'Shady' Porn Site Practices put Visitors @ Risk

[Barefootsies]

It's always interesting to read the mainstream media opinion of porn.

Visitors to porn sites are at serious risk of being exploited by cyber criminals, a study has suggested.

It found that many sites harboured malware or used "shady" practices to squeeze money out of their visitors.

By creating their own porn sites researchers found that many consumers were vulnerable to known bugs and loopholes.

Competition among porn sites makes the online adult industry ripe for abuse by hi-tech criminals.

"They have almost inadvertently created a whole ecosystem that's easy to abuse for cyber crime on a large scale," said Dr Gilbert Wondracek, a computer security expert from the International Secure System Lab, which led the study.
Hidden danger

Dr Wondracek said the team embarked on the study to find out the truth of the widely held view that porn sites are dangerous to visit.

"There are studies looking at the profitability and economics of the industry but we are the first to come at it from a security and more technical point of view," he said.

Statistics suggest that approximately 12% of all websites offer pornography of one sort or another and that 70% of men under 24 browse these sites.

As a first step the researchers trawled pornographic sites to classify what they found and how the industry was structured.

The big distinction was between free sites and those that charge for access. Typically pay sites produce content they give to free sites to drum up traffic.

More than 90% of the 35,000 pornographic domains analysed in the study were free sites.

The researchers analysed the 269,000 websites hosted on the 35,000 domains to see which hosted malicious software. About 3.23% of these sites were booby-trapped with adware, spyware and viruses.

Many others used "shady" practices to keep visitors onsite. These included javascript catchers that made it hard for people to leave a page.

Others use scripts that re-direct visitors so when they click on a link they do not see the video or image they were expecting but are passed to an affiliate site.

The vast majority of sites engage in this trading of traffic or clicks, said Dr Wondracek.

"Visitors are being abused as click bots," he said.

As most sites were free, the only resource they could exploit as a revenue source was this traffic.

"It's cut-throat competition," said Dr Wondracek. "Everybody tries to get as much traffic as possible."
Finding victims

Traffic is used in many different ways. Popular sites sell it to those looking for an audience, some is used to direct visitors to affiliates who provide content and sometimes it is used to boost rankings in search engine indexes.

It could also be a great way for hi-tech criminals to get a ready source of victims, said Dr Wondracek.

To test this idea the researchers created two adult sites of their own, populated them with free content from porn producers and spent $160 (£108) to get traffic piped to these sites.

Analysis of the 49,000 visitors sent to their sample sites showed that 20,000 were using a computer and browser combination that was vulnerable to at least one known exploit.

"As an attacker you want to make your life easier," said Dr Wondracek. "If you can have these 20,000 people come to a place instantly, why not?"

With many porn sites appearing in the top 100 most popular sites on the web this could mean that huge numbers of people are caught out when they browse for adult content.

While relatively few porn sites were infecting visitors, it is difficult to spot good from bad, he said.

"For the average user it might be hard to tell an honest porn site from a dishonest porn site until you click on something," he said.

Dr Wondracek recommended that anyone visiting porn sites keep their security software up to date and use the "safe browsing" modes found in many browsing programs.

The researchers presented their results at the Workshop on the Economics of Information Security held at Harvard from 7-8 June.

http://news.bbc.co.uk/2/hi/technology/10289009.stm

[Caligari]

old article. i love it when "doctors" go to great lengths/time/money/research to end up stating the obvious!

"Visitors are being abused as click bots," he said.

[Agent 488]

that article was crap.

[sortie]

Originally Posted by Barefootsies

It's always interesting to read the mainstream media opinion of porn.



http://news.bbc.co.uk/2/hi/technology/10289009.stm

I guess I'm mainstream then, because I didn't read anything in that article
that I objected to.

[Agent 488]

of course "captain save an industry" wont read it and say it\s about cross sells.

[seeandsee]

it;s not problem in porn, it's problem in people making problems

[Paul Markham]

Maybe we should all start selling anti virus programs from our sites as well as porn.

[Agent 488]

one study i read the most dangerous sites out there were like mp3s, ringtones etc. porn wasn't on the list. this article is hype.

[Caligari]

yes i would still consider mainstream far more lethal. warez, torrents...i wouldnt touch that shit with a ten foot pole.
not only that, half the shit being sold in mainstream is snake oil, bullshit rip off crap.
thats not to say there isnt bullshit in adult, but the majority of the time you know what you are getting.

[sortie]

Originally Posted by Caligari

yes i would still consider mainstream far more lethal. warez, torrents...i wouldnt touch that shit with a ten foot pole.
not only that, half the shit being sold in mainstream is snake oil, bullshit rip off crap.
thats not to say there isnt bullshit in adult, but the majority of the time you know what you are getting.

People who got hit with $150 in cross sales might disagree.

[Agent 488]

Originally Posted by sortie

People who got hit with $150 in cross sales might disagree.

buy any acia, teeth whiteners, money making guides, or free product trials lately?

mainstream is 1000% worse and the real cause of the new visa regs.

[woj]

"The researchers presented their results at the Workshop on the Economics of Information Security held at Harvard from 7-8 June."
I can see some blogger doing "research" like this for shits and giggles, but don't these researchers have better things to do? what good came out of this study? that 3% of porn websites are infected?

[Caligari]

Originally Posted by sortie

People who got hit with $150 in cross sales might disagree.

i would agree there are the shady bullshit practices in adult, just saying the most of the time you get what you pay for.

in the numerous test sign ups i have done with adult sites in my life i have yet to get hit with a hidden x sell or cross sell. granted i am looking for it, but anyone buying a subscription should also be looking.

on my sites when i get into review mode i tell people to be always look carefully before signing up. i probably get less sign ups doing this but i think i gain more trust and repeat visits with surfers.

[Quagmire]

Originally Posted by Paul Markham

Maybe we should all start selling anti virus programs from our sites as well as porn.

You mean like a lot of the mainstream flash game portals that install the toolbars and SecurityAV and SecurityEssentials2010 fake anti-virus stuff?

We're vilified in porn, yet almost all the warnings I get about exploits when surfing are from mainstream sites, not checking porn links.

(yes I know your post was tongue in cheek)

[Relentless]

www.WebsiteSecure.org helps ethical sites earn more by certifying paysites for security conscious consumers.

[sortie]

Originally Posted by woj

"The researchers presented their results at the Workshop on the Economics of Information Security held at Harvard from 7-8 June."
I can see some blogger doing "research" like this for shits and giggles, but don't these researchers have better things to do? what good came out of this study? that 3% of porn websites are infected?

Probably none; but the researchers don't know what the project will yield until
after the research is complete. At that point, why not publish what you found
since throwing it away doesn't do anything either.

[Grapesoda]

Originally Posted by Caligari

old article. i love it when "doctors" go to great lengths/time/money/research to end up stating the obvious!

"Visitors are being abused as click bots," he said.

studies show that teenagers are interested in sex

[Barefootsies]

Originally Posted by bm bradley

studies show that teenagers are interested in sex

Funny how that works with puberty.

[Barefootsies]

Originally Posted by Quagmire

We're vilified in porn, yet almost all the warnings I get about exploits when surfing are from mainstream sites, not checking porn links.

Agreed fine sire.

[Barefootsies]

Originally Posted by Relentless

www.WebsiteSecure.org helps ethical sites earn more by certifying paysites for security conscious consumers.

Yeah, I noticed there are a few of those now a days. They have been advertising in some of the trade mags. I wonder how big a difference they truly make.

[Cyber Fucker]

Who made this research? This is complete bullshit.