OFFICIAL SECURITY BLOG
March 20, 2014 | BY Jérôme Segura
Update (03/21/2014): We received an email from beeg[dot]com’s owner:
Subject: We need you urgent attention. Your last blog post
we are the owners of the site. it’s hacked. we believe our servers are clean now. please add our comment to the post.
The last time an active infection was spotted by our systems was at: 03/21/14 at 00:28 AM.
Short of seeing server logs showing the hack, making a definite statement on what exactly happened is simply speculation. Google’s Safe Browsing report shows that “Part of this site was listed for suspicious activity 962 time(s) over the past 90 days.” which is still a little concerning.
Update (2): beeg[dot]com now displays a disclaimer/acknowledgment:
Most people would agree that browsing pornographic sites is a dangerous thing to do and often leads to all sorts of malware infections.
There are a number of reasons why any website can get hacked ranging from poor password hygiene to how valuable of a target it is, the latter often determined by how much traffic it is getting.
And this is precisely why this post is relevant. The site in question beeg[dot]com, is one of the top adult domains with an Alexa ranking of 332:
According to its owners, it also drives 5.6 million unique visits per day:
Our honeypots caught (the first instance being recorded on March 18 at 22:40) the site serving a drive-by download that originated directly from iframe injections including one on beeg[dot]com itself:
The domain within the malicious iframe does a typical 302 redirect
to an exploit kit (Sweet Orange) landing page, shown below using some obfuscation, which prepares the exploits to be launched on the victim:
In this case we were served two exploits:
For those interested in the exploitation->infection mechanism, the Fiddler capture below retraces what happened:
Google blacklisted beeg[dot]com shortly after initial detection, but as of writing this the blacklist warning had been removed while the site was still actively serving malware.
I tested our own Malwarebytes Anti-Exploit and it detected and blocked the exploit in its tracks:
While this particular infection happened on a pornographic site, it is important to keep in mind that any website can get hacked.
Yes, that’s right, even your Aunt’s delicious cup cake blog could be compromised.
The majority of website hacks are automated and not run by a human sitting behind a computer. There are scripts scanning the web for known vulnerabilities and weak passwords.
At the same time, when a high-profile site gets compromised, one has to wonder whether this was the work of an individual who spent the time and effort on it. After all, when your site receives millions of visitors per day, even a few hours worth of malware infections would generate a lot of money.