Feeds

Online payment site hijacked by notorious crime gang

Your good name, our rogue servers

  • alert
  • submit to reddit

SANS - Survey on application security programs

Updated Online payment service CheckFree lost control of at least two of its domains on Tuesday in an attack that sent customers to servers run by a notorious crime gang believed to be based in Eastern Europe.

Reg reader Richard D. reported receiving a bogus secure sockets layer certificate when attempting to log in to his Mycheckfree.com account early Tuesday morning. On further examination, he discovered the site was mapping to 91.203.92.63. To confirm the redirection was an internet-wide problem, he checked the site using a server in another part of the US and got the same result.

"I managed to get through to a commercial customer support tech, and reported the problem," Richard wrote in an email sent early Tuesday morning. "He was not aware of any problem."

The account is consistent with results of passive DNS search queries such as this one from bfk.de. Spamhaus shows precisely the same thing here.

Security experts say the 91.203.92.63 IP address has long served as a conduit for online crime. Spamhaus offers this laundry list of alleged dirty deeds that includes running botnet command channels and various drive-by download sites. According to security researcher Paul Ferguson of anti-virus software provider Trend Micro, the IP address was recently observed handing off booby-trapped PDF files that infected those unfortunate enough to open them.

According to bfk.de, Spamhaus, and SpyNoMore, several other web addresses are also being redirected to that IP address, including phgainc.org, brachetti.com, and camouflageclothingonline.net.

It's unclear how long checkfree.com and mycheckfree.com were redirected to the rogue servers or whether customers have been warned they may have been compromised. CheckFree spokeswoman Melanie M. Tolley declined to provide details except to say that the company took steps to correct the hijacking at about 8 a.m. California time on Tuesday. The impostor website was shut down about five hours later, she said.

Company employees are in the process of warning customers that they may have visited a malicious website masquerading as CheckFree.

"It is taking time to determine exactly what type of malware we might be dealing with but we are currently working on a program update that provides information to the customers about the incident and maintenance tips recommending that all of our users run scans with Symantec's scan utility, and install the latest patches for Adobe Reader, as well as make a regular practice of keeping their computer updated with the latest anti-virus software," Tolley wrote in an email.

"The important thing for our users to know is that the issue is now resolved and we are doing everything we can to mitigate risk."

She declined to say how many users CheckFree has, but she called the service "the leader in electronic billing and payment" that has "processed hundreds of millions of payments reliably since launching this business in 1981."

It's also unclear how the culprits managed to hijack the domains. While security experts say DNS poisoning wasn't out of the question, the more likely explanation is malicious transfer of the domains through their registrar. Indeed, whois records for both the addresses indicate they were updated sometime Tuesday.

That's the same technique hackers used in May to hijack Comcast's domain name and redirect confused users to a rogue site that bragged of the exploit for three hours.

No doubt, the hijacking of CheckFree seems to have caused some confusion among customers.

"I always pay my bills on the first of the month and I can't get into your website to pay my bills and this will make them late," one CheckFree customer complained here . "You COULDN'T pick a better time to update your website. LOUSY MANAGEMENT on your part." ®

This story was updated 3rd December 2008 23:16.

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.