FTP Client Passwords hacked: Beware - GoFuckYourself.com

ruff · 02-24-2010, 09:21 AM

I use FileZilla and my server passwords were compromised and malicious code added to several of my sites. The code was an iframe link sending to a site in the Netherlands that put the Security Central virus on peoples computers. Nasty little bastard.

Virus or Malware scanners will not find it. It is an iframe link just after the body tag in infected sites. Only html and htm files.

Turns out, FileZilla does not encode anything and keeps your login data in an XML file that can be sniffed out. There are about 10 ftp clients susceptable to this and you can find more info at this link:

http://blog.unmaskparasites.com/2009...dentials-from/

Solution is not to let the ftp program to save your login info. Also switch to secure protocol. I have switched back to WinSCP.

BIGTYMER · 02-24-2010, 09:23 AM

Eeekkk! I use FileZilla. Thanks for the heads up.

CYF · 02-24-2010, 12:01 PM

using ftp also sends your passwords over the internet, in clear text.

I'm amazed that the adult industry doesn't use sftp or scp

GrouchyAdmin · 02-24-2010, 12:05 PM

This issue has been in several trojans/viruses/etc over a year.

Any program who offers free FTP/virtualhosting needs to be aware they will be plagued with this.

EscortBiz · 02-24-2010, 12:36 PM

firewall the ftp too it helps

seeandsee · 02-24-2010, 12:47 PM

damage is done, secure yourself now

sexyclicks · 02-24-2010, 12:49 PM

avast detects the virus http://www.avast.com/

also search for gumblar-family-virus-removal-tool there are some tools to automatically fix all files on your server

react · 02-24-2010, 02:11 PM

Seems more likely that you had an insecure script on one of your sites that lead to this.

easyBob · 02-24-2010, 02:18 PM

FireFTP. Addon to FireFox. It has sftp built in (just needs to be selected). If your server doesn't support sftp (SSH), get on your host about it. FTP username/passes are sent over the net plain text. Packet sniffers can pick them up, and you're boned.

It's free,
-Chris

datatank · 02-24-2010, 03:32 PM

Lock down the FTP just to approved Ips

datatank · 02-24-2010, 03:33 PM

Quote:

Originally Posted by react

Seems more likely that you had an insecure script on one of your sites that lead to this.

Nah im 99% its a pc side virus that steals the logins from the windows FTP client

shwsrvcs · 02-24-2010, 05:01 PM

SSH all the way and use Ws FTP pro

ruff · 02-24-2010, 05:36 PM

Quote:

Originally Posted by datatank

Nah im 99% its a pc side virus that steals the logins from the windows FTP client

I have scanned my computers with a number of anti-malware programs and Norton but can't find any trace of a virus. These guys are slick.

datatank · 02-24-2010, 05:40 PM

Quote:

Originally Posted by react

Seems more likely that you had an insecure script on one of your sites that lead to this.

Quote:

Originally Posted by ruff

I have scanned my computers with a number of anti-malware programs and Norton but can't find any trace of a virus. These guys are slick.

I had a problem with some guys that work for me months ago
I am pretty sure its same one
It was something to do with Abobe PDFS if I remember correct
Some kinda exploit thing
Not sure if any anti virus even ever found it
Sorry I can not be of more help for you

Chosen · 02-24-2010, 10:28 PM

ruff:, Northn sucks big time, try Avast, it's free for home use

TidalWave · 02-24-2010, 10:37 PM

ALL FTP IS SENT IN PLAIN TEXT.

You need to use SFTP or SCP.

Iron Fist · 02-24-2010, 10:48 PM

Quote:

Originally Posted by react

Seems more likely that you had an insecure script on one of your sites that lead to this.

Compromised server or local machine.... either way they were fucked from the very beginning... FileZilla wasn't the problem, same could be said for any software sending passwords via plaintext.

Jdoughs · 02-24-2010, 10:51 PM

There is about 100 threads on this board about Filezilla passes being compromised. Get a real solution.

EDIT - Ok, maybe not 100, but several (and on other boards as well).

martinsc · 02-24-2010, 11:31 PM

sftp

anal4ever · 02-24-2010, 11:33 PM

unless u ssl ftp

but thats still not 100% secure as the data build goes plain text first i belive

MMarko · 02-25-2010, 06:12 AM

Afaik even if you used secure connection your FTP logins would be compromised since this is local exploit / malware! You need to patch your software and clean your PC. Secure connection helps when 3rd party has access to your connection and can monitor / analyze your Internet traffic.

Also you need to analyze FTP logs and see if files were modified through FTP service to make sure problem is not with some unpatched script on your server!

02-25-2010, 06:29 AM

Quote:

Originally Posted by shwsrvcs

SSH all the way and use Ws FTP pro

Yeah, what he said. CuteFTP Pro is another good one.

pornguy · 02-25-2010, 06:30 AM

Quote:

Originally Posted by shwsrvcs

SSH all the way and use Ws FTP pro

yep. Dont leave the desk top without it

czarina · 02-25-2010, 06:46 AM

WS FTP is the best... you get what you pay for

02-24-2010, 09:21 AM	#1
ruff I have a plan B Industry Role: Join Date: Aug 2004 Location: Seattle - Miami - St Kitts Posts: 5,501	FTP Client Passwords hacked: Beware I use FileZilla and my server passwords were compromised and malicious code added to several of my sites. The code was an iframe link sending to a site in the Netherlands that put the Security Central virus on peoples computers. Nasty little bastard. Virus or Malware scanners will not find it. It is an iframe link just after the body tag in infected sites. Only html and htm files. Turns out, FileZilla does not encode anything and keeps your login data in an XML file that can be sniffed out. There are about 10 ftp clients susceptable to this and you can find more info at this link: http://blog.unmaskparasites.com/2009...dentials-from/ Solution is not to let the ftp program to save your login info. Also switch to secure protocol. I have switched back to WinSCP. __________________ CryptoFeeds

02-24-2010, 12:01 PM	#3
CYF Coupon Guru Industry Role: Join Date: Mar 2009 Location: Minneapolis Posts: 10,973	using ftp also sends your passwords over the internet, in clear text. I'm amazed that the adult industry doesn't use sftp or scp __________________ Webmaster Coupons Coupons and discounts for hosting, domains, SSL Certs, and more! AmeriNOC Coupons \| Certified Hosting Coupons \| Hosting Coupons \| Domain Name Coupons

02-24-2010, 12:05 PM	#4
GrouchyAdmin Now choke yourself! Industry Role: Join Date: Apr 2006 Posts: 12,085	This issue has been in several trojans/viruses/etc over a year. Any program who offers free FTP/virtualhosting needs to be aware they will be plagued with this. __________________ AIM: GrouchyGfy

02-24-2010, 12:36 PM	#5
EscortBiz Fuck Checks, CASH only! Join Date: May 2002 Location: New York City Posts: 19,422	firewall the ftp too it helps __________________ Spanking, Medical Fetish, Sleeping, Strap-on Anal Lesbians, Girls Fucking Guys, Handjob site REAL HOT, Shemales, Anal and Ass Licking sites 100% Real EXCLUSIVE with amazing retention, ccbill payouts, lots of content FREE FTP HOSTING Promote the largest and oldest member paid escort site, Converts 10 times better then any dating site, CCBill payouts ICQ# 158802076

02-24-2010, 12:47 PM	#6
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	damage is done, secure yourself now __________________ BUY MY SIG - 50$/Year Contact here

02-24-2010, 09:23 AM	#2
BIGTYMER Junior Achiever Industry Role: Join Date: Nov 2004 Location: Walled Garden Posts: 17,066	Eeekkk! I use FileZilla. Thanks for the heads up.

02-24-2010, 12:49 PM	#7
sexyclicks Confirmed User Industry Role: Join Date: Mar 2002 Location: c9media.com Posts: 3,240	avast detects the virus http://www.avast.com/ also search for gumblar-family-virus-removal-tool there are some tools to automatically fix all files on your server

02-24-2010, 02:11 PM	#8
react Confirmed User Industry Role: Join Date: Sep 2003 Location: NZ Posts: 673	Seems more likely that you had an insecure script on one of your sites that lead to this. __________________ -- react

02-24-2010, 02:18 PM	#9
easyBob Confirmed User Join Date: Feb 2010 Posts: 210	FireFTP. Addon to FireFox. It has sftp built in (just needs to be selected). If your server doesn't support sftp (SSH), get on your host about it. FTP username/passes are sent over the net plain text. Packet sniffers can pick them up, and you're boned. It's free, -Chris __________________ Last edited by easyBob; 02-24-2010 at 02:22 PM..

02-24-2010, 03:32 PM	#10
datatank Confirmed User Join Date: Aug 2004 Location: My dog is blacker than Tupac Posts: 5,471	Lock down the FTP just to approved Ips

02-24-2010, 05:01 PM	#12
shwsrvcs Confirmed User Join Date: Aug 2006 Location: Los Angeles Posts: 600	SSH all the way and use Ws FTP pro __________________ MUTTCASH! Start Earning today! www.muttcash.com

02-24-2010, 10:28 PM	#15
Chosen VIPPay.com \| AdultWebSponsors.com Industry Role: Join Date: Aug 2001 Posts: 63,151	ruff:, Northn sucks big time, try Avast, it's free for home use

02-24-2010, 10:37 PM	#16
TidalWave Confirmed User Industry Role: Join Date: Sep 2007 Location: Los Angeles Posts: 2,706	ALL FTP IS SENT IN PLAIN TEXT. You need to use SFTP or SCP. __________________ www.SwiftNode.com

02-24-2010, 10:51 PM	#18
Jdoughs Confirmed User Industry Role: Join Date: Mar 2004 Location: Great White North Posts: 5,794	There is about 100 threads on this board about Filezilla passes being compromised. Get a real solution. EDIT - Ok, maybe not 100, but several (and on other boards as well). __________________ LinkSpun - Premier Adult Link Trading Community - ICQ - 464/\281/\250 Be Seen By New Webmasters/Affiliates * Target out webmasters/affiliates based on niches your sites are for less than $20 a month. AmeriNOC - Proudly hosted @ AmeriNOC! Last edited by Jdoughs; 02-24-2010 at 10:52 PM..

02-24-2010, 11:31 PM	#19
martinsc Too lazy to set a custom title Industry Role: Join Date: Jun 2005 Location: 127.0.0.1 Posts: 27,047	sftp __________________ Make Money

02-24-2010, 11:33 PM	#20
anal4ever Confirmed User Industry Role: Join Date: Jul 2009 Posts: 413	unless u ssl ftp but thats still not 100% secure as the data build goes plain text first i belive

02-25-2010, 06:12 AM	#21
MMarko Confirmed User Join Date: Jun 2007 Posts: 160	Afaik even if you used secure connection your FTP logins would be compromised since this is local exploit / malware! You need to patch your software and clean your PC. Secure connection helps when 3rd party has access to your connection and can monitor / analyze your Internet traffic. Also you need to analyze FTP logs and see if files were modified through FTP service to make sure problem is not with some unpatched script on your server! __________________ dlXer - web design, developing, managed hosting, website optimizations

02-25-2010, 06:46 AM	#24
czarina Webmaster Extraordinaire Industry Role: Join Date: Jul 2002 Location: A beautiful beach... Posts: 10,744	WS FTP is the best... you get what you pay for