[nsp-sec] ACK AS852 RE: 6k probably compromised FTP accounts

[Chris Calvert]

ACK'ed for AS852, sanitized and sent to Abuse for further investigation (with caveats that compromise is NOT confirmed).

Some of the previous data has lead to identification of some shenanigans, so we're seeing something here worth a deeper look.

Chris



> -----Original Message-----
> From: nsp-security-bounces at puck.nether.net 
> [mailto:nsp-security-bounces at puck.nether.net] On Behalf Of Tom Fischer
> Sent: Friday, April 04, 2008 5:43 AM
> To: nsp-security at puck.nether.net
> Subject: [nsp-sec] 6k probably compromised FTP accounts
> Importance: High
> 
> ----------- nsp-security Confidential --------
> 
> Hi,
> 
> attached (the second part of) a list of probably compromised 
> FTP accounts. The data is based on an iframer toolkit 
> (a toolkit which uses stolen FTP credentials to add 
> iframes/JavaScript/...).
> 
> I've removed the ftp passwords for obvious reasons.
> The data is not verified.