Mathias Thurman writes:

"This week I was sidetracked from my projects yet again by the need to investigate two security incidents. Both involved deleted files on servers that apparently had been compromised.

The first incident was more of a server configuration issue than a traditional security incident, but it still warranted my attention. It started when a customer sent a message addressed to our abuse e-mail alias saying that he noticed several suspicious files on our public file transfer protocol (FTP) server. So I logged into the server as an anonymous user, and sure enough, several directories had been created and populated with 4GB of unauthorized MP3 music files.

Even more alarming, I found a file named Commands that contained account names and associated passwords for support Web sites we use and for accessing internal servers in my company.

The special accounts that give us access to technical support Web sites require user IDs and passwords for access. We pay tens of thousands of dollars per year for some of those accounts. It turns out that our product support group put the file there as a repository for what it considered shared, nonsensitive information. Later, it apparently became a repository for all sorts of information."

[ Read more ]