Slashdot Mirror
FTP Hacking on the Rise
yahoi writes "The disco-era File Transfer Protocol (FTP) is making a comeback, but not in a good way — spammers are now using the old-school file transfer technology to serve up bot malware, and even as a backdoor into some enterprises that neglect to lock down their oft-forgotten FTP servers. Researchers at F-Secure have spotted a new wave of exploits that use FTP — rather than a malicious URL, or an email attachment — to deliver their malware payloads because few gateways scan for FTP attachments these days."
Gopher?
Further proof that FTP is for chumps. :) scp to the rescue!
First off, since when is a 'URL' considered a transport mechanism rather than syntax for specifying a transport mechanism and location? Is ftp://whatever.example.com/badcode/ not a URL because it's ftp now? That's a goofy statement.
And then, this isn't about ftp being hacked, just that bad software is being hosted using ftp as well as http (which I presume is what is meant by 'URL' or being emailed.
And, ftp is not merely an ancient, deprecated protocol. It's still widely used because it does what is intended for well and works under high load readily.
XML is like violence. If it doesn't solve the problem, use more.
They have conquered WWW and Email, now FTP, next on their list... NTP! Yes, hacking through your clock, I can see it now! Malware which will make you either cronically early, or late!
Karma Whoring for Fun and Profit.
to type "bin."
Well, for my money, anyone who blindly clicks on a link.... FTP or HTTP and runs an executable that comes from it is going to get infected regardless of what protocol was used for it.
The fact that a lot of gateways prevent certain actions based on the protocol just makes the "any key" users blindly click on stuff without worry - after all, they've "got protection"
When it comes to any infection vector that involves social engineering, your brain (should you choose to use it) is your best virus protection.
The Digital Sorceress
because few gateways scan for FTP attachments these days.
Er, that's because there's no such thing as an FTP attachment? If you are referring to links, then I'm not aware of any virus checkers that automatically download and check HTTP links either.
Can anybody translate this into something that makes sense?
What the hell is a "FTP attachment"?
Doesn't make sense.
Ruby Neural Evolution of Augmenting Topologies
k thx bye!
Just ignore them. It's good business for them to constantly cry "wolf".
'Once scientists, even the dim-witted social scientists, get muzzled, the Western Civilization is finished.' - oldhack
I'm sorry, but if when setting up server services the admin "forgets" to lock down FTP, they need to be canned. That is all. NEXT.
If you want news from today, you have to come back tomorrow.
Now you have email viruses delivered via FTP. Cool.
Yeah I'm old - get off my lawn!
.. paranoid crackpot leftover from the days of Amiga.
Speaking of FTP I was appalled the other day when my girlfriend told me their small company is paying $100 a month for a service to use FTP for their clients. This service has a space limit of 300 MB!!! With GMAIL and Yahoo email offering unlimited storage this seems unbelievably small.
Clear TXT PASSWD = BAD Might as well bend over. I've made my hosting customers use SFTP/SCP for YEARS. Been very happy I have. Just like POP3 one day.. IF we are lucky people will stop using it. It's like sending your tax return to the IRS in a clear envelope with your name birth date and SS # showing. Just plan STUPID!
It sounds like that 'trusted' sites have been hacked, and that nefarious forces may place files on those trusted sites, then send emails that look authentic. That is, the email looks like it is from a responsible site and has an FTP URL for that site, but the file on the trusted site contains malware of some type.
I have gotten fake hallmark cards in the past, and only because the URLs were obviously not hallmark did I check the headers. Transform this into a malware that installs a back door, grabs your address book, then sends the address book full of trusted names back to the originator. Now you have an email from a trusted source that has URLs to a trusted site to help spread it.
Maybe I shouldn't have typed all that out.....
I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
In mid-February Tipping Point (maker of an IPS) released new filters on FTP Put and Get commands due to this rise in exploits. Always nice to see the IPS on the leading edge, and it again provides a point of emphasis that the IPS is absolutely essential for an enterprise.
Dagnabbit you kids get the hell off my lawn, you're messing up my 2400 baud modem reception!
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
Staring score: -1, Informative moderation: 0?
Funny (to me) anecdote: My first day on my first job in the IT biz (network admin at the university I grad'd from) the old network admin was showing me the ropes, and actually telneted across the network and logged in with his root account. Needless to say my first order of business was to change the root password
ahhh...
Hi, I Boris. Hear fix bear, yes?
except perhaps for the sloppy authentication in the clear and the awkward use of random ports initiated in the wrong direction (from server to client).
What is wrong is that there are ftp servers allowing anonymous write access. That is how those miscreants work: they put a malicious file up on an anonymous ftp server (that allows write access) and then craft ftp URLs to spam people with.
I remember we warned all ftp server administrators about the issue 10 or more years ago, back when I was a rookie.
Of course scp/sftp is way better, everyone knows that. Or not?
Rooted ftp sites have been used for warez and malware since the beginning of time, and the F-Secure folks discover this *now*?
Pretty lame.
thegodmovie.com - watch it
FTA: Elgamal says the bad guys can hop on Port 80 and ship FTP through that port, for example, and a firewall wouldn't block the file transfer. Some Internet gateways scan for FTP traffic, such as F-Secure's Internet Gatekeeper, which does so by default.
This completely depends on the firewall or proxy. Many newer perimeter security devices are L7 protocol aware, and will abort any connection over a well known port that doesn't look right. This means that the days of running an SSH daemon on your home rig on port 80 are slowly coming to an end.
Having said that, I believe that many payloads can continue to slip past secure gateway devices via old fashioned encryption. FTP can be wrapped up via SSL/TLS, making payload inspection impossible. How many of those devices can tell the difference between an unencrypted data channel and an encrypted one? Better still, how many of them recognize 'AUTH TLS', 'CCC' or 'CDC' commands? As long as you keep your control channel clear-text, FTP/S looks and acts very similar to regular FTP.
My company got hit by this. Basically, someone found a username / password combination on a web server and FTP'ed up a phishing website. This user didn't have a valid login shell {it was set to /bin/false} but that didn't matter here because they didn't need to run shell commands {and in any case, if they needed to, they had a perfectly good cgi-bin directory they could use}.
/bin/true for FTP-enabled users without shell access -- this needs to be mentioned in /etc/shells, of course, for FTP access to work -- and /bin/false for non-FTP users. This should not be in /etc/shells.}
/bin/bash or /bin/ash. In which case, as a bare minimum you should disable password-based logins. There are better solutions involving chroot and per-user bin folders.
Obviously you have to have FTP and web servers on the same machine, otherwise your hosting customers can't upload their pages. To limit the potential damage, disable mod_userdir -- all your users should already have their own domain names anyway. And if you have any "email only" users {usually, these will be secondary mailbox accounts, i.e. when you have things like fred@freds-shed.org.uk going into one mailbox and charlie@freds-shed.org.uk going into another} whose only way of accessing files is by POP3 or IMAP, use a different shell for them. {I recommend
If you have users who want to use scp or fish to upload stuff, they'll have to have a Bourne-like shell such as
Je fume. Tu fumes. Nous fûmes!
It's easier to protect your network, especially a corporate network, from malware that uses FTP than HTTP. Just block 21/TCP outbound -- we recommend this to most of our clients. Granted, the bad guys can change the port, and then you don't have much recourse without deep packet inspection. But most compromised servers (which have the malware) will be on a standard port and dropping outbound FTP will be effective. Of course, there are legitimate uses for FTP (some AV companies use it to update their products, for example), but you can often get away with a whitelist.
I fell victim to an FTP security issue in January of last year. The hosting provider for my website allows for anonymous FTP by default and an organization of hackers was able to use this to upload files which somehow enabled them to edit content on my Drupal powered website (I've seen Wordpress sites fall victim to the same hack). All they did was a meta-redirect, but I had about a week of downtime as I restored from dated backups and got technical questions answered on the Drupal.org forums.
As it turns out, my hosting provider doesn't offer any real real capacity to disable anonymous FTP and I had to set the maximum allowed data transfer amount to 0KB for anyone except myself.
Are there any HTTP to email servers left out there? You sent an email to an address with the URL as the subject; the server on the other end fetched the web page and mailed you a copy.
I occasionally have use for such a thing but the last server I used for this (maintained at a Japanese university, iirc) shut down years ago.
Check it out. That, my friends, is a real Clock Gobbler.
if they applied their own laws to themselves.
look up the HIPAA laws...Medicare is a gov't program that seems to be held (along with every other insurance plan) to a much higher standard.
GP was talking about scp being implemented in 1995, not FTP.
Absurdity: A statement or belief manifestly inconsistent with one's own opinion. -- Ambrose Bierce
All network printers also seem to have wide open FTP servers. With some ingenuity, one can hide a music collection on a networked photo-copier or something and the corporate MSCE droids will never fiure it out...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Firefox spell-check agrees: two Ns, one L in "tunneling". Further, no ambiguity is introduced by not doubling the L.
;D
It's a peculiar Americanism. There is robbing, but there's also robing as in the opposite of to disrobe. Raping and rapping are formed from rape and rap respectively, so there's where ambiguity steps in to set the rule. However, it is impelling and not impeling, or even compelling and not compeling. Is it the rule to limit how many repeated adjacent letters you have in a word? There's potterring (Brit.) and pottering (US) but there is only puttering and not putterring anywhere?
For me, it's trust the spell checker, but when in doubt verify. I'd rather have consistent rules, but English is such a mongrel language anyway, borrowing words everywhere. It's annoying, but at least it isn't annoyying.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
To the best of my knowledge, when the DOD paid UCB to implement the TCP/IP suite on Unix, the FTP protocol was included in the sample implementation. Virtually all TCP code in the world was derived from that code and therefore the most common file transfer functionality on the Internet is FTP. After all these years it still works, and sometimes ftp over slip is the best you can do to bootstrap a new firmware device. It is true that there are newer and more efficient protocols, but like "vi", it's one of the things that you are glad to have there when everything else is messing up.
FTP isn't going to go away until the readily available secure alternatives perform as well. Especially since data moving operations have been increasing their "need for speed" along with the amounts of data involved.
I've been involved with performance testing on a data warehouse product that must transfer umpteen-GB nightly, where we've found that FTP transfers typically perform at least 30x faster than then next fastest alternative-- scp, sftp, etc. On a 1000MB link between two computers sitting next to each other we're seeing a 20 minute FTP turn into like 3.5 hours when we switch to sftp. We've resorted to parallel connections as a work around which helps, but it's still dog-slow compared to FTP.
There's a patch to OpenSSH that helps, but FTP is still notably faster, and almost no OpenSSH program binary distributions contain the patch, so you have to have a development system and know how to use it to even try it (and on Windows, that also usually means $$$).
I agree there is a real need for a secure replacement for FTP, but have yet to seen any contenders that I can take seriously.