The SEO industry is very focused on being SEOs

Written by Ian Gorrie Like many professionals, many attempt to avoid time consuming activities that are not core to their business. Business is enabled by the features and abilities of the software that it employs. These feature-rich software environments can, and usually do, have an invisible threat of insecurity. This is a perennial theme of information security writings and I myself have touched on it Web defacements are nothing new, but the media attention to SEO superstars is notable and makes their online presence an attractive high-value target. The recent mass defacement of SEO wordpress blogs that was launched from a technical adversary using tor is an example of what has become a not uncommon occurrence. What can SEOs, and bloggers in general, do to lessen the risk of public embarrassment from defacements, hacktivism, and information leakage? The answer is that quite a large number of things can be done to help prevent these incidents.

• Hardening of systems by reducing unneeded features. (For example, the bugfix for Wordpress v2.0.6 addressed a correction for those webservers that had left register_globals set to "on." Not recommended in the first place.)
• Hardening the web services themselves with security modules.
• Use of a NIDS or HIDS that will actively block or alert upon detection of questionable behaviors.

All of these methods involves time and resources that could best be applied to doing what they do best, in this case, being a SEO. It is a good example of where an application/hosted service provider model or the services of a competent information security advisor would show a lot of value in reducing the risks of media embarrassment and possible valuable information leakage. Ian Gorrie is a friend of mine and a former peer in the security world. I asked him if he would not mind doing a little write up from his perspective on the recent h4x0r fuckingpirate on the loose trying to take out all the SEO bloggers.