This ancient CMS is being exploited by hackers — with governments and schools facing attack

TechRadar · February 27

Hackers are taking advantage of dozens of educational websites to poison search engine results, deliver phishing sites to victims, and engage in all kinds of fraudulent activity.

The websites being abused in this campaign include MIT, Columbia University, Universitat de Barcelona, Auburn University, University of Washington, Purdue, Tulane, Universidad Central del Ecuador, and the University of Hawaiʻi.

Besides government sites, the campaign also targeted government and corporate websites, such as the site of the Government of Virginia, Austin, Texas, the website of the Government of Spain, and Yellow Pages Canada.

There are no free V-Bucks

The scheme was revealed by cybersecurity researcher @g0njxa, who posted on X a report outlining how they found websites using FCKeditor, a web text editor that allowed users to edit HTML content inside a web page.

Apparently, it was a popular solution a decade and half ago, but it rebranded to CKEditor in 2009. Responding to the findings, the CKEditor X profile said FCKeditor died in 2010 and should not be in use at all due to various security issues.

One of the security issues being exploited here is called open redirect, a feature that allows arbitrary redirection requests that send a visitor to an external URL without validating or running appropriate security checks. With open redirects, search engines will show the site being redirected to, as being hosted by the victim site.

Showing an example, @g0njxa posted a screenshot of search engine results for “Free V Bucks” (Fortnite in-game currency), on which websites such as the Barcelona University, or Tulane, were seen “hosting” free V-Bucks generators.

As open redirect URLs don’t host the malicious content, BleepingComputer further explains, they can stay active for much longer and remain visible in search engine results before being flagged and taken down. What’s more, Google and Microsoft don’t even see open redirect as that big of a deal, and usually don’t react unless the attack escalates.

Via BleepingComputer