HN Explorer

Ask HN: is the California state park website leading to malware?

4 points by jph ↗ HN
California state parks use a reservation system that seems to be hacked by malware, by using a DNS typo masquerade, then tries to install Chrome extensions.

What do HN readers recommend to 1) stop the problem now, 2) protect the website for the future?

To reproduce:

1. Visit this California parks page: http://www.parks.ca.gov/?page_id=616

2. Notice the highlight text: "go to reservecaliforrnia.com to view available campsites" and see the misspelling with the extra "r".

3. Go to that misspelled domain name. It redirects to "gogetsplendidapps" and/or to prompt to install Chrome extension "Keep Safe Search". Google reports this as malware.

Update: I'm reporting the issue to the real website, and to the real domain name registrar.

What are approaches to terminate the hack website?

What are suggestions for long-term defense against this kind of attack? For example to install software for many users that would have blocked/refused the hack website?

5 comments

[ 3.1 ms ] story [ 26.5 ms ] thread
slater
Not for me. Check your browser's installed extensions/add-ons, and remove any that might have been taken over.
jph
Thanks for helping! I just added more to the report above-- the problem looks to be upstream, and due to a domain name error.
slater
oh yeah, it's a typo and someone is using the typo-squatted domain for nefariousness!

1) correct: reservecalifornia.com

2) incorrect: reservecaliforrnia [dot com]

Note two 'r'

blinky1456
I have noticed these malicious chrome install rediects have odd behaviour, sometimes they trigger sometimes they don't.

The often only trigger once, when you visit it. And that's it.

I think it is to make it harder for people to report it, as it does not always pop up/redirect. 'maybe it is just your machine, seems ok on my end'

petee
It looks like a simple typo, double hitting the r. I would contact a couple people from the website to alert them to the error.

If it were malware, they would have gone ahead and made it a real link