Home

WHID 2008-46: CheckFree customers redirected to fraudsters sites

Attack Information
WHID ID: 
2008-46
Date Occured: 
2 Dec 2008
Attack Method: 
Attack Method: 
Outcome Information
Outcome: 
Outcome: 
Target Information
Attacked Entity Field: 
Finance
Attacked Entity Geography: 
USA
Source Information
Attack Source Geography: 
Ukraine

In an attack with an alarming similarity to the COX incident (WHID 2008-45), but with a far greater potential damage, hackers changes the DNS records for CheckFree, the largest bill payment service in the USA. Customers where redirected to servers in the Ukraine, which attempted to install a password login software on their computers.

The change was done using correct credentials to login to the administrative web site of Network Solutions, CheckFree domain registrar. It is yet unknown how the hackers got the credentials. Since Phishing attacks against domain registrars including Network Solutions have started to surface recently, a good guess is that it was through a Phishing attack.

According to CheckFree report to the authorities, it estimates that around 160,000 customers where expoesed to the attack, and informed 5 million potential victims who may have been among this group.

Additional information: