• 14850 Online main page

Ithaca, 24 June 04 -- CFCU Community Credit Union acknowledges that its public web site was compromised earlier this week, and software on the site infected the computers of users visiting the web site. Only Windows computer users who visited the web site on Monday, or possibly over the weekend, might have been infected. Macintosh or Linux users would not be affected at all.

"New vulnerabilities are exploited each day. Vigilance is the only fool-proof tool one can use against hackers." -- Daniel Adinolfi

The company that hosts CFCU's web site cleaned up their web server, and, Hegedus says, "moved our site to another server entirely. They had us back in operation late on Monday afternoon." She stressed that "Virtual Branch [the credit union's online banking and bill payment service], which is the tool most people come to the web site for, was not affected and is from another provider." Virtual Branch users who accessed that site directly would have had no problem; only users who went to the main CFCU web site en route might have been infected.

"I was surprised the web site tried to install a program on my machine," said Denise Ramelot, a CFCU member in the Ithaca area who accessed the site earlier this week. Her computer wasn't infected, because she doesn't use her computer in "administrator" mode on a daily basis, and because she has ZoneAlarm software installed to protect the computer. "My ZoneAlarm said 'No way,' so my machine stayed unhacked." ZoneAlarm, from Zone Labs, Inc., provides firewall protection for Windows computers connected to the Internet, as well as virus protection.

• Zone Labs, Inc. web site

Hegedus declined to identify the specific virus or Trojan horse that the credit union's web site was spreading, but said it was "a fairly new virus" that would be detected by the latest versions of popular anti-virus software tools.

Bob Witty, CFCU's president and CEO, added that all computer users "really should maintain the latest working anti-virus software." The two credit union officers said the credit union was not in a position to help members whose computers had been adversely affected following a visit to the CFCU web site. Daniel Adinolfi, senior security engineer with Cornell University's IT Security Office, agrees that all computer users should install anti-virus software and firewall software, and keep it meticulously current. (Outdated protection software is of essentially no value.)

A buggy CFCU automated teller machine in Ithaca displays the idiosyncratic message, "Thank you for using."

"This kind of attack is becoming very common," says Adinolfi. "It takes advantage of vulnerabilities that are due to poor configuration and user practice, instead of a coding flaw." Adinolfi urges all users to create a new user account on their computers for daily use, and access their administrator account only when necessary for installing new software or the like. Windows users should contact their office tech support staff, or contact a local computer consultant, for advice.

"Incidents like this should remind people that they must actively work to secure their computers, since new vulnerabilities are exploited each day," Adinolfi adds. "Vigilance is the only fool-proof tool one can use against hackers."

CFCU, formerly the Cornell FingerLakes Credit Union and the Cornell Federal Credit Union before that, has also recently acknowledged bugs in its Virtual Branch web site that cause problems for some users, and has made limited progress in fixing known bugs in the ATM software installed this winter in its automated teller machines.