3 ms·

Thanks for the warning guys. There is a first time for everything I guess - somehow my FTP account was compromised and a script added to the end of the page th

by gridspy 17y ago

Thanks for the warning guys. There is a first time for everything I guess - somehow my FTP account was compromised and a script added to the end of the page that injected code into the page. The script has been removed and the FTP account blocked. The logs indicate that the work was done by a botnet, quite interesting. One IP logs in and gets a file, another (different IP) logs in and replaces that file. The static content that was compromised is stored on a separate server with separate passwords from the machine that hosts my actual application and associated data. What really concerns me is how that password got into the open (the logs do not indicate brute forcing). Virus checking here we come!

khafra 17y ago
Perhaps some machine on the wire between the two servers is a member of the botnet? You might want to switch to SCP, HTTPS upload, ipsec tunnel, or something else that'll at least be a speedbump to attackers.
- gridspy 17y ago
  Further info for those interested: My developer machine was infected with the Kryptik trojan. Using WireShark I could see that I had become the proud member of a botnet, it probably found a saved password for FTP on my machine and compromised my server that way. Makes me feel all dirty inside watching my computer send viagra emails and receive "sorry, you are blacklisted" responses. All the passwords have been changed and the relevant computer quarantined. I'm still working on removing the virus, seems to be using drivers to mask its presence from the virus checkers I am using. I've got some ideas based on using a scanner on a live-cd. What is really fun is that the virus definition for the trojan was added to NOD32 after I was infected, so I don't know how much help a virus checker would have been, if it was installed. That will learn me for leaving saved passwords on an otherwise secure machine.
  - netcan 17y ago
    Thanks for coming back with that.
    - gridspy 17y ago
      I used an external hard disk drive caddy to mount the infected HDD on another machine. I then used Malware bytes to scan the HDD. It found Trojan.Agent on the hdd (in a dll inside windows/system), which it hadn't found when malwarebytes was run directly on the infected system. The infected computer has ceased sending suspicious packets. I don't know how I am going to trust this machine again.
Tuna-Fish 17y ago
FTP is plaintext. You'd be surprised how easy it often is to become a middleman to a transmission on the open internet. Just always assume all ftp passwords to be released to the world when you transmit them. (Or, just don't use it.)

by gridspy 17y ago

khafra 17y ago

Perhaps some machine on the wire between the two servers is a member of the botnet? You might want to switch to SCP, HTTPS upload, ipsec tunnel, or something else that'll at least be a speedbump to attackers.

gridspy 17y ago
Further info for those interested: My developer machine was infected with the Kryptik trojan. Using WireShark I could see that I had become the proud member of a botnet, it probably found a saved password for FTP on my machine and compromised my server that way. Makes me feel all dirty inside watching my computer send viagra emails and receive "sorry, you are blacklisted" responses. All the passwords have been changed and the relevant computer quarantined. I'm still working on removing the virus, seems to be using drivers to mask its presence from the virus checkers I am using. I've got some ideas based on using a scanner on a live-cd. What is really fun is that the virus definition for the trojan was added to NOD32 after I was infected, so I don't know how much help a virus checker would have been, if it was installed. That will learn me for leaving saved passwords on an otherwise secure machine.
- netcan 17y ago
  Thanks for coming back with that.
  - gridspy 17y ago
    I used an external hard disk drive caddy to mount the infected HDD on another machine. I then used Malware bytes to scan the HDD. It found Trojan.Agent on the hdd (in a dll inside windows/system), which it hadn't found when malwarebytes was run directly on the infected system. The infected computer has ceased sending suspicious packets. I don't know how I am going to trust this machine again.

Tuna-Fish 17y ago

FTP is plaintext. You'd be surprised how easy it often is to become a middleman to a transmission on the open internet. Just always assume all ftp passwords to be released to the world when you transmit them. (Or, just don't use it.)