Finjan Uncovers More Than 8,700 FTP Server Credentials in the Hands of Hackers

In its Latest Malicious Page of the Month Report, Finjan Reveals the Commercialization of Stolen FTP Server Credentials

(11.03.08) - Finjan Inc announced it has uncovered a database containing more than 8,700 harvested FTP account credentials, including username, password and server address - in the hands of hackers. These stolen credentials enable criminals to compromise servers and auto-matically inject crimeware to infect users visiting them. Among those stolen accounts are those of Fortune-level global companies in a wide range of industries including manufacturing, telecom, media, online retail, IT, as well as government agencies. The stolen FTP accounts include some of the world’s top 100 domains as ranked by Alexa.com.

Finjan’s Malicious Code Research Center (MCRC) has detailed the workings of an insidious new application, especially designed to abuse and trade stolen FTP account credentials of legitimate companies around the world. A trading interface is used to qualify the stolen accounts in terms of country of residence of the FTP server and Google page ranking of the compromised server. This information enables the cybercriminals to devise cost for the compromised FTP credentials for resale to other cybercriminals or to adjust the attack on more prominent sites. The trading application also allows the cybercriminal to manage FTP credential information to automatically inject IFRAME tags to web pages on the compromised server.

Finjan invites IT security personnel from legitimate organizations to inquire if their FTP servers’ credentials are among those identified as stolen. (Finjan: ra)