back to article Top smut site Flashes visitors, leaves behind nasty virus

A massive malvertising campaign leveraging the recent Adobe Flash zero day vulnerability has surfaced on popular* adult site xHamster, analysts say. The attack served the Bedep Trojan to the site's 500 million viewers a month through a surreptitious exploit on the landing page. It did not take advantage of the Angler exploit …

  1. Anonymous Coward
    Anonymous Coward

    " Alexa tells us it's more popular than El Reg"

    Got figures for before the site redesign?

    1. dogged

      Re: " Alexa tells us it's more popular than El Reg"

      Maybe you need a Page 3 feature.

      1. This post has been deleted by its author

      2. Michael Habel

        Re: " Alexa tells us it's more popular than El Reg"

        Yes instead of showing Girls with their Kit off... Perhaps you could just show Kits?

        1. Anonymous Coward
          Anonymous Coward

          Re: " Alexa tells us it's more popular than El Reg"

          >Maybe you need a Page 3 feature

          Do you really want to see topless geeks?

          1. dogged

            Re: " Alexa tells us it's more popular than El Reg"

            > Do you really want to see topless geeks?

            Rule 34.

  2. Neil Barnes Silver badge

    As I pointed out only yesterday...

    http://forums.theregister.co.uk/forum/1/2015/01/28/youtube_flushes_flash_for_future_flicks/#c_2423907

    1. Dave 126 Silver badge

      Re: As I pointed out only yesterday...

      Your link isn't working, mate. I came across another broken link posted in the Reg yesterday - like yours it seems to have been truncated.

      Either two Reg readers have been clumsy with their text select>copy in 24 hours - plausible - or the Reg forums needs a tweak.

  3. Inventor of the Marmite Laser Silver badge

    "campaign leveraging the recent Adobe Flash zero day vulnerability "

    "leveraging"? Don't you mean "using"

    I won't say "pretentious twat"

    But I'll think it bloody loudly

    1. Mike Bell

      Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

      No, they mean "leveraging".

      Look it up. It's in the dictionary.

      1. Inventor of the Marmite Laser Silver badge

        Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

        Being in the dictionary doesn't make it sound any less pretentious.

        1. Phil W

          Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

          You calling it pretentious doesn't make it's use any less correct and appropriate.

          1. Inventor of the Marmite Laser Silver badge

            Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

            Never claimed it was incorrect or in appropriate. Just pretentious.

            Do keep up.

          2. Simon Harris

            @ Phil W: Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

            It's always best to ensure that you're using words correctly when commenting on the correct use of words.

            1. Phil W

              Re: @ Phil W: "campaign leveraging the recent Adobe Flash zero day vulnerability "

              Indeed, I blame auto correct and muphry's law. As is often the case I was typing on my phone where i use "it's" far more often than "its".

              1. Bloodbeastterror

                Re: @ Phil W: "campaign leveraging the recent Adobe Flash zero day vulnerability "

                "muphry's"...? Damn' autocorrect... :-)

                1. Phil W

                  Re: @ Phil W: "campaign leveraging the recent Adobe Flash zero day vulnerability "

                  If you believe my use of Muphry rather than Murphy was down to autocorrection you are incorrect, I suggest you consult Google.

          3. Bloodbeastterror

            Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

            Oh I just *love* people correcting others' English when they clearly haven't got a proper command of it themselves... :-)

            Its - possessive - "The dog wags its tail".

            It's - "It is" or "It has" - "It's a nice day" or "It's been a nice day".

            "The dog wags it is tail" and "The dog wags it has tail" make no sense.

            1. Anonymous Coward
              Anonymous Coward

              Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

              >"The dog wags it is tail" and "The dog wags it has tail" make no sense.

              A bit too simplistic, the ban on the possessive apostrophe on "it" is arbitrary.

              Let us consider the dog's tail, its tail wags.

              The "it" is the dog, but while the dog gets the possessive apostrophe the dog as it doesn't.

              http://english.stackexchange.com/questions/22603/why-doesnt-its-have-an-apostrophe

              No doubt I have broken numerous rules of grammar and speeling but in my defence I am not correcting but expanding upon the problem.

      2. Loyal Commenter Silver badge

        Re: "campaign leveraging the recent Adobe Flash zero day vulnerability "

        I think 'leveraging' is something the BOFH does on the roof, with an old tape safe, and a length of broom handle, and involves waiting for people who use the word in every-day conversation to walk past at street level.

  4. CAPS LOCK

    Adblock plus is your friend...

    ... ooops what a giveaway.

    1. Anonymous Coward
      Anonymous Coward

      Re: Adblock plus is your friend...

      Linux host, running clean Linux VM snapshot, through VPN + adblock + noscript

      I think it's quite safe, but you can never be sure...

      1. Phil W

        Re: Adblock plus is your friend...

        That's an awful lot of effort setting up a sandbox VM just to watch porn?

        1. illiad

          Re: Adblock plus is your friend...

          No, that will be 'full protection' from those who 'infest' those websites...

          hamster is a 'virgin' compared to the other awful sites out there.. some needing a 'hosts' entry to block their malware!!!

          you go out with a 'nice' girl, but you still use protection!!!

        2. janimal

          Re: Phil W

          I use the same scheme if I am going to surf the web at all without ad-block (I hate ads, but some decent sites wouldn't exist without them).

          1. illiad

            Re: Phil W

            Ahhh.. the argument *for* ads... Now, if all sites managed their adserver *properly* it would be easy to let their ads through...

            BUT!!! many sites use the SAME server as those ugly using it to spread rude, loud, NSFW content!!!

            so you block that server, and nice websites get blocked too... and of course you have not bothered to research!! goto https://adblockplus.org/ and you will see the message..

            *******

            "Unobtrusive ads aren't being blocked in order to support websites (configurable) "

  5. Zog_but_not_the_first
    Facepalm

    Not just smut sites

    I had a popup telling me "My Flash was outdated" and inviting me to run "installation.exe" (no, thank you) yesterday on the Daily Fail's site.

    (Actually, on reflection perhaps smut site was correct, after all.)

  6. Adam 1

    So firing up fiddler and, um "doing research for your story" eh?

  7. codejunky Silver badge

    So

    Did they use protection?

  8. Anonymous Coward
    Anonymous Coward

    Adblockers?

    Would readers using an adblocker have been protected from this opportunity?

    1. illiad

      Re: Adblockers?

      FULL adblock ( get them from https://www.fanboy.co.nz ) three main types, look at the site!! :)

      plus element hiding helper for adblock..

      flashblock with whitelist

      Yesscript is simpler , only blocks what you want..

      and DO note, patience and caution helps, dont just press button without looking!!!!!! :O

      1. Goldmember

        Re: Adblockers?

        Wouldn't having all that in place block the actual video, too? Or would you need to add every video to the whitelist?

        1. illiad

          Re: Adblockers?

          erm, not if you *USE* that thing above yer eyebrows.... :rolleyes:

          At least try it out and see how it works... http://flashblock.mozdev.org/

  9. Anonymous Coward
    Anonymous Coward

    So what platforms does the virus infect? Windows, Linux, Mac, Solaris, Android, iPhone? All of the above?

    1. Palpy
      Linux

      Indeed.

      Well, the virtual STD comes in through the Windows, and then it opens the backdoor. Once that happens, opportunistic infections are likely. Fortunately, penguins are immune to this STD -- though if they've had enough WINE they may act as carriers, I dunno.

      1. illiad

        Re: Indeed.

        Of course, it is the Lusers that are asked 'do you want to open the backdoor so I can ruin you??' they just shout 'TL; DR' and click OK...

        If a friend has not put on a good AV, "why? it came with kaspersky!!!"

        Virus sez: " ah, kaspersky LOLOL, expired.. let's ruin his day!!! :D :D

    2. tempemeaty

      "So what platforms does the virus infect? Windows, Linux, Mac, Solaris, Android, iPhone? All of the above?"

      Yes. This. Please.

      1. Palpy

        To be less coy about it...

        It's a Windows virus. See the Sophos and Virus Radar entries for Win64/Bedep.C, Win32/Bedep.B, etc. I believe it loads as a Windows dll (p2pcollab.dll, for instance). Mac, Linux, and BSD should be unaffected. If you run Solaris as a personal workstation, kudos and why?

        1. Truth4u

          Re: To be less coy about it...

          as suspected

          a nice fast linux machine with open source browser is like god mode for the internet. I hope linux doesn't win on the desktop because frankly the general public don't deserve an ops system that powerful. They can stick with their windows/xbox streaming/toy computers. Bonus points if they store all their files on someone else's file server. (lol).

          1. Anonymous Coward
            Anonymous Coward

            Re: To be less coy about it...

            One day everyone will run Linux, and then all the viruses will target Linux.

            I do wonder about these people who seem to think Linux has some kind of magical power that protects it.

            1. Crazy Operations Guy

              Re: To be less coy about it...

              "One day everyone will run Linux"

              By the time Windows goes away, I'd imagine both it and Linux would've been replaced by something entirely different.

    3. This post has been deleted by its author

    4. Dave 126 Silver badge

      It's a Windows virus. Even if it could infect iOS, it couldn't use Flash as a vector because a certain CEO didn't like it - citing security issues, battery life, mouse_over events not being suitable for touch-based UIs and a desire for app developers to use iOS-specific development tools:

      https://www.apple.com/hotnews/thoughts-on-flash/

  10. Anonymous Coward
    Anonymous Coward

    serves them right, filthy buggers

    they should have visited uk.gov and bbc.co.uk instead! And keep them filthy paws on the keyboard!

  11. Rol

    Full protection for your computer?

    Might I suggest cling filming your keyboard alongside NoScript and Adblocker.

    1. Bloakey1

      Re: Full protection for your computer?

      Ok, I have done that and have donned a fetching foil 'chapeau' but could you please tell me how I protect my scratch and sniff monitor?

  12. Michael Habel

    We at least the UK laws are thinking of the Children...

    Funny I thought that the UK populis was automaticly protected from this virulent plage. No thanks to thew anti-smut laws, unless they're ignorent enough to request there ISPs to not protect them to start with?

    1. Bloakey1

      Re: We at least the UK laws are thinking of the Children...

      My favourite thing at the moment is when you type in the name of a blocked site in the UK you get presented with "ACCESS TO THE WEBSITES LISTED ON THIS PAGE HAS BEEN BLOCKED PURSUANT TO ORDERS OF THE HIGH COURT" and a massive list of dodgy sites.

      I for one would like to thank the powers that be for giving me such an extensive list of dodgy sites to refer to when d̶o̶w̶n̶l̶o̶a̶d̶i̶n̶g̶ ̶W̶A̶R̶E̶Z̶ , cough, errrr, doing research .

    2. David Lawrence
      Headmaster

      Re: We at least the UK laws are thinking of the Children...

      My congratulations, sir, for the highest defect density I have seen in a posting for some while. Considering the relatively small number of words used, you have surpassed the usual levels attained by the regular clientele of this website.

      Awesome job. I assume you work in journalism, like a previous responder who doesn't understand the difference between "its" and "it's".

      Double fail.

      1. Anonymous Coward
        Anonymous Coward

        Re: We at least the UK laws are thinking of the Children...

        @ David Lawrence :

        And there's me thinking it was a spoof a la "From the message boards" in Private eye.

        How wrong can you be?

    3. Loyal Commenter Silver badge

      Re: We at least the UK laws are thinking of the Children...

      virulent plage

      Is that a French beach, near to a sewerage outfall?

  13. Nash

    Backdoor ...

    ...penetration

    that is all.

  14. oldtaku Silver badge

    Oxford Comma Me, Baby

    It's so El Reg that an article about porn would result in a (mild) grammar flamewar in the comments.

  15. Zzzzzzz78

    Uploading the Flash exploit to Virustotal and concluding AV is useless against the exploit is lame and unprofessional

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like