Hacked EDU Website Serves All-You-Can-Eat DoS

Compromised MIT server swings a digital fist at innocent websites

Once in a rare while in a world replete with hack attacks, a single computer hack manages to stand out of the crowd. Such is the case with the hack against, the web infrastructure of one of the world’s most prestigious universities.

It’s been weeks of talks on technical forums with respect to relentless attacks against websites built atop the PHP-and-SQL technologies – vulnerable sites that are turned into tools for malware dissemination or “brute-force” attacks. This type of campaign alone is estimated to claim 100,000 or more victims.

Judging by initial data, one MIT server (CSH-2.MIT.EDU) hosts a malicious script actively used by cyber-crooks to scan the web for vulnerable websites. It is currently unknown how the crawler bot was planted on the MIT server, but it is certain that it probes the web for hosting accounts that come with a vulnerable version of PHPMyAdmin, the popular database frontend for MySQL servers.

PHPMyAdmin is used by web developers and site administrators to connect and perform specific SQL operations over the web, such as creating, reading, updating and deleting information from the database. Our information shows that the vulnerable versions of PHPMyAdmin range from 2.5.6 to 2.8.2.

When the crawler located on the MIT infrastructure finds a vulnerable version of PHPMyAdmin, it tries to gain administrative privileges to inject a SQL query into the database. If the website has been successfully compromised, the crawler leaves behind a folder called “muieblackcat” – a mutex that acts as a mark of infection. This is not the only damage to the attacked server. Depending on how solid the attacked server is, the multitude of GET requests per second might grind it to a halt.

As a top level reliable domain, .edu is primarily used by educational institutions in America and other trustworthy organizations. A trackback from such a domain is a vote of confidence for an article, a blog, an entire site, or even an institution. In short, an infrastructure the size of is not only guaranteed to have huge bandwidth to carry thousands of malicious requests per second, but is also a good way to evade firewalls that obviously accept traffic from as legit.

This explains the interest crooks have always shown in redirecting attacks towards sites registered in this domain or other trusted ones to involve them, for instance, in promoting illegal merchandise or dubious content.

This article is based on the technical information provided courtesy of Doina Cosovan, BitDefender VirusAnalyst.

All product and company names mentioned herein are for identification purposes only and are the property of, and may be trademarks of, their respective owners.

About the author


A blend of teacher and technical journalist with a pinch of e-threat analysis, Loredana Botezatu writes mostly about malware and spam. She believes that most errors happen between the keyboard and the chair. Loredana has been writing about the IT world and e-security for well over five years and has made a personal goal out of educating computer users about the ins and outs of the cybercrime ecosystem.

1 Comment

Click here to post a comment