NT33 Possible Hack Attempt!!

[kattouf]

Just to let you guys know a customer on Nt25 was hacked today (or atleast he found out about it today) Folders deleted, index replaced etc.

Can we request a free restore? considering its not our fault? He is asking for one... :-)

[admin]

Most likly since he is the only one hacked it was his ftp or a script that got him hacked not really the server.

[Brangwyn]

You can restrict which ephemeral ports are used by IIS FTP If you like, it's controlled by a registry key setting.

[admin]

yea we could do that for windows and unix. We know how to do it, we were going to do that but even when we leave all of them above 1024 open it still does not work. Not sure why yet. Really odd. It should work since it sends on 21 and goes back on a port above 1024.

[dpyers]

It's set for passive right? If not, I think you'd need 20 open as well.

[Brangwyn]

Yeah, Passive should only need 21 open + 1024 and up and Active 20 & 21 & the 1024+ ideally you should support both, theres no harm having 20, 21 1024-5000 open (limit the FTP ephemeral to 5000 via that reg key).