[nsp-sec] compromised ftp accounts 20090804

[Gabriel Iovino]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dirk Stander wrote:
> Hi,
> 
> please find attached a list of ftp credentials which was found on
> a drop site (by courtesy of Niklas Schiffler from shadowserver).

Sanitized notifications have been sent to the following:

> 2572    | 198.209.253.55   | US | ftp.teachers.emints.org jonesm at teachers.emints.org | MORENET - Missouri Research and Education Network (MOREnet)
> 2698    | 205.237.127.15   | US | lislecorp.com lisleart.lislecorp.com | IASTATE-AS - Iowa State University
> 4201    | 128.193.4.140    | US | ftp.onid.orst.edu bob | ORST-AS - Oregon State University
> 5723    | 162.129.178.56   | US | 162.129.178.56 suyi | JHU - Johns Hopkins University
> 5723    | 162.129.28.75    | US | 162.129.28.75 suyi | JHU - Johns Hopkins University
> 11318   | 141.161.76.86    | US | pir7.georgetown.edu www | GU - Georgetown University
> 20452   | 147.226.7.18     | US | 147.226.7.18 mpvaclavik | BSU - BALL STATE UNIVERSITY

Thank you!

Gabe

- --
Gabriel Iovino
Principal Security Engineer, REN-ISAC
http://www.ren-isac.net
24x7 Watch Desk +1(317)278-6630
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkp4jlYACgkQwqygxIz+pTvL2QCgoWZSN4aTOLM0O/RYPGNKYxtt
rYEAn3bZn4NnB/Z7zNfxQbKxUmIPChLa
=7VEx
-----END PGP SIGNATURE-----