FlashFXP Forums - View Single Post - update server dns records were spoofed on google public DNS servers

bigstar · 03-25-2015, 06:55 AM

Thank you very much for bringing this to our attention. This is a very serious problem and I am working to get it resolved ASAP.

flashfxp.com was not compromised and this does appear to be some type of DNS poisoning/spoofing attack.

104.207.143.175 is NOT one of our servers.

liveupdate.flashfxp.com should resolve to the same IP as FlashFXP - Secure FTP Client Software for Windows. Upload, Download, and Synchronize your files. (96.30.5.209)

When you download an update from within FlashFXP after the download has completed the first thing we do is verify the digital signature on the exe, if the file has been tampered with the download will be deleted and we report the download as incomplete.

I am currently investigating this situation and I will provide more information as I know more.

03-25-2015, 06:55 AM
bigstar FlashFXP Developer Join Date: Oct 2001 Posts: 8,012	Thank you very much for bringing this to our attention. This is a very serious problem and I am working to get it resolved ASAP. flashfxp.com was not compromised and this does appear to be some type of DNS poisoning/spoofing attack. 104.207.143.175 is NOT one of our servers. liveupdate.flashfxp.com should resolve to the same IP as FlashFXP - Secure FTP Client Software for Windows. Upload, Download, and Synchronize your files. (96.30.5.209) When you download an update from within FlashFXP after the download has completed the first thing we do is verify the digital signature on the exe, if the file has been tampered with the download will be deleted and we report the download as incomplete. I am currently investigating this situation and I will provide more information as I know more. Last edited by bigstar; 03-25-2015 at 07:35 AM.