10 reasons why your website is being hacked

Hackers make money with your server

Today, a hacker no longer necessarily breaks into a server, he breaks into a security hole. And preferably on 1,000,000 servers at the same time. Fully automated, a few days or even a few hours after the security update has been released and the hacker has analyzed or reverse engineered it. He writes himself a robot script that does the work for him. 20-30% of all website visits today are from robots – and not just those from Google and Bing.

So it doesn’t matter that there is nothing usable on the server from the customer’s point of view. Checking this beforehand is far too time-consuming for the hacker.

We had to learn that our customers can only assess the extent and the real danger if they understand why a hacker hacks web servers in the first place. The hacker usually only wants one thing: to earn money. To do this, he sells server content or rents server power to other hackers. Not individually, but in bundles of 1,000 to 5,000,000 servers. Without claiming to be exhaustive, I have therefore written down 10 reasons why someone uses this hacker service.

#1 Customer data

The actual customer data may be irrelevant. For example, only whether a newsletter subscription exists or not is stored there. But a combination of usernames and passwords is always a good find for hackers. This is because they can then try them out on other relevant sites. For example, a PayPal account is hacked because the login details were identical on a hacked website. People use the same password far too often.

#2 Hacking to hack others

A server is used to hack other servers. The aim is usually to make tracing more difficult. For example, if the White House is hacked, the NSA could only see which computer the hack came directly from. In other words, your web server may have hacked the White House.

#3 Drive-by hack

Hackers rent hijacked servers in order to spread viruses via the websites there. In this case, a malicious code is deposited that allows visitors to the site to catch a virus.

#4 DDoS attacks

DDoS attacks from many hacked servers on one target paralyse web servers or entire networks. This is like switching off the power. So many requests are generated that the target server can no longer respond. Hackers do this on behalf of a competitor, for example to shut down their store. The competitor then loses sales, customer trust and Google ranking. Automated hijacked servers are sometimes made available for such attacks via APIs.

#5 Viagra links

The hacker receives money for traffic to his customers’ sites, i.e. for the number of clicks, by changing links. Sometimes this happens obviously or very well hidden, for example when only some of the requests are redirected. Then the wrong links may not be noticed until much later.

A hospital once approached us:

“Somehow there’s something wrong with Google. Whenever we search for our site on Google, we always find Viagra references. But everything is correct on our site.”

#6 SEO hack

The hacker uses his captured servers to perform SEO optimization for his customers. For example, he invisibly places Viagra links on the website that are only visible to search engines. This increases the number of external links to the target server and thus the ranking of his client’s website. And he gets paid for it.

#7 Spam emails

Trustworthy servers that send emails sell well. The hacked servers generate revenue per minute by sending spam.

For example, a Formula 1 racing circuit approached us because they always ended up on anti-spam blacklists. They couldn’t send any emails because they were blocked, but instead of investigating the reasons, the admin just went to a lot of trouble to keep getting deleted from these blacklists. In the end, it turned out that several hundred million emails had been sent via his server.

#8 Mining Bitcoins

Hackers use the servers under their control to create bitcoins themselves with these server farms: The power consumption of the hacked server increases, its computing power decreases.

#9 Peer-to-peer to illegal file sharing

The hacked server is used to provide illegal downloads/movies.

We once had a bank approach us because their site was so slow. We first tested the system on our own servers and everything was fine. A network traffic analysis revealed the problem: There were films from an exchange platform on the server, 95% of the server space was occupied, 100% of the bandwidth was being used for the films.

#10 Tor Exitnode

The aim of the Tor network is to make anonymous surfing possible. Anyone can use it for different things – but also to avoid being prosecuted. The exit point is a weak point of Tor. If someone provides an exit point for the Tor network, it can become the starting point for criminal investigations. Hackers use infiltrated servers to create exit points that are not provided voluntarily and also have the ability to manipulate outgoing traffic.