It's Been a Year and Georgia.gov Continues to Be Hacked | Hacker News Reader

It's Been a Year and Georgia.gov Continues to Be Hacked

boehs.org

162 pointsinternetter44 comments

> This indicates to me that someone with access to Georgia’s servers did this on an Apache level, instead of within WordPress

Assuming you've breached WordPress, and can run arbitrary php, you can produce that kind of result. I think that path is more likely/common.

Yeah, they appear to have gotten into WordPress:

"The state’s goal is for citizens to lose one million pounds, and httpx://sanyuwu.com/index.php?top-lesbian-dating-sites-pii the website even suggests ways to get the family dog involved. Trainers and nutritionists will be"

Bottom of this page: https://team.georgia.gov/georgia-news/state-parks-fitness-ch...

And this query: https://www.google.com/search?q=site%3Ateam.georgia.gov+viag...

Whats fascinating to me is that the content seems to have been removed from most of these pages. Some staff member is likely manually deleting them and didn't think to escalate the situation

https://www.google.com/search?q=site%3A.gov+%22As+of+my+last...

Looking into those results, the Department of Veteran Affairs forum [1] is an hilarious meeting point for bots :D

[1] https://oawp.va.gov/forums/general-discussion

Here’s another one: https://oawp.va.gov/forums/general-discussion/15a1e35b-13a2-...

At least this time, it appears to just be a user on some forum, as opposed to something cooked directly into the server

[deleted]

I do not read any industry standard disclosure details for this.

Was this reported to the site owners (https://gema.georgia.gov/get-involved/report-cybersecurity-e...) and appropriate government law enforcement agencies (https://www.cisa.gov/report)?

I do see a call to share other incidents to the blog owner.

As stated in the post, I contacted the listed email exactly one year ago. I did not contact law enforcement — I did not consider it to be my place

Edit: and I’m not sure standard disclosure even applies. I’m just talking about IOCs, not the actual attack vector (which I do not know)

If you’re interested in getting more eyes on it, might I suggest reaching out to the newspaper the Atlanta Journal Constitution?

Full disclosure if you're a good guy, no disclosure if you're bad.

"Responsible" disclosure is anything but.

Can you elaborate on your note?

Asking because I had multiple bad experiences with responsible disclosure, yet I do not believe full (public presumably) disclosure is the right initial path.

"Responsible" disclosure at best results in an embargo where "trusted" parties get to sit on it while the general public remains at risk. Worst case you get the cops knocking at your door.

(Full disclosure should be done anonymously to prevent the latter from happening anyway)

But full disclosure places the general public at greater risk than responsible disclosure.

Let's say hypothetically someone found this hacked website, sent an e-mail to the site owners' security reporting contact, and after a year they hadn't taken any action.

Some would say a "responsible" disclosure which allows the danger to continue unabated for a year is a greater danger than a public disclosure, which would lead to the danger being fixed.

That is one hypothetical scenario, yes. Another hypothetical scenario is that as a result of responsible disclosure the site owners patch the hole and ensure customer data isn't publicly accessible before the vulnerability is public knowledge.

Seems reckless to me to not even _try_ responsible disclosure. You don't have to wait a year. But at least give a chance for the problem to be solved before you make it common knowledge.

Did I say hypothetically? Sorry, I meant to say exactly as happened [1]

[1] https://news.ycombinator.com/item?id=40169334

Right, so that’s a dataset of 1. Are you suggesting responsible disclosure never works because of your one time experience?

Of course not. I agree that responsible disclosure works perhaps 10% of the time.

It's the 90% of the time, when it doesn't work, that's the problem.

Only in the very short term. In mid-to-long term it increases the incentive to actually roll out a fix sooner then later.

Or you can possibly decide to shut down whatever service is vulnerable.

Responsible disclosure creates a ton of perverse incentives for all parties and ultimately leaves customers worse-off. Bug bounty programs and all of the drama and exploitative labor issues fall into this pit.

Full disclosure might have short-term negatives for _companies_ involved but is best for customers/users as it allows them to evaluate and implement their own mitigations as early as possible. It's the only truly ethically consistent way to operate.

This really sounds like you’re back-solving from a pre-existing ideology of complete openness. A customer’s ability act early, e.g. mitigate, is quite clearly context-dependent. I can think of vendors I interface with as a customer that I’d prefer had vulnerabilities ‘responsibly disclosed’ to them. Nothing in technology is this simple. The absolute nature of your claims make it near impossible to actually take this seriously.

These looked like cached search results. I am not seeing the IOCs on the live site unless I am missing it or they're only showing them to googlebots.

One can see the results by searching google for the domain and the "gold" string from the article.

This is standard practice for hacked wordpress sites. They only serve the compromise to organic search traffic.

Yes, I have heard this called a link cloaking hack, methinks.

Thank you for bringing this up! The plot thickens: https://shottr.cc/s/1CXn/SCR-20240426-cm4.png

This is why it's fairly common for people to say "Google says my site is hacked, but when I check it's fine!" on webdev forums.

Clicking the link from the google search results continues to work, I just tested it on my phone. Visiting the page directly continues to redirect for me

If you think the site is still serving the redirects I’m going to make a phone call to a publicly available number of some Cyber Crime division for Georgia’s GBI.

From the screenshot linked above:

  curl -i -H 'Referer: google.com' https://team.georgia.gov/medicicnes/kamagra-gold-100/
  HTTP/1.1 301 Moved Permanently
  Date: Fri, 26 Apr 2024 12:36:14 GMT
  Server: Apache/2.4.6 (CentOS)
  X-Powered-By: PHP/7.4.33
  Location: https://gomylink.site/vkKXXr8G?sub1=kamagra-gold-100&sub2=team.georgia.gov
  Connection: close
  Transfer-Encoding: chunked
  Content-Type: text/html; charset=UTF-8

Good find- I was on my mobile at the time so couldn't dig this deep so I am happy to see someone figured it out.

Test it yourself: https://www.google.com/search?q=team.georgia.gov+%22kamagra%...

I tried the first 5 links and none of them showed the hacked content in the resulting page. At least for me the Google results were all old caches.

Note that browsers/extensions/settings that hide your referrer might prevent you from encountering this redirect

Could you try setting the referrer to google.com in the WGET? https://shottr.cc/s/1CXn/SCR-20240426-cm4.png

Worked for me with no changing of any referrer or other HTTP settings. Clicking on the first georgia.gov resulted redirected me to the spam site. (Win11 + Chrome)

referrer google or user agent google bot is a great way to have google specific shenanigans to rank higher in search.

Google says it's against their policy but plenty of sites do that. Plenty of sites let their paywalls down just for GoogleBot to the ranked in search but real users have to pay.

Some sites don't load ad crap to show GoogleBot how fast they are.

We should all become GoogleBot.

Reply on news.ycombinator.com