Recently a new extortion scheme targeting webmasters has emerged from the black/gray industry, and even Baidu is powerless against it — no fix yet. Today I’m exposing how it works from a technical angle.
First, the black/gray industry contacts a webmaster with various requests — free backlinks, free ad placements, and the like. If the webmaster refuses, they use this trick to get the webmaster’s site removed from Baidu, and hold that over them until they cave.
Technically, it abuses Baidu’s automated review mechanism. The playbook:
- Get a phone and root it. Modify the phone’s CA store to trust a self-signed SSL certificate.
- Connect to the hacker’s Wi-Fi LAN, where DNS is also the hacker’s — DNS resolution is intercepted to point at the hacker’s prepared server.
- On the rooted phone, install the Baidu app, search normally, and visit the victim webmaster’s site.
- Because of the DNS interception, the request lands on the hacker’s server.
- Because the trusted CA store was modified with root access, the hacker’s self-signed SSL certificate is trusted.
- The hacker’s server returns prohibited content, then files a complaint about the page through the Baidu app.
- After multiple people on multiple devices complain, Baidu’s AI reviewer becomes convinced the prohibited content is real.
- Baidu bans the victim webmaster’s page.
This works because Baidu trusts its AI automation too much, does no human review, and offers no appeal channel for webmasters. Victims can only sit there and take it.
There’s no solution at the moment — we can only wait for Baidu to overhaul its review mechanism. But as the saying goes: a lie repeated enough becomes the truth. Baidu may simply be unable to tell fact from fiction when facing a flood of complaints.
You might say: can’t Baidu just crawl the page? Some people configure DNS to serve special records to Baidu’s spider, or detect the spider’s User-Agent and serve different content — so Baidu doesn’t 100% trust what its spider fetches. Quite the opposite, though: the Baidu app is a client, showing each real user what they actually see, so Baidu trusts what the app reports back even more.
Running a website keeps getting harder, and webmasters are practically an endangered species. Hackers, please show some mercy — leave webmasters a little room to survive, and the internet stays richer for it.