Google Search Result Redirect Page Hijacked For NodeSummit

travisglinesOP14y ago· 3 in thread

Click the top link (NodeSummit)

The Google redirect is landing on a page with malware by the looks of things.

Edit: Picture of the page it redirects to ...

http://i.imgur.com/EgwKs.png

Nodesummit.com is hacked, not Google. Redirect is active for referrer:

    curl --head --referer 'http://www.google.com/url?{...cut...}' http://nodesummit.com
    HTTP/1.1 302 Moved Temporarily
    Date: Sat, 11 Feb 2012 00:32:36 GMT
    Server: Apache/2.2.9
    X-Powered-By: PHP/5.2.17
    Location: http://costabrava.bee.pl/
    Vary: User-Agent,Accept-Encoding
    Content-Type: text/html

pooriaazimi14y ago

Why '302 Moved Temporarily'? Wouldn't '301 Moved Permanently' serve hacker's purpose better?

travisglinesOP14y ago

Ahh good call, I was thinking it couldn't be Google ...

cleverjake14y ago· 2 in thread

I dealt with this a lot at a hosting company I worked for. This is almost certainly a .htaccess file that is set to only redirect based on referrer. It is normally under several hundred blank lines, to make it look empty to the casual observer.

pooriaazimi14y ago

It can't be.

I can't access the linked url (it's https: http://news.ycombinator.com/item?id=3575029), but as far as I remember, if an HTTPS page links to (or redirects to) another page that is not on the same domain, the HTTP REFERRER field will be empty.

dchest14y ago

Google's redirect is not an HTTPS link, so it sends referrer (see my comment below).

indexzero14y ago

We (nodejitsu) sponsored NodeSummit, but have no control over nodesummit.com. I have reached out to Charles Beeler (the conference organizer) to make him aware of the issue.

Google Search Result Redirect Page Hijacked For NodeSummit (opens in new tab)

Google Search Result Redirect Page Hijacked For NodeSummit (opens in new tab)

8 comments

8 comments