Feeds

Online payment site hijacked by notorious crime gang

Your good name, our rogue servers

  • alert
  • submit to reddit

SANS - Survey on application security programs

Updated Online payment service CheckFree lost control of at least two of its domains on Tuesday in an attack that sent customers to servers run by a notorious crime gang believed to be based in Eastern Europe.

Reg reader Richard D. reported receiving a bogus secure sockets layer certificate when attempting to log in to his Mycheckfree.com account early Tuesday morning. On further examination, he discovered the site was mapping to 91.203.92.63. To confirm the redirection was an internet-wide problem, he checked the site using a server in another part of the US and got the same result.

"I managed to get through to a commercial customer support tech, and reported the problem," Richard wrote in an email sent early Tuesday morning. "He was not aware of any problem."

The account is consistent with results of passive DNS search queries such as this one from bfk.de. Spamhaus shows precisely the same thing here.

Security experts say the 91.203.92.63 IP address has long served as a conduit for online crime. Spamhaus offers this laundry list of alleged dirty deeds that includes running botnet command channels and various drive-by download sites. According to security researcher Paul Ferguson of anti-virus software provider Trend Micro, the IP address was recently observed handing off booby-trapped PDF files that infected those unfortunate enough to open them.

According to bfk.de, Spamhaus, and SpyNoMore, several other web addresses are also being redirected to that IP address, including phgainc.org, brachetti.com, and camouflageclothingonline.net.

It's unclear how long checkfree.com and mycheckfree.com were redirected to the rogue servers or whether customers have been warned they may have been compromised. CheckFree spokeswoman Melanie M. Tolley declined to provide details except to say that the company took steps to correct the hijacking at about 8 a.m. California time on Tuesday. The impostor website was shut down about five hours later, she said.

Company employees are in the process of warning customers that they may have visited a malicious website masquerading as CheckFree.

"It is taking time to determine exactly what type of malware we might be dealing with but we are currently working on a program update that provides information to the customers about the incident and maintenance tips recommending that all of our users run scans with Symantec's scan utility, and install the latest patches for Adobe Reader, as well as make a regular practice of keeping their computer updated with the latest anti-virus software," Tolley wrote in an email.

"The important thing for our users to know is that the issue is now resolved and we are doing everything we can to mitigate risk."

She declined to say how many users CheckFree has, but she called the service "the leader in electronic billing and payment" that has "processed hundreds of millions of payments reliably since launching this business in 1981."

It's also unclear how the culprits managed to hijack the domains. While security experts say DNS poisoning wasn't out of the question, the more likely explanation is malicious transfer of the domains through their registrar. Indeed, whois records for both the addresses indicate they were updated sometime Tuesday.

That's the same technique hackers used in May to hijack Comcast's domain name and redirect confused users to a rogue site that bragged of the exploit for three hours.

No doubt, the hijacking of CheckFree seems to have caused some confusion among customers.

"I always pay my bills on the first of the month and I can't get into your website to pay my bills and this will make them late," one CheckFree customer complained here . "You COULDN'T pick a better time to update your website. LOUSY MANAGEMENT on your part." ®

This story was updated 3rd December 2008 23:16.

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.