Jump to content

This ancient CMS is being exploited by hackers — with governments and schools facing attack


Recommended Posts


Hackers are taking advantage of dozens of educational websites to poison search engine results, deliver phishing sites to victims, and engage in all kinds of fraudulent activity. 

The websites being abused in this campaign include MIT, Columbia University, Universitat de Barcelona, Auburn University, University of Washington, Purdue, Tulane, Universidad Central del Ecuador, and the University of Hawaiʻi.

Besides government sites, the campaign also targeted government and corporate websites, such as the site of the Government of Virginia, Austin, Texas, the website of the Government of Spain, and Yellow Pages Canada.

There are no free V-Bucks

The scheme was revealed by cybersecurity researcher @g0njxa, who posted on X a report outlining how they found websites using FCKeditor, a web text editor that allowed users to edit HTML content inside a web page.

Apparently, it was a popular solution a decade and half ago, but it rebranded to CKEditor in 2009. Responding to the findings, the CKEditor X profile said FCKeditor died in 2010 and should not be in use at all due to various security issues.

One of the security issues being exploited here is called open redirect, a feature that allows arbitrary redirection requests that send a visitor to an external URL without validating or running appropriate security checks. With open redirects, search engines will show the site being redirected to, as being hosted by the victim site.

Showing an example, @g0njxa posted a screenshot of search engine results for “Free V Bucks” (Fortnite in-game currency), on which websites such as the Barcelona University, or Tulane, were seen “hosting” free V-Bucks generators. 

As open redirect URLs don’t host the malicious content, BleepingComputer further explains, they can stay active for much longer and remain visible in search engine results before being flagged and taken down. What’s more, Google and Microsoft don’t even see open redirect as that big of a deal, and usually don’t react unless the attack escalates. 

Via BleepingComputer

More from TechRadar Pro

View the full article

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...