Malicious version of FTP Software FileZilla stealing users Credentials

[aelius]

Malware code can be very small, and the impact can be very severe! The Antivirus firm AVAST spotted a malicious version of the open source FTP (File Transfer Protocol) software 'FileZilla' out in the wild.

The software is open source, but has been modified by the hackers that steal users' credentials, offered on various hacked sites for download with banner or text ads.

Once installed, the software's appearance and functionalities are equal to the original version, so a user cannot distinguish between the fake or real one, and the malware version of the “.exe” file is just slightly smaller than the real one.

"The installed malware FTP client looks like the official version and it is fully functional! You can’t find any suspicious behavior, entries in the system registry, communication or changes in application GUI."

The only difference is that the malware version use 2.46.3-Unicode and the official installer use v2.45-Unicode, as shown:

"We found a hardcoded connection detail stealer after deeper analysis. Malware authors abuse open source code and add their own stealer function to the main code."

The modified version copies the login information of the user and sends it to a server that is apparently in Germany, and same IP address of the server hosts three other domains, which are also associated with malware and spam activities.

"Login details are sent to attackers from the ongoing FTP connection only once. Malware doesn't search bookmarks or send any other files or saved connections," Avast explains.

This malicious version has been compiled way back in September 2012, and is still detected by just a couple of Antivirus solutions. In the past, Cyber Criminals also used Google Adsense to promote malicious software or the modified open source softwares.

Be Careful when downloading the FileZilla FTP client, such malware could also be employed for spreading more malware. Users are recommended to downloaded the softwares from the official website only.

Source: Warning: Malicious version of FTP Software FileZilla stealing users' Credentials - The Hacker News

Nota personala:

Oricum FileZilla e cel mai ratat client ftp. Chiar si pentru conexiunile SSL/TLS, el stocheaza parolele in plain text. Au fost gramada de tickete puse la ei si se pare ca nu considera ca e ceva grav.

Referinta: http://trac.filezilla-project.org/ticket/5530

status changed from new to closed
priority changed from critical to normal
resolution set to rejected
....

Pe trac filezilla:

why was this ever rejected? that is so ridiculous.

i had a virus steal the credentials to 5 different sites' ftp accounts and inject malware into them. even notepad++'s ftp plugin encrypts these credentials.

if it takes 2 years to add this ridiculously simple feature, i might as well just stop bothering with filezilla.

Users are recommended to downloaded the softwares from the official website only.

Eu va recomand sa nu-l mai descarcati deloc.

Edited January 29, 2014 by aelius

[synkron]

si ce sa folosim, ce recomandari aveti?

[Silviu]

De exemplu, pe Windows, eu am instalat plugin-ul de FTP la Notepad++, cu care si lucrez si mi se pare destul de ok.

[synkron]

am windows 7, despre ce plugin este vorba?