1

As a part of my project I had to scrape some motivational pictures, so I considered using the gallery section of the website, "Quotes Cover" - "https://quotescover.com/category/quotes-gallery". Kaspersky's green tick, the HTTPS protocol and the general look of the website made me assume it would be safe.

However, when I inspected the elements and tried to find the source of the pictures, they were all under [don't open this link] "https://quotescover.com/wp-content/uploads/". What I saw was a flickering website and a heading saying "Asalama Allaikum" (something like that). Terrified, I quickly shut it.

When I re-type that URL in the address bar, Chrome gives me a text, "_Tuan2Fay_". I type that in Google Images and I see a lot of "Your computer has been hacked" images. What's strange is that VirusTotal and Kaspersky URL checker say the site is completely safe. I have now submitted that site for a closer review to Kaspersky.

My question is, could this be that the pictures are safe but that site is some sort of a trick by the developer to scare me away from using this part of their site, or is this site actually malicious and I should not use Quotes Cover at all?

  • 2
    Site was hacked, probably an outdated Wordpress plugin is the culprit. Send an email to the site admins, and wait for them to fix it. – ThoriumBR Aug 13 '18 at 14:17
5

These does NOT tell the site is safe:

  • Kaspersky's green tick. It merely tells the site hasn't marked as a known harmful site.
  • HTTPS protocol, even with a trusted certificate, only tells your connection to the site is encrypted. This only means that the connection between your browser and the server is secured from 3rd parties. It has nothing to do with the content:
    • TLS protected sites can have vulnerabilities that can be used for modifying the contents. The site mentioned in your question is actually a good example of this.
    • Bad guys can buy or create free certificates for their web sites, too.
  • General look of the website. Most of the actually bad things happens when you don't notice. The longer you can hide, the more information you can steal.

A flickering website does NOT tell the site is malicious. It might look scary, but it's not a direct sign of anything else happening in the background. You'd have to look at the source code. This page had obfuscated JavaScript, but it was easy to deobfuscate. Most of the code was simply for creating the contents and the effects. It tries to load more JavaScript from external sources, but as they are all http:// resources on a https:// page, the browser refuses to load them.

The /wp-content/uploads/ is a standard directory for uploaded content. The site allows its users to upload own content, so probably some of such feature or other vulnerability was used to upload an index.php to that directory. The administrators of the site should be informed of such activities.

  • Indeed. These seems more like generic defacement. – forest Aug 14 '18 at 3:12
2

Sorry for that. I am webmaster of quotescover. It seems like it is the file remnants from a couple of years ago. My site was devaced because of some outdated plugins. The devacer sent an index.html to all folder. and I cant believe I missed this one. I have update and remove the plugins and consult with the hosting provider. About the site it just a quotes maker without any login. User cannot upload their own image there. The gallery content image is from us. Thanks for spotting this

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.