Security researcher Orange recently managed to gain access to a file transfer server at Facebook. He used a set of vulnerabilities that he found in the product that provides the service: the Accellion File Transfer Server (FTA). He notified Facebook under their bug bounty program and was awarded US$ 10,000. Accellion addressed vulnerabilities CVE-2016-2350/1/2/3 in a recent patch.
When analyzing the system under his control he found signs that another attacker had been on the system for some time. That attacker had installed a backdoor to harvest login ids and passwords used to transfer files from the service.
According to Facebook the other attacker was also a security researcher and not a real attacker.
If you run Accellion FTA you should install the patch as soon as possible. Any version lower or equal to 0.20 is vulnerable.
