Slashdot Mirror
FTP Hacking on the Rise
yahoi writes "The disco-era File Transfer Protocol (FTP) is making a comeback, but not in a good way — spammers are now using the old-school file transfer technology to serve up bot malware, and even as a backdoor into some enterprises that neglect to lock down their oft-forgotten FTP servers. Researchers at F-Secure have spotted a new wave of exploits that use FTP — rather than a malicious URL, or an email attachment — to deliver their malware payloads because few gateways scan for FTP attachments these days."
Gopher?
Further proof that FTP is for chumps. :) scp to the rescue!
First off, since when is a 'URL' considered a transport mechanism rather than syntax for specifying a transport mechanism and location? Is ftp://whatever.example.com/badcode/ not a URL because it's ftp now? That's a goofy statement.
And then, this isn't about ftp being hacked, just that bad software is being hosted using ftp as well as http (which I presume is what is meant by 'URL' or being emailed.
And, ftp is not merely an ancient, deprecated protocol. It's still widely used because it does what is intended for well and works under high load readily.
XML is like violence. If it doesn't solve the problem, use more.
They have conquered WWW and Email, now FTP, next on their list... NTP! Yes, hacking through your clock, I can see it now! Malware which will make you either cronically early, or late!
Karma Whoring for Fun and Profit.
Well, for my money, anyone who blindly clicks on a link.... FTP or HTTP and runs an executable that comes from it is going to get infected regardless of what protocol was used for it.
The fact that a lot of gateways prevent certain actions based on the protocol just makes the "any key" users blindly click on stuff without worry - after all, they've "got protection"
When it comes to any infection vector that involves social engineering, your brain (should you choose to use it) is your best virus protection.
The Digital Sorceress
because few gateways scan for FTP attachments these days.
Er, that's because there's no such thing as an FTP attachment? If you are referring to links, then I'm not aware of any virus checkers that automatically download and check HTTP links either.
Can anybody translate this into something that makes sense?
What the hell is a "FTP attachment"?
Doesn't make sense.
Ruby Neural Evolution of Augmenting Topologies
k thx bye!
Just ignore them. It's good business for them to constantly cry "wolf".
'Once scientists, even the dim-witted social scientists, get muzzled, the Western Civilization is finished.' - oldhack
I'm sorry, but if when setting up server services the admin "forgets" to lock down FTP, they need to be canned. That is all. NEXT.
If you want news from today, you have to come back tomorrow.
Now you have email viruses delivered via FTP. Cool.
Yeah I'm old - get off my lawn!
.. paranoid crackpot leftover from the days of Amiga.
Speaking of FTP I was appalled the other day when my girlfriend told me their small company is paying $100 a month for a service to use FTP for their clients. This service has a space limit of 300 MB!!! With GMAIL and Yahoo email offering unlimited storage this seems unbelievably small.
Clear TXT PASSWD = BAD Might as well bend over. I've made my hosting customers use SFTP/SCP for YEARS. Been very happy I have. Just like POP3 one day.. IF we are lucky people will stop using it. It's like sending your tax return to the IRS in a clear envelope with your name birth date and SS # showing. Just plan STUPID!
It sounds like that 'trusted' sites have been hacked, and that nefarious forces may place files on those trusted sites, then send emails that look authentic. That is, the email looks like it is from a responsible site and has an FTP URL for that site, but the file on the trusted site contains malware of some type.
I have gotten fake hallmark cards in the past, and only because the URLs were obviously not hallmark did I check the headers. Transform this into a malware that installs a back door, grabs your address book, then sends the address book full of trusted names back to the originator. Now you have an email from a trusted source that has URLs to a trusted site to help spread it.
Maybe I shouldn't have typed all that out.....
I rarely read replies, it's my opinion and if you thought about your opinion a little more, I'm OK with that.
except perhaps for the sloppy authentication in the clear and the awkward use of random ports initiated in the wrong direction (from server to client).
What is wrong is that there are ftp servers allowing anonymous write access. That is how those miscreants work: they put a malicious file up on an anonymous ftp server (that allows write access) and then craft ftp URLs to spam people with.
I remember we warned all ftp server administrators about the issue 10 or more years ago, back when I was a rookie.
Of course scp/sftp is way better, everyone knows that. Or not?
My company got hit by this. Basically, someone found a username / password combination on a web server and FTP'ed up a phishing website. This user didn't have a valid login shell {it was set to /bin/false} but that didn't matter here because they didn't need to run shell commands {and in any case, if they needed to, they had a perfectly good cgi-bin directory they could use}.
/bin/true for FTP-enabled users without shell access -- this needs to be mentioned in /etc/shells, of course, for FTP access to work -- and /bin/false for non-FTP users. This should not be in /etc/shells.}
/bin/bash or /bin/ash. In which case, as a bare minimum you should disable password-based logins. There are better solutions involving chroot and per-user bin folders.
Obviously you have to have FTP and web servers on the same machine, otherwise your hosting customers can't upload their pages. To limit the potential damage, disable mod_userdir -- all your users should already have their own domain names anyway. And if you have any "email only" users {usually, these will be secondary mailbox accounts, i.e. when you have things like fred@freds-shed.org.uk going into one mailbox and charlie@freds-shed.org.uk going into another} whose only way of accessing files is by POP3 or IMAP, use a different shell for them. {I recommend
If you have users who want to use scp or fish to upload stuff, they'll have to have a Bourne-like shell such as
Je fume. Tu fumes. Nous fûmes!
I fell victim to an FTP security issue in January of last year. The hosting provider for my website allows for anonymous FTP by default and an organization of hackers was able to use this to upload files which somehow enabled them to edit content on my Drupal powered website (I've seen Wordpress sites fall victim to the same hack). All they did was a meta-redirect, but I had about a week of downtime as I restored from dated backups and got technical questions answered on the Drupal.org forums.
As it turns out, my hosting provider doesn't offer any real real capacity to disable anonymous FTP and I had to set the maximum allowed data transfer amount to 0KB for anyone except myself.
Check it out. That, my friends, is a real Clock Gobbler.
GP was talking about scp being implemented in 1995, not FTP.
Absurdity: A statement or belief manifestly inconsistent with one's own opinion. -- Ambrose Bierce
Firefox spell-check agrees: two Ns, one L in "tunneling". Further, no ambiguity is introduced by not doubling the L.
;D
It's a peculiar Americanism. There is robbing, but there's also robing as in the opposite of to disrobe. Raping and rapping are formed from rape and rap respectively, so there's where ambiguity steps in to set the rule. However, it is impelling and not impeling, or even compelling and not compeling. Is it the rule to limit how many repeated adjacent letters you have in a word? There's potterring (Brit.) and pottering (US) but there is only puttering and not putterring anywhere?
For me, it's trust the spell checker, but when in doubt verify. I'd rather have consistent rules, but English is such a mongrel language anyway, borrowing words everywhere. It's annoying, but at least it isn't annoyying.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?