attackers most likely used an unpatched security issue in the FTP daemon
If they don't know exactly how the server was compromised I don't understand how they can know the vulnerability is limited to software downloaded within a certain timeframe. The added backdoor yes, but the vulnerability that allowed the attack to succeed is still unaccounted for.
If they don't know exactly how the server was compromised I don't understand how they can know the vulnerability is limited to software downloaded within a certain timeframe. The added backdoor yes, but the vulnerability that allowed the attack to succeed is still unaccounted for.
Or am I missing something?