Trojan horse on my sites

[cd34]

The hacker used the FTP username/password to modify a few files on the server. Generally when that happens, the username/password has been leaked somewhere through a keylogger/spyware/trojan or, like this case, a vendor storing the user/password/hostname in the clear somewhere.

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

You would be surprised at the frequency this happens.

[Cleo]

Originally Posted by LeRoy

Is this a tubex related incident or JBM Soft?

Originally Posted by cd34

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

This is why I always add a user name with a temp password to my server that I then change after they are done.

I did this just last month after I wanted JBM Soft to take a look at my install of TubeX.

[LD]

Originally Posted by cd34

The hacker used the FTP username/password to modify a few files on the server. Generally when that happens, the username/password has been leaked somewhere through a keylogger/spyware/trojan or, like this case, a vendor storing the user/password/hostname in the clear somewhere.

When you give a password to a vendor, you should change it after they are done, or, change it to something, give it to them, and then change it after they are done.

You would be surprised at the frequency this happens.

Thanks for getting fixed so quickly.

Guess you can't be too careful...live and learn.

[SimonT]

Had this happen to me too but not with JBM - created a temp ftp account and sure enough after the company had used it someone else sneaked in and installed a load of crap on the server.