Security and SSL
Investigate a possible infection through FTP credentials
An intrusion can add JavaScript, iframe elements, backdoors or phishing pages to many files. Browsers and search engines may warn about the site when they detect dangerous content.
What the files look like does not tell you how the attacker got in. Before attributing it to FTP, keep and review the access logs, the modification dates and the existing accounts. Application vulnerabilities, admin users, scheduled tasks and other access to the hosting should also be investigated.
If the logs show a valid, unrecognised FTP login, consider that credential compromised. Keep the log and revoke or restrict that access as soon as possible from a trusted device. Also scan the devices it was used from; do not wait until that scan is finished to contain active access.
Security tips
- Use SFTP when available and delete the FTP accounts you do not need.
- Give each account a long, unique, different password; keep it in a reliable password manager.
- Keep the operating system, browser and transfer client up to date, and scan the device with its security software.
- Once the device is secure, rotate the FTP credential confirmed as exposed and any other that has been reused or may have been accessible to the attacker.
- Clean the whole account, fix the way in and review later logs. Changing the password does not remove malware that has already been installed.
What information helps confirm it
Match the user, IP, date and time zone of the access with the affected files. A successful login does not necessarily show which file was changed, and a modification date can be altered. Correlate several signals and do not attribute the incident solely to an IP's country.
Tell an additional FTP account apart from the hosting's main credential. If you change the main password, update the legitimate access that depends on it; if there are SSH keys, revoke them separately when they are exposed. SFTP encrypts the connection, but it does not prevent the use of a credential that has already been stolen.
You may also find useful
- Clean up and recover WordPress after an intrusion Sets out a controlled process to preserve evidence, verify and replace the core, check for persisten...
- Clean up files detected as malware Explains when to restore an earlier backup or analyse the files, and how to use Imunify360's Malware...
- Scan files with cPanel's Virus Scanner Introduces cPanel's Virus Scanner, based on ClamAV, for scanning an account's content on demand when...
- What to do if your website or hosting has been compromised Sets out common causes and effects of a hosting intrusion, options for cleaning up or restoring, and...
Something wrong or out of date? Tell us and we will review it.