SEO Poisoning (T1608.006) is a Resource Development sub-technique of Stage Capabilities. Its platform is PRE. The adversary manipulates search engine optimization so that sites hosting staged capabilities rank where victims will find them.
It sounds like a marketing problem. For developers, it is a supply chain problem too, because MITRE includes search inside developer platforms in its description.
How attackers use it
Search engines show results based on purchased ads and on a site's ranking, score and reputation as calculated by crawlers and algorithms. To help with Drive-by Compromise, adversaries stage content that manipulates those rankings to promote sites hosting malicious payloads, for example a Drive-by Target.
MITRE lists several tricks:
- Stuffing keywords into compromised sites, including as hidden text. The keywords may match the interests or browsing habits of intended victims, or seasonal topics such as elections and trending news.
- Targeting in-site searches on developer platforms such as GitHub, which rank results by their own metrics such as popularity. These can be gamed to push users toward Supply Chain Compromise lures.
- Buying or planting incoming links to staged capabilities, to boost the site's relevance and reputation.
- Combining SEO with evasive redirects and cloaking, such as measuring mouse movements or serving content based on browser user agents, language settings or HTTP headers, so the content passes scrutiny from defenders.
Examples on the page: Mustard Tempest poisoned search engine results to return fake software updates that distribute malware. NIMBUS MANTICORE used SEO poisoning, registered dozens of domains that link to a typosquatted domain to generate link-based reputation signals, and used keyword stuffing.
How to detect it
MITRE notes internet scanning may uncover content related to SEO poisoning or Drive-by Target if patterns were identified earlier. Most of it is out of your view, so focus on the phases that follow: Drive-by Compromise and Exploitation for Client Execution.
Signals you can use:
- Downloads that start from a search result click on a site nobody in your company has visited before, followed by an executable or installer running.
- New dependencies or repositories added because someone searched, rather than because they came from an approved source.
- Browser traffic to recently registered domains right before a new process starts on the endpoint.
How to reduce the risk
MITRE says this cannot easily be mitigated with preventive controls. Make the next steps safer:
- Download software from the vendor's own site or an internal catalog, not from the first search result.
- Provide an internal software portal so people do not need to search for installers.
- Verify repositories and packages before use. Popularity can be gamed. Check the publisher, the age, and the source.
- Pull dependencies from an approved mirror and pin versions.
- Restrict install rights so a convincing fake update fails to run.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. No login is needed, the file never leaves your machine, and it covers up to 100 dependencies. The Gold directory can help you look up a package you found through search.
Check your own environment
- Ask your help desk what people do when they need a tool. If the answer is "search for it", fix that path.
- Review recent installs on endpoints and ask where each installer came from.
- Check whether developers add GitHub repositories or packages straight from search results.
- Make sure there is a short, easy way for staff to report a suspicious download.
- Check which of your own pages could be abused for keyword stuffing, such as open comment sections.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why is SEO poisoning relevant to developers specifically?
MITRE notes it can also target in-site search on developer platforms such as GitHub, where ranking by popularity or similar metrics can be gamed to steer users toward supply chain lures.
What is cloaking in this context?
Serving different content depending on signals such as mouse movements, browser user agent, language settings or HTTP headers, so search crawlers and defenders see something harmless.
