Tuesday, March 22, 2011

Many University websites used for spam

In January, I wrote about many high profile websites, mostly universities, that were hijacked to redirect to fake stores. Many have since been cleaned up, but a few of these University websites are still redirecting users to new fake stores (adobe-discount.com, terrific-software.com, successful-software.net, mmpsoftstore.com, successful-software.com, successful-downloads.com, general-oem.com, etc.)

In the past 2 weeks, I've seen a significant amount of spam hosted on University websites. Spammers seem to be using compromised user accounts on wiki-like services to upload spam for Viagra, banking loans, online casinos, etc.

Fake pharmacy page hosted on the UCSF website
The list of Universities hosting such spam include:
  • MIT (hxxp://nola.mit.edu/~cil/nolawiki/images/7/70/Amortizing-loan-calculator.pdf)
  • Cornell (hxxps://confluence.cornell.edu/download/attachments/140416416/tab15.html)
  • UCSF (hxxp://dingo.ucsf.edu/twiki/pub/People/EricAadnes/tab7.html)
  • University of Pennsylvania (hxxp://george.isc-seo.upenn.edu/ocladmin/ocl/uploads/204599.txt)
  • University of Massachusetts (hxxp://xserv1.umb.edu/groups/podcasts/wiki/ce448/attachments/cec02/xs57.html)
  • Colorado State (hxxp://writing.colostate.edu/files/personal/108957/File_0FFC8EF8-EC2C-2238-F165D3DC0AA636A9.txt)
  • Oregon State (hxxp://foodfororegon.oregonstate.edu/sites/default/files/imagecache/al65.html)
  • OSU (hxxps://carmenwiki.osu.edu/download/attachments/16256437/tad44.html, down)
  • WUSTL (hxxp://cssa.grad.wustl.edu/sites/cssa.grad.wustl.edu/files/imce/user1208/ed60.pdf)
  • Eastern University (hxxp://ccgps.eastern.edu/members/dstore/member-blog.blog2/items/Cialis-Viagra-Online)
  • University of Washington (hxxp://modular.math.washington.edu:9001/role?action=AttachFile&do=get&target=sl45)
  • Oklahoma State (hxxp://asdevelopment.okstate.edu/logs/x.php?wy334=287)
  • Tufts University (hxxps://wikis.uit.tufts.edu/confluence/download/attachments/29761132/ced46.html)
  • National University of Singapore (hxxp://wiki.nus.edu/download/attachments/76947595/doc11.html)
  • and many others
There are thousands of these spam pages. They are used mainly in e-mail spam campaigns, hidden by a URL shortener.

The university and the fraternity I attended are amongst the victims as well: hxxp://alumni.iit.edu/s/946/forms/757/100824/game31.html, hxxp://pkp.iit.edu/bog/l.php?n249=300

University websites are becoming a preferred vector for different types of spam. The vast number of sub-domains, each of them likely managed by a different group which may not have professional IT/Security skills, make them an easy target.

-- Julien

3 comments:

Anonymous said...

When I kept getting those hijacked pages as false positives in Google searches I started contacting admins to cut them off. When I can actually get an admin to read what I send about 3/4 are surprised and promptly cut them off. On a good day I get 5000 or 10000 of these pages cut down. The other 1/4 either spam filter my abuse report or couldn't buy a clue if they went to the clue store.

Anonymous said...

One more clue proof domain I didn't think to mention in the last comment.

http://www.google.com/search?q=prescription+without+site:www.scribd.com
647,000 results

http://www.google.com/search?q=oem+download+site:www.scribd.com
70,000 results

Any advice you have or anything you can do will be greatly appreciated.
Thank you for helping combat fraud and spam on the net

Anonymous said...

http://www.google.com/search?q=prescription+site:ning.com
850,000 results

http://www.google.com/search?q=OEM+site:ning.com
62,900 results

http://www.google.com/search?q=buy+site:uprm.edu
60,800 results

http://www.google.com/search?q=prescription+site:uprm.edu
20,000 results

http://www.google.com/search?q=buy+site:mymym.com
35,100 results

http://www.google.com/search?q=prescription+site:mymym.com
17,600 results

http://www.google.com/search?q=OEM+site:jurispedia.org
28,000 results

http://www.google.com/search?q=no+OR+without+prescription+site:momlogic.com
22,600 results

http://www.google.com/search?q=OEM+site:momlogic.com
3,100 results

http://www.google.com/search?q=buy+site:articleart.com
12,900 results

http://www.google.com/search?q=OEM+site:articleart.com
8,000 results

http://www.google.com/search?q=buy+site:oui-iohe.org
8,000 results

http://www.google.com/search?q=prescription+site:oui-iohe.org
6,700 results

http://www.google.com/search?q=buy+site:augustana.edu
8,000 results

http://www.google.com/search?q=prescription+site:augustana.edu
740 results

http://www.google.com/search?q=buy+site:cityofhampton-ga.gov
2,650 results