[!] Malvertising campaign hit Adult Site xHamster

[MrGusMuller]

We identified a malvertising campaign taking place on adult site xHamster (Alexa rank #68, est. 514 million visitors/month according to SimilarWeb) that abused ad provider TrafficHaus and Google?s URL shortener service.

This incident reminds us of a similar one that happened at the end of January also involving the same ad network.

Simply going on xHamster?s website could infect a PC if the browser or one of its plugins was not up to date. We notified TrafficHaus which responded immediately to shutdown the malicious ad, helping to limit the number of victims.

The redirection chain used by the criminals was quite effective in that it only strikes one time per IP address and cleverly hides itself within an innocuous piece of code.

https://blog.malwarebytes.org/malver...hamster-again/

[MrGusMuller]

https://www.traffichaus.com/
is the ad network running the malware ad

[xXXtesy10]

[The Porn Nerd]

This will cost sales.

[PAR]

By the sounds of it they removed the ad as soon as they knew about it.
No ad network is 100% malware free this is a sad reality.

The malware group that is using goolge's short url's has been at it for well over 2 years using this same setup. With their trigger being once per IP and targeting select browsers add to this them turning it on and off at different times of the day and sometimes off days at a time it makes it rather hard for any ad network to find before it's in the wild.

They have affected not only adult sites/ad networks but are also in the wild on the top main stream networks.

Chrome/google has flagged a number of times its own goo.gl short url service as an issue.


Google Safe Browsing diagnostic page for goo.gl

[The Porn Nerd]

Originally Posted by PAR

By the sounds of it they removed the ad as soon as they knew about it.
No ad network is 100% malware free this is a sad reality.

The malware group that is using goolge's short url's has been at it for well over 2 years using this same setup. With their trigger being once per IP and targeting select browsers add to this them turning it on and off at different times of the day and sometimes off days at a time it makes it rather hard for any ad network to find before it's in the wild.

They have affected not only adult sites/ad networks but are also in the wild on the top main stream networks.

Chrome/google has flagged a number of times its own goo.gl short url service as an issue.


Google Safe Browsing diagnostic page for goo.gl

Crazy they can't contain it somehow. Google does control the domain, after all.
Shit like this does cost sales because for many malware = shady and once lost it's hard to get a customer's trust back.

[Jel]

got this while stroking one off last night using xhamster on my mobile. starting downloading some shit and couldn't back out of it, hit the home button thingo on my galaxy, and finished off my wank by restarting internetz. I should check my phone I guess.

[PAR]

Originally Posted by The Porn Nerd

Crazy they can't contain it somehow. Google does control the domain, after all.
Shit like this does cost sales because for many malware = shady and once lost it's hard to get a customer's trust back.

Ya, it's one of the top 10 malware groups, google more than knows about them..
But even them scanning their own links isn't 100% and still leaves a big enough hole.
Can more be done...
Yes...

But I do not ever see a day where a surfer will ever see a message from an adult site that tells then they should get a proper AV or firewall software. Let alone a major mainstream site.