DreamHost, one of the veteran US web hosts, confirmed this week that an attacker exploited a flaw in third-party software behind its browser-based File Manager. According to the company, the attacker obtained FTP and SFTP usernames and passwords of people who signed in to the tool, and also reached some webmail systems and obtained login details for a limited number of users.
According to the company, the exposure ran roughly from August until October 23, when the breach was discovered. DreamHost rebuilt the tool with additional security and brought it back on October 26. Anyone who used the tool in that period should treat their FTP and SFTP passwords as compromised. The company said it found no evidence that payment details or control panel credentials were affected, and has not said how many customers were hit.
Why is this especially dangerous? An FTP password gives direct access to a site's files. Whoever holds it can plant malicious code, redirect visitors to fake sites, or add phishing pages without the owner noticing. Webmail credentials let an attacker read email, send messages in the owner's name, or set forwarding rules that quietly pass every incoming email to them.
What to do? DreamHost customers should change FTP, SFTP and email passwords, check whether site files were added or changed, and check email settings for unfamiliar forwarding or filter rules. If you used the same password elsewhere, change it there too. And it applies to every site owner, not just DreamHost customers: browser-based site management tools are very convenient, but they are also a weak point. Check your site files now and then, use unique passwords, and turn on two-step verification wherever possible.
