image
U.S. military and government website subdomains have a sticky problem: They’re “quite vulnerable” to blackhat SEO tactics that result in persistent redirects to spammy Viagra ads and porn videos. An example is one that showed up on a dot.mil subdomain on the Minnesota National Guard site (you can have your own fun searching on terms such as “buy generic and brand Viagra” on dot-gov and dot-mil sites: Plenty of these ads are still out there) that asks this question: How are erections measured while a man sleeps? Two small rings are placed around the penis, one at the tip and one at the base. Edwards told Motherboard’s Vice – which first reported his findings – that the reason a lot of government websites are hosting these spammy ads is that an array of government agencies are using the same software: one that, it turns out, has a now-patched vulnerability that allowed third parties to push files to these sites without the site owners’ permission. It’s called Laserfiche, and it’s made by a government software provider that produces content management systems and sells them to the Army, the Navy, the FBI and more, according to public procurement records such as this one for the City of Fort Worth (PDF). “This vulnerability created phishing lures on .gov and .mil domains that would push visitors into malicious redirects, and potentially target these victims with other exploits,” Edwards told Motherboard in an online chat. Blackhat SEO campaigns featuring redirects have been…

Source