Staff writer
People who went to the city of Marion’s website by means of a Google or Bing search Wednesday through midday Tuesday found themselves where they didn’t intend to go.
Instead of Marion’s homepage, a website for an online pharmacy that sold drugs to treat erectile dysfunction came up.
That result was likely caused by a “malicious redirect.”
Tuesday morning, the redirect problem appeared to have been solved.
“At this point, I believe it’s resolved,” city administrator Roger Holter said.
Asked what happened, Holter couldn’t say.
“The service provider for the city is not providing any details at this time,” he said.
An independent investigation by the Record revealed that the redirection affected every computer attempting to reach the website via links from both Google and Bing.
This means the redirection was generated by the computer that hosts the city’s site, not by computers of people attempting to view the site or the search engines themselves.
Hacking tutorials uncovered by the Record describe what happened as a “Conditional Pharma Hack” and assert that the most common way it is accomplished is for a file called “.htaccess” in the root of the server directory to be modified by a person possessing the system’s highest level user name and password.
The problem unexpectedly cleared up Tuesday morning soon after the Record suggested that the city request to see the “.htaccess” file from its website.
When asked, Rick Burcky, a retired sanitation worker who runs the site for the city, denied that any malicious code had been entered in that file. He said he was at a loss to explain why the problem disappeared.
Asked if the city would take any action against anyone because of the problem, Holter said the city “continues to explore all options necessary to provide secure and reliable access to information via our website to our citizens and visitors.”
Burcky said anyone having problems getting onto the city website was welcome to call his mobile number at (620) 381-4013.
During a June 14 city council meeting, city clerk Tiffany Jeffrey said she would like to have a new city website.
The city website was affected by a similar attack April 24 to May 1, 2019.
Jeffrey said the city had talked to website hosting companies before the COVID-19 pandemic, and city officials had been told to comprise a list of what they would like to change about the city website.