Google goes over all the security issues reported on by Search Console in a new explainer video.
The video is another installment of Google’s Search Console Training video series on YouTube.
It’s actually a follow-up to Google’s last video which deals with the security issues report itself.
The previous video taught users how to find and fix security issues using the reports in Search Console.
This last video goes into more detail about he types of security issues and what causes them.
Hacking and Social Engineering
The types of security issues reported on by Search Console can fall into one of two categories: hacking or social engineering.
Hacking
There are many different types of hacks. The most common one is URL injection.
URL injection can happen through stolen credentials or outdated software, and allows hackers to gain unauthorized access to a website.
With unauthorized access hackers can remove, modify, or add content.
They can also steal user data or exploit the reputation of a website for their own commercial purposes.
Google Search Console reports on these three types of hacking:
- Injection of URLs: When a hacker creates new pages on a site containing spammy links. These links redirect users to other sites
- Injection of content: When a hacker adds unrelated content to a site’s pages, such as spammy keywords or gibberish text.
- Injections of code: When a hacker injects code into a website to change its behavior. For example, by sending spammy emails
How Hackers Gain Control
Hackers typically take control of a website in one of these ways by gaining access to an insecure directory on a server.
For example, there may be a directory with open permissions that you have forgotten about.
A hacker can take advantage of the open permissions to gain access to a site.
Hackers can also gain control of a website by exploiting a vulnerability in software running on a site, such as a content management system.
This typically happens when site owners are running an older, insecure version of a CMS.
Another way hackers gain control of a site is by hacking third-party applications like plugins or widgets.
Hackers look for technical signals to see whether a website is well protected or not.
If they see that a website is running an outdated version they might exploit a known vulnerability.
Social Engineering
Social engineering tricks users into doing something dangerous online, such as revealing confidential information or downloading malicious software.
One of the most common examples of social engineering is phishing.
Google safe browsing protects users by warning them before they visit deceptive websites or downloading harmful files.
If Google safe browsing detects that a website has deceptive content, the Chrome browser might display a “deceptive site ahead” warning.
Search Console will alert site owners by email if any types of social engineering content are detected.
Google recommends checking the security issues report at least once in a while to stay one the safe side.
Examples of Social Engineering
The most common examples of social engineering are:
- Deceptive content: the site tries to trick visitors into doing something they would only do for a trusted entities. For example, sharing a password or a credit card number.
- Deceptive ads: The site contains ads that falsely claim device software is out of date, prompting users to install unwanted software.
Since deceptive content makes users believe it is the original source, it may successfully trick them into sharing sensitive data.
Deceptive content may also include fake download buttons that trick users into downloading malware.
Other Types of Security Issues
In addition to social engineering warnings, Google Search Console reports on other types of security issues:
- Uncommon downloads: A site offers a download that Google safe browsing hasn’t seen before. Chrome may warn those who download it that it could be dangerous.
- These warnings are lifted automatically if Google safe browsing verifies that the files are safe.
- Harmful downloads: A site offers users a download that Google safe browsing thinks is either malware or unwanted software. Browsers such as Chrome may show a warning when a user visits your site.
- To remove this warning you must remove the links to harmful sites.
- Unclear mobile billing: A site is not sufficiently informing users about mobile charges.
- Chrome may display a warning before a user loads a page that incurs these chargers.
- Malware: A site has been infected by malware, or is hosting malware from a hacker. This can include software, a mobile application, or a script specifically designed to harm a device when a user knowingly or unknowingly installs it.
Final Thoughts
Some final words of advice from Google on security issues are to pay attention to the security issues report in Search Console.
The report may contain important information regarding the security of your site and your users.
And, as user, beware of social engineering.
Pay attention to warnings and do not fall for deceptive content and harmful downloads.
Related: Using Google Search Console to Find & Fix Security Issues
For more information, see the full video below:
