3 ms·
Ask HN: is the California state park website leading to malware?
California state parks use a reservation system that seems to be hacked by malware, by using a DNS typo masquerade, then tries to install Chrome extensions.
What do HN readers recommend to 1) stop the problem now, 2) protect the website for the future?
To reproduce:
1. Visit this California parks page: http://www.parks.ca.gov/?page_id=616
2. Notice the highlight text: "go to reservecaliforrnia.com to view available campsites" and see the misspelling with the extra "r".
3. Go to that misspelled domain name. It redirects to "gogetsplendidapps" and/or to prompt to install Chrome extension "Keep Safe Search". Google reports this as malware.
Update: I'm reporting the issue to the real website, and to the real domain name registrar.
What are approaches to terminate the hack website?
What are suggestions for long-term defense against this kind of attack? For example to install software for many users that would have blocked/refused the hack website?
- slater 7y agoNot for me. Check your browser's installed extensions/add-ons, and remove any that might have been taken over.
- jph 7y agoThanks for helping! I just added more to the report above-- the problem looks to be upstream, and due to a domain name error.
- slater 7y agooh yeah, it's a typo and someone is using the typo-squatted domain for nefariousness! 1) correct: reservecalifornia.com 2) incorrect: reservecaliforrnia [dot com] Note two 'r'
- blinky1456 7y agoI have noticed these malicious chrome install rediects have odd behaviour, sometimes they trigger sometimes they don't. The often only trigger once, when you visit it. And that's it. I think it is to make it harder for people to report it, as it does not always pop up/redirect. 'maybe it is just your machine, seems ok on my end'
- petee 7y agoIt looks like a simple typo, double hitting the r. I would contact a couple people from the website to alert them to the error. If it were malware, they would have gone ahead and made it a real link