Information on Gumblar Attacks - Powered By Kayako SupportSuite

07 Sep 2010

Support Center » Knowledgebase » Information on Gumblar Attacks

	Information on Gumblar Attacks

Solution Information on Gumblar Attacks

In the news:
http://news.cnet.com/8301-1009_3-10244529-83.html
http://www.martinsecurity.net/2009/05/20/inside-the-massive-gumblar-attacka-dentro-del-enorme-ataque-gumblar/

Over the past month, we have been investigating these attacks, and working on methods to mitigate damage caused by them; this mail contains our findings and recommendations.

- Through our investigations, it was confirmed that the infection was not due to any server vulnerability. We enforce stringent security measures to safeguard your data.

- The attack is perpetrated through stolen FTP login credentials. It transmits FTP information to an IP address from an infected machine.

- This FTP information is then used to log on to the web server and infect the hosted website.

- The attack is not limited to ExpertHost's hosting services - so far, thousands of websites across a large number of hosting providers have been infected through this attack.

Given the nature and scope of this attack, it is important that proper security measures be taken at all levels to prevent it. We would like to suggest a few steps that would reduce the vulnerability of your computer and remove existing threats.

- We recommend you install an antivirus program with the latest updates and ensure removal of any malware, trojans or key loggers on any machine that you use to manage your website's content via FTP.

- Several free antivirus software like AVG, AntiVir, Malwarebytes are available for this purpose. Regular virus scans will minimize such threats to a great extent.

- Once you are confident that you have a clean machine then you should change all FTP passwords.

Article Details

Article ID:

Created On:

12 Jun 2009 02:08 PM