Topic: Online payment site hijacked by notorious crime gang

[Samker]

Online payment service CheckFree lost control of at least two of its domains on Tuesday in an attack that sent customers to servers run by a notorious crime gang believed to be based in Eastern Europe.

Reg reader Richard D. reported receiving a bogus secure sockets layer certificate when attempting to log in to his Mycheckfree.com account early Tuesday morning. On further examination, he discovered the site was mapping to 91.203.92.63. To confirm the redirection was an internet-wide problem, he checked the site using a server in another part of the US and got the same result.

"I managed to get through to a commercial customer support tech, and reported the problem," Richard wrote in an email sent early Tuesday morning. "He was not aware of any problem."

The account is consistent with results of passive DNS search queries such as this one from bfk.de. Spamhaus shows precisely the same thing here: http://www.spamhaus.org/sbl/sbl.lasso?query=SBL70072

Security experts say the 91.203.92.63 IP address has long served as a conduit for online crime. Spamhaus offers this laundry list of alleged dirty deeds that includes running botnet command channels and various drive-by download sites. According to security researcher Paul Ferguson of anti-virus software provider Trend Micro, the IP address was recently observed handing off booby-trapped PDF files that infected those unfortunate enough to open them.

According to bfk.de, Spamhaus, and SpyNoMore, several other web addresses are also being redirected to that IP address, including phgainc.org, brachetti.com, and camouflageclothingonline.net.

It's unclear how long checkfree.com and mycheckfree.com were redirected to the rogue servers or whether customers have been warned they may have been compromised. CheckFree spokeswoman Melanie M. Tolley declined to provide details except to say that the company took steps to correct the hijacking at about 8 a.m. California time on Tuesday. The impostor website was shut down about five hours later, she said.

Company employees are in the process of warning customers that they may have visited a malicious website masquerading as CheckFree.

"It is taking time to determine exactly what type of malware we might be dealing with but we are currently working on a program update that provides information to the customers about the incident and maintenance tips recommending that all of our users run scans with Symantec's scan utility, and install the latest patches for Adobe Reader, as well as make a regular practice of keeping their computer updated with the latest anti-virus software," Tolley wrote in an email.

"The important thing for our users to know is that the issue is now resolved and we are doing everything we can to mitigate risk."

She declined to say how many users CheckFree has, but she called the service "the leader in electronic billing and payment" that has "processed hundreds of millions of payments reliably since launching this business in 1981."

It's also unclear how the culprits managed to hijack the domains. While security experts say DNS poisoning wasn't out of the question, the more likely explanation is malicious transfer of the domains through their registrar. Indeed, whois records for both the addresses indicate they were updated sometime Tuesday.

That's the same technique hackers used in May to hijack Comcast's domain name and redirect confused users to a rogue site that bragged of the exploit for three hours.

No doubt, the hijacking of CheckFree seems to have caused some confusion among customers.

"I always pay my bills on the first of the month and I can't get into your website to pay my bills and this will make them late," one CheckFree customer complained here: http://www.complaintsboard.com/complaints/checkfreecom-c132622.html . "You COULDN'T pick a better time to update your website. LOUSY MANAGEMENT on your part."

(The Register)