Hacker bid large amounts of FTP passwords

More than 8,700 FTP account names and passwords are being sold by hackers on an online auction site. This site also provides software tools that allow you to hack Web servers and automatically insert malware into your Web site.

Some of the above information provided a mechanism to break into many of the Fortune 500 companies. Most of them are in the manufacturing, telecommunications, media, online retail sectors. IT and government agencies. Stolen FTP passwords including domain names are among the top 100 domains in the world ranked by Alexa.com.

The malware research center of Finjan Security listed details of the working mechanism of a malware called NeoSploit 2 - used to exploit and sell FTP account references from well-known companies. .

The working mechanism of NeoSploit 2 is as follows: The software uses the same interface as eBay to classify stolen accounts by country (swerver location), and Google's ranking of the level of servers being compromised. . Criminals will use this information to value stolen FTP references so they can be resold to other criminal organizations. The software also allows criminals to use FTP references to automatically insert HTML IFrame tags into Web pages on the intrusion server.

" The fact that software is used as a service (SaaS) has actually been around for a long time, but so far it has been applied to legitimate applications. With this type of transactional application, criminals always have Get an instant solution for obtaining FTP reference access, and you can install malware and valid Web sites and then infect the user's computer. "It's easy to do with just one button ," Finjan said.

According to Finjan, the NeoSploit 2 tool package marks the escalation of criminal software through the SaaS business model.

Sophos has an application of 6,000 new websites being hacked every day - a hacked website has an average of 14 seconds. 83% of these websites belong to companies and individuals who do not know their site has been hacked.

" Crime gangs not only attack websites, but they also trade usernames and passwords of business websites, and bundle additional malicious code. This means even when Your website has no holes, hackers can still 'roam' comfortably in there, "said Sophos.

Criminals can attack any computer user just by sending an e-mail containing a link to a "poisoned" website, then "plugging" the malicious code into the victim's computer. In some cases, these websites can identify users using a Mac or PC, thereby installing specialized malware.