Hackers Use MIT Server to Hack 100,000 Sites
November 7, 2011 2:42 PM
comment(s) - last by
Nearly five months of attacks went unnoticed and successful thanks to the MIT domain's strong reputation
Most content-heavy sites on the web today are driven by a mix of PHP and SQL. Unfortunately, exploits abound from popular PHP database manager frontends like PHPMyAdmin. Thus, "hacking" many websites has been reduced from an art down to a "brute force" search for applicable SQL vulnerabilities [
]. And that's just was cybercriminals want.
In this bold new world of SQL injection having a reliable host for your "brute force" attack web-crawler program is essential. A recent incident involving an infected server at the
Massachusetts Institute of Technology
shows how *.edu servers may be the perfect vehicle to carry out cybercriminals' attacks.
The MIT server had the perfect profile to carry out attacks. It had bandwidth aplenty. And it piggybacked on its school's strong reputation, making its requests automatically appear trusted and less suspicious.
MIT's campus [Source: Aisha]
Thus it's not surprising that once a malicious softbot was planted on the MIT server that it was able to wreak havoc on the internet for nearly six months.
The attacking server was identified by Bitdefender, the antimalware arm of Romanian-based software firm Softwin. It is unknown how the malicious software was planted on the server. What is clear is what the attacking software has been doing.
The attacking server (CSH-2.MIT.EDU) would locate webpages and initiate a set of SQL injection attempts using GET requests and certain characters troublesome sequences like "//". An example is seen below in the
"GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1"
"GET /muieblackcat HTTP/1.1" 404 "GET //scripts/setup.php HTTP/1.1" 301
"GET //admin/scripts/setup.php HTTP/1.1"
"GET //admin/pma/scripts/setup.php HTTP/1.1" 404
"GET //admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404
"GET //db/scripts/setup.php HTTP/1.1" 404
These attempts targeted vulnerabilities in PHPMyAdmin versions 2.5.6 to 2.8.2. PHPMyAdmin is an open source frontend that
at the popular software repository SourceForge. It has an impressive 50k+ downloads a week. The latest version is 3.4.7.
The attacks compromised a reported 100,000+ websites in the five months since the MIT server was compromised in June.
The script would use injection attempts to deface pages, dumping keywords on them that would elevate their page rank. It would also dump images from BlogSpot, DeviantART, and Tumblr, among others, on the front-page.
Over 100,000 webpages were compromised by the rogue MIT server. [Source: SecurityWeek]
The telltale sign of the compromised pages was a directory "muieblackcat", which was created on the victims' server space.
For now the attack has been silenced, but it serves as a warning of the growing dangers of SQL injection attacks and the potential of abuse of trusted *.edu servers.
wrote a piece
on the attacks, suggest implementing anti-injection rewrite rules/conditionals and to rename your PHPMyAdmin script to prevent quick identification from casual attackers.
This article is over a month old, voting and posting comments is disabled
11/8/2011 10:24:22 PM
How about learn the command line so you don't have to rely on web based gui to manage your databases?
"Paying an extra $500 for a computer in this environment -- same piece of hardware -- paying $500 more to get a logo on it? I think that's a more challenging proposition for the average person than it used to be." -- Steve Ballmer
Nokia is the Victim of SQL Injection, Loses Developer Records
August 29, 2011, 8:37 AM
LulzSec Strikes Again, 1M Sony Pictures User Accounts Compromised
June 2, 2011, 6:27 PM
Sony Loses Yet More Customer Records, 3 More Sites Hacked
May 25, 2011, 8:16 AM
Sony Appears to Have Lost Yet Another User Database
May 23, 2011, 9:09 AM
Pirate Bay Hacked, 4 Million User Records Looted, Site Is Down
July 8, 2010, 10:31 AM
AT&T Defeats Purpose of New Apple SIM, Locks iPad Air 2 SIMs to Its Network
October 24, 2014, 2:17 PM
Microsoft to Discontinue Free, Ad-supported Xbox Music Service on December 1
October 23, 2014, 10:03 AM
Christian Bale Confirmed to Play Steve Jobs in Upcoming Film
October 23, 2014, 8:43 AM
Monica Lewinsky Speaks Out, Calls Herself "Patient-Zero" for Internet Cyberbullying
October 21, 2014, 2:25 PM
Google Fiber Finally Heading to Austin, Texas in December
October 16, 2014, 11:48 AM
Dropbox Flexes Security Muscle, Appears to Have Squashed Password Breach
October 15, 2014, 12:12 PM
Most Popular Articles
Chinese Government Declares Digital War Against America's Top Tech Firms
October 20, 2014, 12:07 PM
Samsung Announces Galaxy S5 Plus with Snapdragon 805 Processor, LTE-A
October 22, 2014, 3:40 PM
Windows 8.1 + Android "Sell Mini PC" w/ Bay Trail Creates New PC Form Factor
October 20, 2014, 5:07 PM
Apple's iPad Air 2 Features Triple-core A8X Processor, 2GB of RAM
October 21, 2014, 8:32 PM
Apple Releases iOS 8.1; Adds Apple Pay Support, SMS Relay, Instant Hotspot
October 20, 2014, 1:00 PM
Latest Blog Posts
The Surface Mini That Was Never Released Gets "Hands On" Treatment
Sep 26, 2014, 8:22 AM
ISIS Imposes Ban on Teaching Evolution in Iraq
Sep 17, 2014, 5:22 PM
Space Terrorism is a Looming Threat For the United States
Apr 23, 2014, 7:47 PM
Facebook Aims to Provide Internet to "Every Person in the World" with Drones, Satellites
Apr 1, 2014, 10:20 AM
Retail Mobile Sites Experience Outages in Light of Simplexity's Bankruptcy
Mar 14, 2014, 8:48 AM
More Blog Posts
Copyright 2014 DailyTech LLC. -
Terms, Conditions & Privacy Information