Now, you think, just tell search engines to delete the links !? Well, that’s fine, but the hacked programming code/files/database entries within your WordPress system will just bring them back !!

There are the 3 types of website links:
#1. Internal Link = Links on your website that link to other pages of your own website.
#2. Outgoing Link = Links on your website that go out to other websites.
#3. Incoming Link (or Backlink) = Links from other websites to yours.

With the loan hack, your customers think this is simply #1 above, an Internal link. They’re being tricked. It appears to be #1 above, an Internal Link, because it LOOKS LIKE an internal link on your website, but isn’t.

You may think it’s #2 above, and Outgoing Link, but isn’t: There is no link from your website out to the hackers. People are at completely at the hacker’s website but the browser at the top is displaying your ‘www.yoursite.com’ address.

Sucuri knows exactly what to do and will fix it for you fast !! Click here to go to Sucuri now and get this taken care of right !!

In general, hackers can use websites to send spam email, crash servers, make money, plant further virus and so much more.

With this particular ‘Loan Hack’, normal traffic to your website is maliciously redirected to the hacker’s loan site. This will typically be a legitimate or illegitimate site. There are 3 scenarios as to the popularity of this scheme:
1) The legitimate loan site may offer an affiliate program. The hacker sends business there, generates legitimate sales for them and then earns a commission; at your expense.
2) The loan site may be illegitimate and cause victims to pay hackers a fee for a loan application but never receive a loan. The hacker pockets the application fee.
3) Lastly, the loan site may be illegitimate and cause victims to give hackers personal information like SS # when applying for a loan. Then the hackers steal their identity; or sell the information on the black market.

BTW, Hackers have wisely chosen to ‘disturb the water as little as possible’ while going about their dirty business. The majority of hackers do not want you to know that they have tampered with your website, as the first thing a website owner will do when they know that their website has been compromised is to fix it. No visible damage is actually done to your site, as everything looks normal to your visitors and to yourself.

Trivia:
You may wonder why they went after a small or medium sized website like yours. Well, hackers don’t go after huge corporations with elaborate security measures in place. They thrive off of smaller website owners who think they’re not the target. After all, smaller sites are easier to attack.
Hackers are difficult to stop and bring to justice because, many times, they’re in countries outside the USA and, thus, out of our jurisdiction.

With this particular ‘Loan Hack’, I believe scenario #1 above is being used here. The hackers want to send as many people as possible to a legitimate loans website so people will apply for a loan. This loans website has an affiliate program so when the site gets a sale, the hacker earns a commission; at your expense

If they created a website of their own, it would take years to acquire a good Google ranking, if at all. So they ‘latch onto’ honest websites by hacking them and putting malicious programming code in which redirects ‘normal’ traffic landing on the hacked site off to the loans payoff site.

All of the loan sites they are promoting appear higher in Google results than they otherwise would. The Google search engine ranks the list of hits for a given website according to (among other factors) the number of external sites that link to it. By inserting the bogus code into an unsuspecting victim’s site, the hack in effect links that site to the victim’s site. If done on a large enough scale, this tactic can result in the hacker’s site showing up near the tops of various hit lists resulting from keyword-based searches. All of the hacked websites link to each other, creating an interlinking and inter-promotion of hacked sites which promotes the whole illicit network.

And all of this happens at search engines, unbeknownst to the honest website owner. Only Google’s search engine crawler (and also others like Yahoo, Bing, WebCrawler, HotBot, Blingo, Blekko, Dogpile, Ixquick, Qwant, Info, DuckDuckGo, Yandex.ru) receives the changed content.

Side note: The hacker’s programming code is set up to not just latch onto Some of your website, but mainly the Most Popular Pages of your website. They go after the cream of the crop !

Hackers do what’s called ‘Brute Force’ password cracking with software that takes a list of thousands of common passwords and tries logging into your WordPress system with them. And at a rate of several hundred passwords per minute !!

If that fails, they try sequential numbers/letters/symbols. It takes hours or days to try billions of probable password combinations. If it gets a click, the program gets access to your administrator account.

Trivia:
Most WordPress users use default username ‘admin’ so a hacker already knows half of the information to login ! Hackers can easily confirm that ‘admin’ is a valid the username: At your WordPress login screen, they enter the username ‘admin’ and just anything for password. A message then comes up saying ‘The password you entered for the username admin is incorrect.’ Well, now the hacker has confirmed the username ‘admin’ is a valid one !! Then they can move on to cracking the password.
2.2 % of passwords used are made up from the top 25 list.
Using a very fast computer, it’s possible to crack every Windows alphanumeric password under 8 characters in less than 6 hours.
And cracking every alphanumeric password under 6 characters would take less than 5 hours.

Keep WordPress, Plug-ins and Themes updated so you’re using the latest, secure versions of them. Trivia: 83 % of hacked WordPress sites are using old versions of software.

Disable plug-ins you aren’t using; better yet, delete them. Especially delete the “Askimet” plug-in if it’s not being used. It comes with WordPress and can allow a backdoor for hackers.

Only get Plug-ins and Themes from trusted sources.

After your site is hack-free, I recommend 2 fantastic security plug-ins; and they’re free, too !!: ‘Sucuri Security’ and ‘WordFence’. Combined, they have a tremendous # of features to keep your site secure. One big one: To prevent future ‘Brute Force’ password cracking, ‘Wordfence’ can limit the # of WordPress login attempts ! 🙂

Periodically check your WordPress Users to see if there’s one that you don’t recognize. If there is one, delete it asap !!

Don’t ever user the default ‘admin’ username.

Use an online password generator, if possible, to generate great passwords for all users.

If you don’t use WordPress as a blog, disable comments (this is one of the most common attack vectors). If you really want them, look into using ‘Intense Debate’ or ‘Disqus’ software.

Look at the permissions for each user; everyone does not need to have administrator rights.

If you have a second WordPress system installed for Development use, have that development directory password protected. You’re the only one in the world who needs access to it. (This is usually done with your Internet Provider)

This is technical, but the ‘wp-config.php’ file holds important information and can be protected more by moving it up one directory to the calling/root directory. WordPress will find it in that more secure location alright. Also, consider changing permission of that file from 644 to 400 so only owner can read it.

This is technical, but the ‘wp-config.php’ file should have long, encrypted security ‘keys’ and ‘salts’ in them. These make your site harder to hack and access harder to crack by adding random elements to the password. An online key generator can be used to create excellent ones which are long, random and complicated. You can change these at any point in time to invalidate all existing cookies; although it means that all users will have to log in again.

This is technical, but set your file and directory permissions properly per WordPress recommendations.

At Google, create an account with ‘Google Webmaster tools’. This is a free service offered by Google that helps you monitor and maintain your site’s presence in Google Search results. You don’t have to sign up for ‘Webmaster Tools’ for your site to be included in Google’s search results, but doing so can help you understand how Google views your site, keeps it healthy and optimizes it’s performance in search results.

There is also a clear pattern in the passwords being guessed. This is natural as people have a very bad habit of choosing very weak passwords. Unfortunately, the things that are easy for us to remember are also quite easy to guess. The following passwords come out on top as the most frequently guessed ones:

About the Author: Firstly, I hope this web page has given you information and assisted you in some way. My name is Mark Allbaugh and I own the domain ‘www.alltrackusa.com’. I converted the site to WordPress in 2013/14 and found in January of 2015 that it had been hacked. I had discovered on a search in Google (and 12 other search engines) that there were hundreds of links supposedly at my site to obtain cheap, easy-to-get ‘Financial Loans’. I was shocked !! Then when I typed the loan links into a browser manually, they were Not Found !? Being a computer programmer since 1982, I had to know what in the world was going on. So I spent weeks researching and reading all about WordPress vulnerabilities (This loan hack, by the way, is technically called a ‘Pharma’ Hack). In that research, I discovered that there were thousands of other victims, most not even knowing they had been hacked. So now I’m a customer of Sucuri, Inc. and, as an affiliate, am working to get these victim’s sites cleaned up.
This benefits all involved (except, of course, the hacker):
   Victim: Their website is cleaned up professionally and ‘hardened’ (made more secure)
   Me: Earn an affiliate profit
   Sucuri: Gets another customer to protect
   Hacker: One less victim/website sending people to the loan website

Even if victims don’t use Sucuri’s services, I’m pleased to inform them of the situation so they can get it rectified asap by whatever means possible. 🙂

Thank you – Mark Allbaugh

I can be contacted at: fix-loan-hack@alltrackusa.com

Visitors to this page:


Digits Web Counter