[113773] in North American Network Operators' Group
Re: Malicious code just found on web server
daemon@ATHENA.MIT.EDU (Kevin Oberman)
Tue Apr 21 15:38:47 2009
To: Paul Ferguson <fergdawgster@gmail.com>
In-reply-to: Your message of "Mon, 20 Apr 2009 10:52:57 PDT."
<6cd462c00904201052q1f352e25h1aed3e2aa97c0f00@mail.gmail.com>
Date: Tue, 21 Apr 2009 12:38:26 -0700
From: "Kevin Oberman" <oberman@es.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
> Date: Mon, 20 Apr 2009 10:52:57 -0700
> From: Paul Ferguson <fergdawgster@gmail.com>
>
> On Mon, Apr 20, 2009 at 10:40 AM, Nick Chapman <nicknetworks@gmail.com>
> wrote:
>
> > On Mon, Apr 20, 2009 at 12:47 PM, Neil <kngspook@gmail.com> wrote:
>
> >>
> >> But if you figure out how they got write access to a static website, I'd
> >> love to hear it.
> >
> >
> > Compromised FTP credentials would be my guess. They can be obtained
> > by brute force attacks or credential stealing trojans.
> >
>
> Yeah, it could have been any number of ways -- there has also been a huge
> increase of SSH brute-force attacks in the past few weeks:
>
> https://isc.sans.org/diary.html?storyid=6214
And, from several reports (including my own), they (brute force ssh
attacks) seem to have stopped at about 22:30 UTC on the 19th. (Not that
this is really relevant to the thread.)
--
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: oberman@es.net Phone: +1 510 486-8634
Key fingerprint:059B 2DDF 031C 9BA3 14A4 EADA 927D EBB3 987B 3751
