Finjan finds application selling FTP credentials

By Dan Kaplan on Feb 29, 2008 9:41AM

Researchers at the web security firm Finjan on Wednesday announced they have discovered a small database containing about 8,700 file-transfer protocol (FTP) server credentials that were being used to plant malicious code on legitimate websites.

The database – located on a server based in Hong Kong, operated by Russians and administered from Amsterdam, Netherlands – contained usernames, passwords and server addresses that could grant access to at least 2,000 sites in the United States, including at least a dozen Fortune 500 companies and several government agencies, said Iftach Amit, director of security research at Finjan.

The credentials were being used by the hackers to access and infect legitimate websites with malicious code, but they also were being sold to other criminals through the underground market, Amit told SCMagazineUS.com.

Each credential was listed with a price tag, determined by the Google page-ranking of the website the information could be used to compromise, Amit said.

The credentials enable cybercriminals to gain access to websites to inject IFRAME tags into webpages, which can redirect the client's browser to a malicious server.

The Finjan researchers stumbled across the application after tracking a number of trusted websites that contained code pointing to the overseas server, which also was hosting a crimeware toolkit being used to distribute malware.

Amit said organisations are welcome to contact Finjan to determine if their FTP credentials were listed on the database. In the meantime, the company has contacted numerous law enforcement agencies, including the FBI.

An agency spokesman could not confirm whether the FBI was investigating.

See original article on scmagazineus.com