those cases, a sophisticated hacker has caused a cookie to set so that whatever the hack is supposed to do gets done only once. (A hack to redirect the browser to a malware site, for example. If it doesn't work the first time, it won't the second, and the hacker doesn't want to alarm more than necessary.)

The site owner is likely to have noticed something unusual — once. But upon loading the site again, it didn't repeat.

"Maybe it was an anomaly," the site owner might think. "Maybe something weird I typed in. Or I clicked the wrong bookmark, or inadvertently clicked an AdSense ad and ended up at someone else's site."

There's a shrug of the shoulders. And because it doesn't happen again — to the site owner — it's forgotten.

Just because the site owner forgets the incident doesn't mean the site becomes un-hacked.

The hack is still there affecting unwary site visitors.

It's good to test your site occasionally, perhaps once a week. The test is in two steps.

1. The first step relates to cookies.

   1. Dump your site's cookies from your browser to use for viewing your site afresh. Or use a different browser, one that has none of your site cookies.

   2. Set your browser so it won't automatically accept all cookies it's sent. Have it notify you of attempts, or ask you whether or not a cookie may be accepted.

   3. Connect to your site and observe whether or not something unusual happens. Also notice whether or not cookies you don't expect are sent to your browser. (Accept only cookies you expect.)

Although the above might pass inspection — nothing weird happens and no unexpected cookies are set — there is still one more test.

You see, a hacker can get more sophisticated still, especially when they really, really want their hack to be as unnoticed as possible. The longer a hack is in place, the longer the hacker benefits.

In those cases, the hacker can record the IP address of the first attempt — instead of or in addition to using cookies. From that point on, no browser from that IP address will experience the hack.

There is a way to test your site with a different IP address even when you have a static IP address.

One way is to use someone else's computer, maybe one available at your public library, or borrow a friend's mobile device to access your site (after letting them know there's a risk, of course). But that method is optional.

There's also a method you can utilize right from your own office without those hassles.

2. The second step relates to your IP address.

   1. Use the Tor Browser to access the site from a different IP address.

   2. The Tor Browser connects you to websites with an IP address that's different than the one you use to connect to the internet. It's unlikely you've ever used the Tor Browser-assigned IP address in the past.

   3. Connect to your site and observe whether or not something unusual happens. The Tor Browser may render your site slightly different than expected, removing Flash elements for example. It also has other protections built in, so take any messages it presents seriously.

If you are still suspicious, then using someone else's computer and a normal, popular browser may be an option for testing.

Some hacks might not necessarily affect a browser directly. But all I've encountered do.

If your site is hacked, you need to know. Just using your site won't necessarily reveal a hack. Occasional testing is prudent.

Will Bontrager