My FTP is getting hacked each day !

[Spacedust]

What's this Mustafa !!! I've created a test domain with just phpinfo.php file on it.

Code: [Select]

188.138.112.23 - admin2 [06/May/2013:17:58:02 +0200] "PUT /home/admin2/test.domain.pl/j3CQRFYD.gif" 200 10
188.138.112.23 - admin2 [06/May/2013:17:59:08 +0200] "PUT /home/admin2/test.domain.pl/php.php" 200 27
188.138.112.23 - admin2 [06/May/2013:17:59:15 +0200] "PUT /home/admin2/test.domain.pl/php.php" 200 105936
82.165.150.42 - admin2 [06/May/2013:22:54:12 +0200] "PUT /home/admin2/test.domain.pl/xw7WN9cR.gif" 200 10
82.165.150.42 - admin2 [06/May/2013:22:55:21 +0200] "PUT /home/admin2/test.domain.pl/php.php" 200 105936
82.165.150.42 - admin2 [06/May/2013:22:55:36 +0200] "GET /home/admin2/test.domain.pl/.htaccess" 200 1585
82.165.150.42 - admin2 [06/May/2013:22:55:36 +0200] "PUT /home/admin2/test.domain.pl/.htaccess" 200 3247
82.165.150.42 - admin2 [06/May/2013:22:55:37 +0200] "GET /home/admin2/test.domain.pl/.htaccess" 200 3298
82.165.150.42 - admin2 [06/May/2013:22:55:37 +0200] "PUT /home/admin2/test.domain.pl/.htaccess" 200 3247
188.138.112.23 - admin2 [06/May/2013:23:26:56 +0200] "PUT /home/admin2/test.domain.pl/GrvwJTBq.gif" 200 10
188.138.112.23 - admin2 [06/May/2013:23:28:03 +0200] "PUT /home/admin2/test.domain.pl/php.php" 200 105936
62.149.195.237 - admin2 [06/May/2013:23:28:32 +0200] "PUT /home/admin2/test.domain.pl/YjkXnxZd.gif" 200 10
62.149.195.237 - admin2 [06/May/2013:23:29:38 +0200] "PUT /home/admin2/test.domain.pl/box.php" 200 27
62.149.195.237 - admin2 [06/May/2013:23:29:40 +0200] "PUT /home/admin2/test.domain.pl/box.php" 200 105936

Inside there is something strange - professionally written virus that steal passwords, databases etc. !

[MRatWork]

Read http://xavsec.blogspot.com/2006_09_01_archive.html

[Spacedust]

How to protect ?

[MRatWork]

Try disable anonymous ftp and change ftp password.

[Spacedust]

Try disable anonymous ftp and change ftp password.

Anonymous FTP is already disabled. Changing FTP password does not help.

[MRatWork]

What about rkhunter log?. If your system have backdoor, ftp is not importance.

[Spacedust]

What about rkhunter log?. If your system have backdoor, ftp is not importance.

No backdoors :/

[Spacedust]

I wrote a script so I will get e-mail if a different IP than mine logs on my FTP accounts

[MRatWork]

I am not sure this issue related to with pure-ftpd (as ftp server). As I know no report about pure-ftp vulnerability.

But, please googling about pure-ftp vulnerability.

[Spacedust]

I am not sure this issue related to with pure-ftpd (as ftp server). As I know no report about pure-ftp vulnerability.

But, please googling about pure-ftp vulnerability.

I will monitor this and keep you informed.