User: UnmaskParasites

Re:Firewall

On: Doorways Sneak To Non-Default Ports of Hacked Servers

Interesting point.

Still makes no excuse why admins leave open ports and don't notice malicious activity on their servers for months

Re:Firewall

On: Doorways Sneak To Non-Default Ports of Hacked Servers

Taking security seriously would be the solution.

The chances are the intruders have root privileges (since they can re-configure Apache). So they can unblock any ports as easily.

So if admins don't watch their servers, they won't even know that something's wrong.

Re:Here's an example break-in.

On: Doorways Sneak To Non-Default Ports of Hacked Servers

The Whois information is forged. They just use a database of stolen contact details and use them to register domain names.

Note how registration times of their many domains differ only by seconds.

Re:Also done with 404 Error Documents

On: Malware on Hijacked Subdomains, a New Trend?

In this attack, the hacked sites redirect to subdomains of third party sites. E.g. site1.com redirects to sub.site2.org, so most NoScript settings should be safe.

Re:We got hit by this

On: Image Searchers Snared By Malware

Thanks,

I received it. Hope the second file is also under version control

Re:We got hit by this

On: Image Searchers Snared By Malware

Thanks for sharing this story.

Did you find and save that 7_22-5.class.php file? It would be interesting to see what exactly they tried to achieve.
You can post the code (if it's short and not outright malicious) here or contact me directly using this form
http://www.unmaskparasites.com/contact/

Thanks,
Denis

Re:Whaaaaaa!

On: R.I.P. FTP

On many cheap hostings plans FTP is the only way to upload files.

They steal passwords from config files

On: R.I.P. FTP

Hi,

I'm Denis Sinegubko. The one quoted in this article.

I want to clarify one thing about how malware steals passwords from webmasters' computers.

TCP traffic sniffing was only one of possible vectors.

However, now I have more proofs that malicious programs just read configuration files and registry settings.

Just check how this trojan steals FTP, email and IM credentials:
http://www.viruslist.com/en/viruses/encyclopedia?virusid=147349

I checked programs, installed on my computer and indeed many of them store passwords in _plain text_, not encrypted. And those that encrypt
passwords use very weak algorithms.

FileZilla stores FTP credentials (including passwords) in .xml files in plain text. And this is "by design"! Check this thread:
http://forum.filezilla-project.org/viewtopic.php?f=2&t=12280

So why would malware bother with sniffing traffic or key logging (this activity can be detected by antivirus), when it can simply read everything it needs from files and Windows registry?