Hackers turn Cleveland into malware server...

January 2008

Tens of thousands of websites belonging to Fortune 500 corporations, state government agencies, and schools have been infected with malicious code that attempts to engage in click fraud and steal online game credentials from people who visit the destinations, security researches say. More than 94,000 URLs had been infected by the fast-moving exploit, which redirects users to the uc8010-dot-com domain. The security company Computer Associates was infected at one point, as were sites belonging to the state of Virginia, the city of Cleveland, and Boston University. Malicious hackers were able to breach the sites by exploiting un-patched SQL injection vulnerabilities that resided on the servers, according to the CTO for the SANS Internet Storm Center. The injections includedjava_script that redirected end users to the rogue site, which then attempted to exploit multiple vulnerabilities to install key-logging software that stole passwords for various online games. According to a researcher for ScanSafe, the exploits forced end users to visit sites that pay third parties a fee in exchange for sending them traffic. She speculates the attackers signed up as affiliates of the sites and then profited each time an end user was infected. The malware also installed keyloggers on end user machines that stole passwords to various online games, another researcher said. He added that the uc8010-dot-com domain was registered in late December using a Chinese-based registrar, indicating the attackers were fluent in Chinese.