Forgot your password?
typodupeerror
Security United Kingdom Windows

Regular Domains Have More Malware Than Porn Sites 122

Posted by CmdrTaco
from the wouldn't-have-seen-that dept.
SnugglesTheBear writes "New research pours scorn on the comforting but erroneous belief that Windows surfers who avoid smut and wares on the Web are likely to avoid exposure to malware. A study by free anti-virus firm Avast found 99 infected legitimate domains for every infected adult website. In the UK, Avast found that more infected domains contained the word 'London' than the word 'sex.' Among the domains labeled as infected by Avast was the smartphones section of the Vodafone UK website. The mobile phone operator's site contained a malicious JavaScript redirect script that attempted to take advantage of an unpatched Windows Help and Support Centre flaw (CVE-2010-1885) to infect the machines of visiting surfers."
This discussion has been archived. No new comments can be posted.

Regular Domains Have More Malware Than Porn Sites

Comments Filter:
  • by Animats (122034) on Wednesday June 30, 2010 @01:10PM (#32747088) Homepage

    "London", as a keyword, is a heavy spam target. I used to use "London Hotels" as a test case for SiteTruth's web spam detector. [sitetruth.com] Google used to do badly on that search. (Since they started handling travel destinations as a special case, the first 10 Google results are now either paid ads or results from the business search engine.)

    • Which category did they place www.sexlondon.co.uk in?
    • by Z00L00K (682162)

      And then it's a lot better effect to spread malware through ad networks.

      Design an ad that contains a time bomb and that triggers randomly will make it sneaky enough to penetrate machines randomly and inconclusive. Make sure that the ad is displayed on a high-profile site where a lot of users have low tech skills.

      Spammers and malware creators are getting sneaky and sometimes do have a legitimate front and a dirty back.

  • The question is (Score:3, Interesting)

    by dmgxmichael (1219692) on Wednesday June 30, 2010 @01:12PM (#32747112) Homepage

    How many of those redirects lead to adult sites? A very large number I'd imagine.

    Further actual numbers mean little - what percentage of porn sites are infected (or deliberately take malware related action) as opposed to legitimate sites?

    • by vxice (1690200)
      shh we don't want more attention on our porn sites. Although when will people learn to stop going to shady sites that require executables on their web page. I mean pictures are just that, pictures and so are videos. Stick to simple video and picture content that does not allow for executable content and you should encounter very few problems.
      • Re: (Score:3, Informative)

        by Syncdata (596941)
        A few rebuttles to your comment and others on this thread. Downloaded plugins and such are not necessary on a website for malware to transfer. All that is necessary is for an advertisement to load which contains the means for a cross site scripting attack. You don't even have to click on anything once you visit the site.

        And yes, these attacks happen on totally legitimate sites that are not very discriminating on the ads they run, or whose admins do not properly defend their server against worms/ teh h
        • This is true.

          My most recent detection, by Avast, of malware on a site was from a client's site that is REALLY basic. Bit of HTML, that's all. The thing is he linked some "visitor counter" on the site, bam, malware.

          The most frequent sites to throw malware warnings by Chrome or Avast seem to be corporate sites, not porn. I don't think I've ever had one for redtube or youporn.

    • by commodore64_love (1445365) on Wednesday June 30, 2010 @01:35PM (#32747520) Journal

      So however you look at it, you get fucked.

      • VLC?

        I have watched stuff accelerated with audio that seemed fine (there is something to correct for the chipmunk effect) and most of their features are platform independent.

        • VLC does work but it makes everything sound like a chipmunk. That's what is nice about the 2xAV plugin for Windows Player - it sounds natural even when sped-up

          • Have you tried recently? You may have to activate scaletempo in preferences (should be automatic post 1.0 though)
    • Re: (Score:2, Insightful)

      by nacturation (646836) *

      Further actual numbers mean little - what percentage of porn sites are infected (or deliberately take malware related action) as opposed to legitimate sites?

      Exactly. 99 regular sites infected to 1 porn site infected is rather telling if there are 1000 times more regular sites, which would mean that you have a ten-fold increase in risk on porn sites. As usual, this is a non-story that boils down to nothing more than a press release for Avast: "You're at risk! Buy our crap which will slow down your computer and probably won't detect much anyways!"

      • Re: (Score:3, Informative)

        by BenoitRen (998927)

        Exactly. 99 regular sites infected to 1 porn site infected is rather telling if there are 1000 times more regular sites, which would mean that you have a ten-fold increase in risk on porn sites.

        Way to miss the point, which is that avoiding porn sites doesn't mean you won't get infected. This proves that there are many regular sites out there that are infected, ratio of anything be damned.

        As usual, this is a non-story that boils down to nothing more than a press release for Avast: "You're at risk! Buy our c

        • Way to miss the point, which is that avoiding porn sites doesn't mean you won't get infected.

          Of course it doesn't. People who've been around the net from the early days are well used to seeing porn and goatse and all, so they've no big reason to avoid it. The vulnerable people are the n00b grandmas and managers who think porn is the scary part of the net and that being good by just playing those quizzes that everyone sends them.

          Honestly, this is common sense. Hardly article worthy.

          • by BenoitRen (998927)

            Honestly, this is common sense. Hardly article worthy.

            Sadly, "common sense" isn't common at all. You should know this. Otherwise we wouldn't have most of the population thinking the web's porn domains are the scary part of the web.

        • Exactly. 99 regular sites infected to 1 porn site infected is rather telling if there are 1000 times more regular sites, which would mean that you have a ten-fold increase in risk on porn sites.

          Way to miss the point, which is that avoiding porn sites doesn't mean you won't get infected. This proves that there are many regular sites out there that are infected, ratio of anything be damned.

          They're making a claim involving a ratio. I'm pointing out a flaw in their claim. If the ratio is unimportant, they shouldn't have mentioned it. And they've "proven" something that was already widely known in the security community and re-packaged it as news.

          As usual, this is a non-story that boils down to nothing more than a press release for Avast: "You're at risk! Buy our crap which will slow down your computer and probably won't detect much anyways!"

          Avast is free. It even says so in the summary.

          And we all know the summary is heavily fact checked by the Slashdot editors, right? From http://www.avast.com/free-antivirus-download [avast.com] : "Enjoy worry-free web surfing - Innovative Sandbox technology protects you from dangerous websites" -- not availa

          • by BenoitRen (998927)

            They're making a claim involving a ratio. I'm pointing out a flaw in their claim.

            There is no flaw in their claim, as there are more porn sites out there than you think. More than a third of the domains consists of porn. Hence if there are 99 regular infected domains for every infected porn domain, there is a lot more malware on regular domains.

            And they've "proven" something that was already widely known in the security community and re-packaged it as news.

            The question is, though, has it ever been proven b

    • Re:The question is (Score:5, Interesting)

      by pseudorand (603231) on Wednesday June 30, 2010 @01:57PM (#32747858)

      > How many of those redirects lead to adult sites?

      Probably not many. After all, porn sites actually have a legitimate (or at least legal) internet business model with revenue. Why do they need to infect their customers with malware? The newspapers on the other hand are struggling to figure out how to get people to pay for their content.

      What's more, I imagine mostly lonely guys visit porn sites. And who are lonely guys? Geeks! (present company excluded, of course :). And geeks use Firefox, NoScript, etc., so they're hard to infect. If you want to build your fleet of rooted zombies, I'd imagine sites that a bunch of old people who are still using IE 5 on unpatched Windows 2000 is your best bet. And unless they've responded to a Viagra e-mail, I would guess grandma and grandpa aren't visiting porn sites.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        What's more, I imagine mostly lonely guys visit porn sites. And who are lonely guys? Geeks!

        Well, you'd be imagining wrong, because the correct answer to the question who visits porn sites is EVERYONE.

      • Re: (Score:2, Informative)

        being a porn site isn't the silver bullet that means you will make money. Also, there was a slashdot article [slashdot.org] saying that more porn sites were infected than expected. I'm not exactly sure how these two articles mesh up, but specifically that article had said that people in the porn industry tend to trade content to lower operating costs. So all it takes is one link in the chain putting malware in that content to infect multiple sites.
      • by b4upoo (166390)

        How about surfing from a live CD edition of a Linux distro? Talk about making a PC hard to infect!

  • makes sense... (Score:4, Insightful)

    by gandhi_2 (1108023) on Wednesday June 30, 2010 @01:12PM (#32747120) Homepage

    there's competition in the porn world... they want to make money.

    vodafone, like most carriers, will be making money no matter what.... thanks to monopolies, duopolies, market segmentation and such.
    this creates a lazy attitude towards security, among other things.

    is anyone surprised by this, really?

  • by zill (1690130) on Wednesday June 30, 2010 @01:12PM (#32747126)

    In the UK, Avast found that more infected domains contained the word 'London' than the word 'sex.'

    Maybe it's due to my weird fetishes, but none of the porn sites I visit actually contain the word "sex".

  • by meerling (1487879) on Wednesday June 30, 2010 @01:13PM (#32747138)
    It's all fine and good to point out that for every porn site there are 99 non-porn sites that have malware.
    But what are the percentages of said catagories infected?
          What percentage of porn sites have malware?
          What percentage of non-porn sites have malware?
    If the percentages are high enough for a category, it is a good idea to avoid that category, even if it is a tiny percentage of total sites.
    • Re: (Score:3, Insightful)

      by logjon (1411219)
      Assuming that porn sites make up > 1% of all websites (a pretty safe assumption,) then the ratio of (infected regular sites/uninfected regular) sites is still higher than that of porn sites.
    • by wisnoskij (1206448) on Wednesday June 30, 2010 @01:24PM (#32747322) Homepage

      Over 37% of the internet is porn (http://idle.slashdot.org/story/10/06/16/1722258/Over-a-Third-of-the-Internet-Is-Pornographic)

      therefore porn sites have a far smaller probability for malware then non porn sites.

      • Re: (Score:3, Funny)

        by JamesTRexx (675890)
        Then I vote for more pornsites on the net!

        Either that or block everything but .xxx domains...
    • Re: (Score:3, Interesting)

      No, I think the percentages are kind of irrelevant.

      Basically what you are asking for is a census of the internet. And what qualifies as a porn site and what qualifies as a non-porn site can reeeaaaallly blur the lines. Suppose Break is used to showing off hot Swimsuit models? Pornographic? Probably not. They show a Pic of a spring break girl flashing? Ehhh it's hard to call it pornography even though theres nudity.

      I think it generally boils down to what sites can you trust vs what sites you can't trust. And

      • by BenoitRen (998927)

        I think it generally boils down to what sites can you trust vs what sites you can't trust.

        Wrong. You can't trust any site.

      • by nu1x (992092)

        Generally, I consider porn to be when bodily liquids of genital genesis are displayed - described (or implied).

    • by tomkost (944194)
      In other words, there are more people posting useless articles who are not name CmdrTaco than those who are. So, we should avoid those not named CmdrTaco since this article is definitely useless???
    • by NevarMore (248971)

      Except there are only two categories of websites:
      Porn
      Not Porn

      So you should be able to extrapolate the data you want from there.

    • Researchers at Texas A&M are crawling the web and finding such statistics such as these. I do believe they have found that around 20% of websites on the internet are porn sites.
  • by mooingyak (720677) on Wednesday June 30, 2010 @01:15PM (#32747164)

    Does that still hold true in terms of traffic? It doesn't matter how many sites have malware, it matters how often those sites are visited. One high volume site with malware does more damage than a thousand sites that no one visits.

  • "A study by free anti-virus firm Avast found 99 infected legitimate domains for every infected adult web site."

    Maybe there are just 99 regular websites to every porn site out there.

    • Re: (Score:2, Informative)

      by crazypip666 (930562)
      I assure you there aren't. If you believe this story [slashdot.org], then more than a third of the internet is porn.
    • by c+era (102193)

      Maybe there are just 99 regular websites to every porn site out there.

      You must be new to this internet thing.

  • by Gaygirlie (1657131)

    Vodafone UK infected... well, it WOULD be embarrassing if it was about any other company, but with all the bad things I've heard about Vodafone you probably get better quality service and stabler applications even via the infection than from Vodafone.

  • by Monkeedude1212 (1560403) on Wednesday June 30, 2010 @01:16PM (#32747192) Journal

    People in the porn business are in it to make money. For the most part, they work together. Ever notice how they all link/ad/popup to more sites all within their clique?

    There's more money in repeat subscriptions than regular joe getting infected with Malware.

    • People in the porn business are in it to make money. For the most part, they work together. Ever notice how they all link/ad/popup to more sites all within their clique?

      No, of course I've never noticed that. No virtuous person would have knowledge of such things. Either that, or they're too busy looking at other things on those web pages...

    • by JWSmythe (446288) <jwsmythe@jws[ ]he.com ['myt' in gap]> on Wednesday June 30, 2010 @02:07PM (#32748014) Homepage Journal

          Actually, the reason you'd see the same or similar ads in a particular genre of porn would be that porn folks are usually pretty good at targeted marketing. For the successful ones, they watch their revenue streams very carefully. They learn (through trial and error mostly) which ad campaigns work, which ones don't, and the best placement on their pages.

          There are some shady dealings too, where folks running ad campaigns shave profits. If campaign A gives them 1:300 conversion rate, but campaign B gives them a 1:600 conversion rate, but all other things are the same (same type of content, same cost and membership length) you can look at the possibility that the company running the campaign is stealing from you.

          Popovers, popunders, jumping monkeys, or whatever aren't the biggest concern of the webmaster. If that ad method didn't make money, it wouldn't be used. It's not worth it for the webmaster to waste space and/or time with ads people don't click on, or worse, ads that don't pay.

          For most of them, it's far from their best interest, to have a malware infected site. If you go there, and your antivirus does kick off saying "This site is infected, run!", you're very likely not to go there again. You may tell your perv friends "Hey, don't go there, it has viruses." If it's a "clean" site (as in viruses, not smut level), you may be back every day, and tell your perv friends "hey, check this site out."

          Word of mouth doesn't seem like it would be that significant, but it is. I worked at one of the highest trafficked adult sites for many years. They got that big by word of mouth. SEO on the site was almost nonexistent, unless you are looking for their name only, which they usually abbreviated, making that useless too. It was in their best interest to keep it a safe place to go.

          I'd guess most of the malware stuff is either done by dirty webmasters who don't ever expect to have a repeat visitor, or (and more of) lost and lonely porn sites in virtual hosting environments, where the user permissions were all set wrong. Have 0666 / a+rw on your files is an open invitation for anyone else on that machine to cause you a lot of grief.

          A lot of times, people don't even know that the problem exists. I was helping someone out with a non-porn site. I pulled down a copy of the live site with wget. That was fine. I went to their location, and we downloaded the entire contents of their site, and there were two html files with javascript malware in them, that weren't linked from the live site. It appears someone else on the server had a script crawl through and add their malicious payload to any default.html that was world writeable. The script kiddies can't tell if the files are actually used, they just write to anything they can. Sometimes they'll stick it in any .html or .htm file that's world writeable, but that takes longer than just sticking it in any index.html or default.html that they can.

          Regular webmaster type folks usually only have a handful of sites. Porn webmasters usually have hundreds or thousands of them. It's all about how much exposure your content gets. If I have one site, the chances of someone tripping over my site are slim. If I have 10,000 sites, the chances get much better, which means my ads are seen and I can make more money. People rarely set up porn sites for their love of the topic. They do it to make money.

    • by mfh (56)

      There's more money in repeat subscriptions than regular joe getting infected with Malware.

      I don't have an opinion on what you just said. I just am happy to be discussing porn on Slashdot.

  • by crazypip666 (930562)
    I would imagine that part of the reason for this is that the idea that so many adult sites are infected drives adult sites to be very careful, so they don't get infected. If it gets out that an adult site is infected, there are plenty of others out there for people to go to, adult sites simply can't afford to become infected.
  • by Anonymous Coward

    A "study" done by an anit-virus firm finds that there are a lot of infected web sites out there. Regardless of the validity of the study, it seems that there is a HUGE conflict of interest here. A company in the business of protecting users for malicous websites publishes a study showing that there are a lot of malicous websites out there.

  • by southpolesammy (150094) on Wednesday June 30, 2010 @01:24PM (#32747328) Journal

    Uptime.
    Penetration testing.
    Viral infections.

    Discuss amongst yourselves...

  • To validate this study...

    Which sites did they "study"?

    • by SmallFurryCreature (593017) on Wednesday June 30, 2010 @04:20PM (#32749658) Journal

      Are you truly prepared to traverse the deepest darkest corners of the internet? Where unspeakable things happen and are best left untouched? Where your very soul is at risk and your sanity might be stripped from you with one wrong click?

      Do you really got what it takes to fire up your browser and go to a mobile phone operator site?

      I think not.

  • This isn't surprising. In a way advertisers and malware authors have a lot in common. They both want to have their ware's in places with the highest visibility, and they both want you to get something you may not want or need... As much as we all love to joke about how much porn there is on the internet I think we all realize there's more to it than just that.
  • There are more people NOT named CmdrTaco than those who ARE. Yes, the total number is higher, but what about the percentage???
  • Get rid of those affiliate marketing schemes and the financial incentive for click-jacking, etc., goes way down.

    Malware author: "If I can get credit for sending traffic to your site, then what's to stop me from infecting as many sites as I can and making money off it?"

    Want malware to drop? Boycott anyone who uses affiliate marketing.

  • what kind of infection are we talking about?

    an adobe flash attack vector?

    or hepatitis b?

  • Like I needed a reason to visit porn sites...
  • by DrJimbo (594231) on Wednesday June 30, 2010 @01:52PM (#32747762)
    I lived in a centrally located but rather crummy neighborhood of NYC back in the early '80s. Late at night cars would be backed up up several blocks waiting in a line so they could turn down my street and pick up a hooker.

    Funny thing is, the neighborhood seemed perfectly safe. I never had any trouble getting to or from my apartment at any hour of the day or night. I figured it was probably one of the safest areas of NYC because any crime would have been bad for business.
    • Re: (Score:1, Interesting)

      by Anonymous Coward

      By this fascinating logic, Mafia headquarters should be totally safe.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        I just had to reply, first time ever on /.

        Yes. Mafia-controlled neighborhoods ARE very safe. It's the modern version of Pax Romana. Just don't challenge the status quo there.

  • by puppetman (131489) on Wednesday June 30, 2010 @01:53PM (#32747794) Homepage

    when swingers are more likely to have an STD than a prostitute [reuters.com] and a regular domain has more malware than a porn site.

    Obviously, the sex-professionals, be it high tech or human beings, are far more careful than an amateur.

  • Porn sites have a built-in defense mechanism. It's hard to hack when your hands are busy.

  • The porn site people are smart and dont want to load your computer with malware and get blocked in firefox as an attack site. They want to be discrete and keep you coming back. Its the hackers that who dont care who's site they ruin by sneaking in hidden iframes and fake anti virus scanners.
  • Yea, but that's sort of like saying "Hookers take more Penicillin than Doctors do".
  • by hduff (570443)

    Don't use the web if you use a Microsoft OS and browser.

    • by mjwx (966435)

      Don't use the web if you use a Microsoft OS and browser.

      Remember that's a Boolean and. So if you're using a Microsoft browser with a non Microsoft OS then you're safe to use the web, you should probably seek professional help but you're safe.

  • by bugs2squash (1132591) on Wednesday June 30, 2010 @03:05PM (#32748756)
    he is tired of life...
  • by asdf7890 (1518587) on Wednesday June 30, 2010 @03:13PM (#32748876)

    Am I the only one who isn't surprised? I would expect porn sites to be less infected than regular sites.

    Admins and designers who work on such sites are more likely, than those that work in more "innocent" areas, to be exposed to the lower end of human behaviour through using spammers and ropey affiliate schemes to draw in traffic. If you are aware of what nefarious things you do (or could do) and more importantly what your competition do or could do then you are going to be more clued up on how careful you need to be with site security.

    Ignoring the lower end of human behaviour (there must be at least one or two porn sites out amongst the millions that don't spam/crack/what-ever to make an extra few $), to be successful financially a porn site need to be secure, otherwise people would just hack in and take the content for nothing. It is simply good business for them to be security concious, especially the smaller outfits/franchises that are run by a small team (where the designers/programmers/admins are more likely to be directly affected in the wage-slip if the site is hacked). Designers, programmers and admins working on a small and possible not very sensitive part or a much larger organisations output (like the vodafone example mentioned) may not be as directly aware of such issues. The "smartphones section" of their site, assuming this is a phone/contract sales area, is not likely to have cracking types trying to steal content. Now a site (or part there of) that is offering paid-for downloadable content I would expect to be "safer" than other areas for the same reason as a porn site: the content needs to be protected more than the content of a brochure page.

  • by TekJannsen (1001150) on Wednesday June 30, 2010 @07:25PM (#32751458)
    ...by avoiding non-porn sites altogether!
  • I think the real story here is two fold;

    The first is [obvious]:
    More pages with Malware contained 'London' because of those Geo-Spam ads that usually come from Virus-laden ad networks. "Hot Singles waiting for you in London!" You know those ones. Facebook does it too, just a little bit less flagrantly.

    The second is the fact that Vodafone UK is serving up Malware. That's awesome.

Information is the inverse of entropy.

Working...