If you can create a scenario in which your competitors sites are seen by the search engines as hosting a bunch of spam/malicious links, your site can perform well in the void that is created. The techniques simply insert spam links into the target site. Once Google crawls that site and sees the spam it will see it is untrustworthy- once marked as spam the site may disappear altogether from the rankings.

This type of activity has been labeled "evil SEO", but that's way too simplistic a view. It is an attack, in the same way that a defacement is an attack. What is interesting is that the value of search has reached such a peak that any method for gaining search visibility is worth a shot for some people.

So how would someone do this?..

...if a site allows the execution of mark-up or code inserted from a publicly accessible mechanism- such as through a browser- it is vulnerable. For example, if your site runs SQL it is possible that that someone can manipulate the site to insert content, in this case spammy links, or links to flagged malicious websites. This is most often achieved through the browser. If there is no filtering for certain characters, or if it allows the insertion of a string of characters where only numbers should go, then your site is vulnerable.

Similarly, with non-SQL web applications and sites it may be possible to insert mark-up or code into a form input field, or browser that will create on-page changes to a site- allowing it to be populated with spam links. This technique is often called XSS (cross-site scripting) by the SEO community, but it is more properly recognised as plain HTML Injection. For a basic discussion of XSS see the Wikipedia entry.

Increasingly, rivals are undermining each others search engine optimization efforts and page rankings by exploiting web application vulnerabilities to fool search engines into categorizing them as untrustworthy, or very low/zero authority. There is also plenty of evidence that social bookmarking sites are also used in attacks. One method is to spoof the IP of the target site (creating web traffic using their address, rather than your own). Then bookmark a targeted page on their site using that spoofed IP. This can be done with multiple accounts, so it looks like the site is self-promoting on a grand scale. Once again trust, authority and rankings go out the window.

Of course security vulnerabilities are inevitable, but preventing many attacks can be achieved by building applications right, the first time round. Businesses need to know that the technologies they are using are not substantially flawed from the off, and suppliers and developers have a responsibility to implement secure code. This is cold comfort for those whose sites are vulnerable, and for who the costs of a code review or an application security test are out of reach- never mind any remediation work.