This is from the people who run the server which SG is hosted on:
Dear Customers,
We have disabled remote FTP access on all servers. Recently all our servers were targeted by a server based in Gnax datacenter ( US based ) and index page of certain websites who had weak FTP password were injected.
We have executed mass replacement scripts which have removed those injection but we cannot open FTP port unless cpanel finds a solution on this problem. those who need FTP access should request support team to add their IP address in allowed list for FTP access for respective username.
If you still see the injected code in your files then there's no need to panic. remove it using file manager in your control panel or request our support team to do so. I will post link to a form which should be used to request FTP access.
There's a long discussion going on cpanel forum regarding this injections but there has been no solution so far. this injection has occurred due to vulnerability in pure-ftp service and nothing else could be done besides injection of iframe code.
so far no solution. We will need to keep global FTP access disabled till cpanel replies with a solution.
All customers are request to choose a complicated FTP password of at least 10 characters. You can reset your password from control panel.
We have managed to communicate with the 14 year old boy from New Zealand whose server was used for this injection attack. We are not able to trace if he is the actual person who did it but he has given all the scripts and available ftp passwords he had on his server.
we are sending an email to customers whose passwords were on his server and our phone support team will be calling all those customers in next 2 days time.
he used ftp_exec function to initiate this injection and he managed to get list of passwords for those accounts which had weak password without any numbers or Caps in them. We have modified our password policy on the signup page and now every customer will need to choose a password with minimum 10 characters.
I will update with further information as we are trying to trap the actual culprit.
