Pharma Hack

Hacked Off!!!

The pharma hack is an exploit that takes advantage of vulnerabilities in WordPress causing search engines to return adverts for pharmaceutical products along with legitimate listings. The hack can be difficult to detect because it does not affect the displayed pages of the compromised Web site or blog.

Photo credit: kennymatic via / CC BY

The purpose of the pharma hack is to make pharmaceutical sales sites they are promoting appear higher in Google results than they otherwise would.

The Google search engine ranks the list of hits for a given Web site according to (among other factors) the number of external sites that link to it.

By inserting the rogue code into an unsuspecting victim’s site, the hack in effect links that site to the cracker’s site. If done on a large enough scale, this tactic can result in the cracker’s Web site showing up near the tops of various hit lists resulting from keyword-based searches.

In WordPress, the pharma hack comprises files in the plugins folder that contain malicious code that runs other, disguised code in the database.

The code is disguised by reversing the order of the strings, thereby making the problem difficult to detect as a hack.

In order for the hack to work, the malicious files must exist in the plugins folder. Once activated, the hack pings Google to find out how many links exist for a particular listed Web page. The more links a page has, the more “desirable” a target it makes, and the greater is the likelihood that it will be hacked.

The Hack


The Hack without the html

Gobbleygook but with all the pharma keywords:

  • Levlen without prescription
  • levlen without prescription again!
  • It, have good tackling the: tube Viagra days using
  • Tamanu does the my sublingual cialis online with longer do time
  • cypro without a prescription there after the what is the correct dosage of
  • Cytotec like on looked buying meds in tijuana
  • cilift for delivery in uj great and. You last and oils of so.
  • Smells generic propecia pharmacy that else Melon canadian levitra tablet the from
  • Try viagra ajanta personally dandruff not GF that

You can by entering a specific character sequence into the Google search engine find out if a given site has been compromised by the pharma hack.

Type “site” followed by a colon, then the domain name followed by a space, then “Viagra” then¬†hit the search button.

If the site has been affected, unusual descriptions linked to actual pages or blog posts will appear.

The modified title tag and links can only be seen in search results, not in the hacked site itself.

Victims of the pharma hack have reported decreased traffic to their sites and, in some cases, removal of their sites by Google from search result lists.

Because Web site owners cannot readily see when they have been pharma hacked, the online reputation of a legitimate company or individual can be seriously damaged before the rogue code can be removed.

Once discovered, the code can be taken out of the affected files, although the process can take considerable time and effort.

Protection from Web Security Vulnerabilities

All website owners should be protecting their websites with respected and proven web security software from companies such as Wordfence or iThemes Security. Both these companies also provide free versions of their professional security products