On Monday, a report surfaced claiming that a teen hacker using the alias “Fear” managed to gain access to hundreds of FTP servers owned by the U.S. government. The hacker initially gained access to one server, but then discovered that it listed the access credentials to all FTP servers residing on the .us and .gov domains. The .us servers include public data, private data, program source code, and more sensitive data, while the hacker wouldn’t say what’s loaded on the .gov sites.
FTP stands for file transfer protocol, and servers using this protocol are established to host files on local networks or via the internet. Users typically need a login name and password to gain access to content stored on these servers, which can be made public or set as private. Naturally, the government would keep its servers private, so it’s a bit scary to see that a teen managed to access one and grab the details of numerous others.
“It was very simple to gain access to the 1st box that listed all the .us domains, and their ftp server logins,” the unnamed hacker claims. “I went through each and every one, it was legit. I am pretty sure about every person who does security researching can do this, yes, it may have taken me about 3 hours or 4 hours of looking around, but it is still possible.”
The hacker also points out that the FTP sites used absolutely no encryption on their contents despite their sensitive nature. He discovered social security numbers, credit card numbers, and even web-based banking transactions made by the First Bank of Ohio. One file contained the postal addresses, email addresses, and phone numbers of candidates for the Minnesota school board as well.
According to the report, the teen hacker managed to grab credit card numbers from the First Bank of Ohio because the government has access to that particular bank. In turn, the bank stores the sensitive numbers across several SQL tables, which is a form of Excel-like data storage within a database. Moreover, one FTP server located within Florida wasn’t even password protected. It reportedly serves up one file with 267 million records, one file with 76 million records, another one with 400 million records, and more. Since then, that specific FTP server has now become password protected (even though that may be a case of closing the barn door after the data-rich cow has gotten out).
Ultimately, the teen managed to collect credit card numbers by the thousands, and social security numbers by the millions. He even grabbed the sensitive details of state employees including their telephone numbers, names, addresses, and government positions. Apparently, the FTP sites owned by the U.S. government depend on passwords with only five characters.
The teen hacker reportedly didn’t leave any backdoors to the FTP servers save for Florida, and that backdoor was removed Sunday night. Still, the whole situation is surprising given these servers are run by the U.S. government and a single teen managed to access them and grab sensitive data.
Just imagine the damage local hackers and international terrorists could deal to Americans by breaking into these servers … if they haven’t already.
After the report went live, the federal government shut down the main .us FTP server. The story is currently ongoing, so stay tuned.
