Red Hen website suffers SEO spam compromise

Malware Bytes Labs ^ | 27 June 2018 | Christopher Boyd

[COBOL2Java]

---

If you’re thinking about checking out the website owned by the restaurant that asked White House press secretary Sarah Huckabee Sanders to leave the premises, you might want to hold off. There’s some site compromise action afoot.

Although the homepage appears to be acting in a perfectly normal manner, turning off scripts so you can see what’s happening under the hood provides a rather stark visual discrepancy.

Visiting as normal:

Visiting with scripts turned off:

Why yes, that’s a collection of Viagra spam text injected into the website with the aim of giving a search engine boost to the sites linked. What you’re seeing here is the otherwise “hidden” code leaking through onto the page; it actually resides in the HTML source like so:

The sites hoping to get a search engine boost from the compromised restaurant page are pushing pharmaceuticals. Here’s the first example, a shopping portal for Generic Viagra:

The second is for a prescription drug I’m not even going to attempt to pronounce:

Old hat

This is an absolutely ancient black hat tactic, most typically referred to as a form of SEO (Search Engine Optimisation) spam, or “Spamdexing.” Threat actors either use dirty SEO tactics to drive high traffic to their pages or they capitalize on already highly-trafficked targets by hiding their links in subtext.

[COBOL2Java]

Another link to a similar story (without the techie stuff):

The Red Hen restaurant that refused to serve Sarah Sanders was hit by a cyberattack

[Dilbert San Diego]

I wonder if this restaurant owner is wealthy, if she depended on this restaurant to earn a living?

Will her liberal friends bail her out, financially, since she really showed Sarah Sanders who is boss and all of that?

[libstripper]

Pretty soon they’ll be advertising male and female masturbation devices. At that rite they’ll become a sex site and suffer a bit of a hit to their restaurant business or have to spend a pot of money having to fix their web site. Couldn’t happen to nicer people.

[SkyPilot]

Her cousin is wealthy actress Meryl Streep.

[Dilbert San Diego]

When does the restaurant owner get on TV, do a media tour, and claim to be the victim? I haven’t heard of her going on TV yet to defend and justify her actions.

Where is she? The hosts on MSNBC would do a powder puff interview with her. Is she too shy to go public and defend her actions? She has freedom of speech and freedom to run her business as she wants. So let her exercise her freedom and tell the world why she did what she did.

[IYAS9YAS]

Interesting. I tried looking at a menu from a local Albuquerque restaurant months ago, and what was interesting was, when I hovered over the link for the menu, it looked normal (gave me the url of the restaurant), but when I clicked the link for the menu, it sent me to some on-line pharmacy ordering site.

I figured someone had hacked the page. But this looks like it may have been what was going on.

[Luke21]

Used to be a common virus tactic to allow your computer to only access Viagra ads.

[Texas resident]

I wonder if the owner is kicking herself for listening to her fragile triggered waitstaff.

Her financials will remind her of how big of a mistake this was.

[TigersEye]

I don't want to eat at this Red Hen restaurant.

[I want the USA back]

Awwwww. My heart bleeds for them.

[Governor Dinwiddie]

#3: "I wonder if this restaurant owner is wealthy, if she depended on this restaurant to earn a living?"

Good question. My conclusion is that she is at least somewhat wealthy. She also runs a boutique yarn shop in the same town.

In my experience, I have seen these operations time and again in small college towns. Usually the husband has a pretty good job, at least enough to indulge his wife's hobbies.

This restaurant only seats twenty six people. This lady charges $28 for a pork chop and grits. She has a large staff. She would be lucky to break even and cover the rent. Maybe she owns the building, though.

Nobody in the rural South is going to pay $28 for a pork chop and grits—nobody except a transplanted northerner who has the word "sucker" written all over his back. You know that the local main street merchants aren't going to patronize her place. They have to make a living and can't fritter their money away on boutique food.

The woman has bucks, and can afford to play the game of restaurant owner.
 

[Flick Lives]

I wonder if the owner is kicking herself for listening to her fragile triggered waitstaff.

On Yelp, the Red Hen has now achieved a perfect 1-star rating with over 13,000 reviews. Sweet.

https://www.yelp.com/biz/the-red-hen-lexington-3

[Kozy]

Even money that it never reopens. So san!

[sauropod]

Bkmk

[Dilbert San Diego]

I’m not familiar with Lexington, so I thought maybe it’s a tourist oriented town, and that tourists are the ones who pay $28 for the porkchops?

In any event, her business will certain take a hit, since they clearly let us know you have to be liberal/radical/anti Trump to go there.

[CottonBall]

“fragile triggered waitstaff.”

I’m thinking she just used them as an excuse. She’s too lily-livered to say it was her own idea. she followed these poor people across the street, even after Sarah was no longer with them.

[ßuddaßudd]

ooopppsssyy,,
did I do that?¿

[snarkpup]

The old WordPress Pharma Hack. Several years ago a local campus Republicans site as well as the Colorado National Monument site got infected with this. I don't think either one was fixed. The former was abandoned and the latter was completely replaced.

Only people who disabled JavaScript knew what was going on. Everyone else was simply wondering why Google searches were tagging the site as possibly compromised.

[jonrick46]

Is the Red Hen closed? I looked at the Red Hen's menu on Facebook. Evidently, they change their menu and this latest one may be changed next week. Obviously this is overpriced stuff, and with only five items on their main menue, the cook staff could make them in their sleep. This is their main course menue:

ENTREES

Pan Seared Arctic Char $25 Sunflower Flats Herb Risotto, Heirloom Tomato Vierge

Blackened Pork Chop $25 Donald's Meats, Wades Mill Espelette Grits Pipérade, Sula's Garden Kale

Cardamom Spiced Duck Breast $26 Donald's Meats Smoked Bacon Lentils, Brandied Peaches, Dijon

Vegetable Risotto $24 Sunflower Flats Snap Peas, Sula's Garden Kale, 2yr Aged Pecorino

Rosemary Basted Ribeye $28 Buffalo Creek Beef, Horseradish Creme Fraîche, Grana Padano

This is a photo of their ribeye. I am not a fan of scorched ribeye and we have steak houses in my area that would put this eye sore to shame: