FTP Server Offers Key to the Store

Wednesday, 12 February 2003, 11:25 AM EST

Mathias Thurman writes:

"This week I was sidetracked from my projects yet again by the need to investigate two security incidents. Both involved deleted files on servers that apparently had been compromised.

The first incident was more of a server configuration issue than a traditional security incident, but it still warranted my attention. It started when a customer sent a message addressed to our abuse e-mail alias saying that he noticed several suspicious files on our public file transfer protocol (FTP) server. So I logged into the server as an anonymous user, and sure enough, several directories had been created and populated with 4GB of unauthorized MP3 music files.

Even more alarming, I found a file named Commands that contained account names and associated passwords for support Web sites we use and for accessing internal servers in my company.

The special accounts that give us access to technical support Web sites require user IDs and passwords for access. We pay tens of thousands of dollars per year for some of those accounts. It turns out that our product support group put the file there as a repository for what it considered shared, nonsensitive information. Later, it apparently became a repository for all sorts of information."

[ Read more ]


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th