R.I.P. FTP

Slashdot contributor Bennett Haselton says "Using FTP to administer a website is insecure -- but not for the reasons that you probably think. You yourself can stop using FTP any time you want, but how do we change the landscape Net-wide, to reduce the number of breakins using stolen FTP credentials?" You know what to click on if you want to read the rest.

On July 1st I found that one of my less important websites, hosted on a low-cost shared Web hosting service, had been broken into. A friend emailed me to say that the site was showing up in Google's search results with the Google "This site may harm your computer" warning listed next to it. I found that on one of the pages, about 1,500 HTML script tags had been inserted, loading JavaScript files from pseudo-random Russian hostnames like "www.chk06.ru" and "www.errghr.ru", none of which are currently resolving. Usually, when such script tags are maliciously inserted into a page on a website, the script tags attempt to install spyware on the machines of people who visit the site.

I immediately replaced the infected file on the website with the backed-up clean copy from my machine, and changed the password on the website in case the attacker had gotten in by using the old one. (The original file with the script tags inserted is here if you want to examine it, but use with caution -- if the .ru hostnames in the script tags start resolving again, then opening the file could cause the JavaScript on the pages to be loaded, which might infect your machine.) Then I started investigating (a) how this probably happened; (b) whether future similar attacks could be prevented, by changing some defaults in the way that hosting accounts are set up; and (c) whether the incentives for hosting providers are such that these changes are likely to happen by themselves, or whether it will require some third-party advocacy to change what we think of as "best practices".

Denis Sinegubko, the webmaster of Unmask Parasites, a free service that scans websites on demand for signs of break-ins, says:

The majority of web site compromises happen because of:

1. Stolen FTP credentials. Spyware on webmasters' computers: key-loggers, traffic sniffers (FTP protocol sends username/password as plain text), trojans that steal credentials from various programs' configuration files (FTP clients, DreamWeaver, etc).
2. Security holes in popular web software: CMS (Joomla, Drupal, etc), Forums (phpBB, vBulletin, Simple Machines, etc), Blogs (WordPress). Once a vulnerability discovered, hackers configure their automated tools to search the web for websites running vulnerable versions of the software and exploit them. This can be done easily and at almost no cost when they have an army of zombie computers.
3. Security hole in "in-house" web software. Many novice (and even many experienced) web developers don't properly sanitize user input making various attacks possible (SQL injections, XSS, etc)
4. Poor security practices (Something that should be manually configured by site/server admins and cannot be fixed with automated security updates): Weak passwords, open ports, insufficiently strict permissions for limited accounts, files and directories with world write permissions, etc.

I didn't have any third-party web software or custom-made software installed on the PublicEditorMyAss.com site, the password was a seven-letter meaningless mix of letters and numbers, and I didn't have permission to change most of the things like open ports and file permissions. That left the possibility of stolen FTP credentials. This is in fact what Sinegubko says is the most common cause of such break-ins:

I guess 90% of attacks use stolen FTP credentials this year. Check this Google's graph that shows the top 10 malware sites as counted by the number of compromised web sites that referenced it:
http://googleonlinesecurity.blogspot.com/2009/06/top-10-malware-sites.html

I reviewed 4 most widespread of them (Gumblar, Martuz, Goooogleadsense, Googleanalytlcs). All four used stolen FTP credential to penetrate web sites and upload malicious content. The chances are the rest used this vector too.

When the PublicEditorMyAss.com site was set up, the default setting was for pages to be edited over FTP. Even though FTP sends and receives passwords without encrypting them (in contrast with alternatives like SFTP or "secure FTP", which encrypts passwords), for a long time I had assumed that this was not a major security problem, because in order for an attacker to intercept the passwords in transit, they would have to control a machine somewhere on the path between my home computer and the PublicEditorMyAss.com server. I figured this wasn't worth worrying about, because it was much more likely that an attacker would attempt to steal the password by installing spyware on my home computer. And if an attacker managed to do that, then I assumed that the risk of passwords being stolen by spyware was about the same whether I used FTP or SFTP -- because either way, the spyware could just steal my password by reading it out of a configuration file where the password was stored. (Even though FTP and SFTP programs both store passwords in an encrypted format, the programs have to be able to decrypt the passwords in order to use them whenever the user wants to open a connection. So the spyware could just mimic whatever steps the client programs use to decrypt the stored passwords, in order to steal one of my passwords stored in a file.) So, I assumed it made no difference whether I used FTP or SFTP.

But according to what Sinegubko told me, this reasoning was probably wrong. The problem is that even though spyware installed on your machine could read passwords that are stored in configuration files, it would be a lot of work to write a spyware program that could do this, because every FTP program and SFTP program stores passwords according to a different algorithm. It's much simpler for spyware to simply watch the traffic sent and received from your machine, so that any unencrypted passwords will be spotted:

[Passwords can be stolen by] sniffers that read all TCP traffic on local computers. Like personal firewalls but malicious. They can easily intercept FTP credentials since they are sent as a plain text.

Sinegubko describes how one of his contacts obtained evidence that a common spyware program was doing exactly this:

One of them even infected a spare WinXP computer (with Gumblar) to test the consequences. On the infected computer he created a new account in a popular FTP client and saved it. The server address was correct (his server) and the username/password pair was not valid. A few hours later in FTP logs, he discovered login attempts that used that invalid username/password pair from a Singapore IP, then from a Florida IP, the some other country's IP. Apparently the FTP credentials were somehow stolen from that infected computer.

I know of only two instances where I've ever definitely been infected with spyware. I don't do stupid things like downloading and running strange programs from third-party sites, so I think both infections were probably caused by a site exploiting a security hole in Internet Explorer, or in a plug-in like Adobe Acrobat or the Flash player. Both times, once I noticed I was infected, I got rid of the infection with Malwarebytes, but I don't know how much damage the spyware did in the meantime.

So this was a case where a little knowledge can be a dangerous thing. If I had known nothing about Internet architecture, and someone told me "FTP is less secure than SFTP," I would have found a way to switch to administering the site via SFTP. But because I knew that the main reason FTP was considered "insecure" was because it transmitted passwords unencrypted, but I also knew that most of of the machines relaying those passwords in transit were secure and trustworthy, I thought it didn't matter. Now it seems that is probably how my password got compromised after all.

In that case, why don't more people switch to administering their sites via SFTP instead of FTP? Here are the steps it took me to enable SFTP on my GoDaddy hosting account. Feel free to use this as a reference, but the obvious point is that as long as this many steps are required, it's safe to say that most users won't be switching:

1. Go to the "Hosting" menu and pick "My Hosting Account."
2. Next to the name of your website, pick "Manage Account." This will open the Hosting Control Center.
3. In Hosting Control Center, click to expand the "Settings" options.
4. In the "Settings" control panel, click the "SSH" icon.
5. You will see a page saying "SSH is not set up", and prompting you to enter a phone number so that their automated service can call you with a PIN number. After you enter your phone number, the phone rings a second later, and you enter the PIN in a form on the GoDaddy website.
6. You will then see a page which says:

   Current Hosting Account Status: Pending Account Change
   Your request to enable SSH is being processed. This upgrade may take up to 24 hours.

In fact, even if only one step were required to switch, most users probably wouldn't change from the default setting to use FTP, due to the eternal, unchangeable fact that most people do not change their default settings, ever. (What percent of users ever change the default set of toolbars that are displayed at the top of their Web browser window?)

If more Web hosting companies made SFTP the default, then the number of websites that were compromised by stolen login credentials, would probably go down. Spyware authors might start to make their programs smarter at that point, enabling them to read the passwords stored by popular FTP and SFTP programs, so that it would make no difference whether the passwords were transmitted in the clear or not. However, this would be harder for spyware authors to do correctly, so it would at least raise the bar for a successful malware attack, and the number of compromised websites would be reduced.

Unfortunately, Web hosting companies don't have much incentive to make users switch to the more secure SFTP protocol. This isn't necessarily true of all security risks; sometimes the hosting company has a strong incentive to pass on the right wisdom (and select the right default settings) for their customers. From the hosting company's point of view, you could divide risks into three categories:

• Risks where the hosting company pays a large part of the price for a customer's machine being compromised. For example, if a cyber-criminal takes over a customer's machine and uses it to launch a denial-of-service attack by sending it a flood of traffic, the hosting company will see that traffic spike on their network. The hosting company has the most incentive to help prevent these types of attacks.

• Risks where the hosting company doesn't directly pay a price for the customer's machine being compromised, but they may have to deal with complaints sent in by third parties. For example, a customer's website could get broken into, and script tags could be inserted into the pages that cause visitors' machines to be infected with spyware. Those visitors might complain to the webmaster of the infected site, or they might complain to the hosting company, which then forwards the complaint to the webmaster. The hosting company may have to provide a few minutes of tech support to the customer, advising them to change their password and scan their own machine for spyware, but they probably won't incur any other material costs.

• Risks where neither the hosting company nor the customer pays a price for the machine being infected, but the price is paid by "Internet users as a whole." The only attack that I can think of in this category, is an attack where a cyber-criminal inserts key words into your web page and links them to his site, in order to increase his Google ranking for searches for those key words. Neither the website owner, nor any visitors to the website, are victimized directly; the harm being done is that the quality of Google search results is reduced for everybody. The only reports of the attack would probably come from "good Samaritan" Web surfers, who tell the hosting company or the webmaster that one of their pages has been vandalized.

When a customer's FTP credentials are stolen, the price paid by the hosting company lies somewhere in the middle. An attacker who stole my current PublicEditorMyAss.com credentials would only be able to deface the content on the site, but they wouldn't be able to launch an attack against a third-party network (my PublicEditorMyAss.com hosting account doesn't have the ability to initiate an outgoing connection to a third-party site).

Weighing in the other direction are the costs of switching to SFTP. If existing customers are forcibly switched over, phone lines will be clogged by customers wanting to know why their old method of logging in to their site has suddenly stopped working. A better choice would be to allow existing customers to stay with FTP while making SFTP the default for new customers. But there is a time and money cost of changing anything, even a default setting.

So GoDaddy doesn't have much incentive to make SFTP their new default. Indeed, I've used many different shared hosting companies before I started running proxies exclusively on dedicated servers, and none of the shared hosting companies ever used anything but FTP as the default method for customers to administer their websites. So who can blame them? They're not making the choice that makes the most sense for their customers or for Internet security as a whole, they're making the choice that makes the most sense in terms of costs and benefits for themselves, and I'm not being judgmental about that. We shouldn't expect most companies to ever behave in any other way.

That's why I think that glib "solutions" to security problems, like "Everybody install anti-virus software", or "Everybody stop using Windows", aren't helpful, because regardless of whether these ideas would work if everybody actually followed them, the fact is that most people won't. The problems have to be addressed in terms of changing incentives for the choices people make.

What's an idea for reducing the risks of FTP credentials stolen by malware, that addresses the incentives problem? Maybe give tax breaks to Web hosting companies that set up customer accounts to use SFTP instead of FTP by default? Or ask more computer vendors to include a desktop link to pre-installed SFTP software, so that when Web hosting companies present options to their customers, it's easier for users to choose the SFTP option since they have a client already installed? (I was tempted to recommend that Microsoft include a universal SFTP client pre-installed in Windows with a prominent desktop link, but the problem with that is that if almost everybody used the same SFTP client, malware authors would have greater incentive to reverse-engineer the algorithm that the client used to store saved passwords -- and then passwords would be just as easily accessible to spyware, as if the user were using FTP all along. So a good mix of SFTP clients is safer for this purpose.)

Since the difference between SFTP and FTP usually only matters in cases where a customer's machine has been infected with malware, obviously the best solution is to avoid malware altogether, but that's much harder problem to solve, as long as malware authors can keep finding security holes in Internet Explorer and other popular programs. Making SFTP the new standard for Web hosting accounts is something that we know how to do, right now. The incentives aren't currently right for Web hosting companies to make it happen. But there may be ways to change that, and I'll bet some people can think of better ideas than the ones I've suggested. I'm just saying that the incentives problem is where attention should be focused.

Comments

All you need to know:

[Godeke]

I know of only two instances where I've ever definitely been infected with spyware. I don't do stupid things like downloading and running strange programs from third-party sites, so I think both infections were probably caused by a site exploiting a security hole in Internet Explorer, or in a plug-in like Adobe Acrobat or the Flash player. Both times, once I noticed I was infected, I got rid of the infection with Malwarebytes, but I don't know how much damage the spyware did in the meantime.

Malwarebytes is good software, but as you point out you don't know how much damage was done. Secondary infections can easily be missed, and many malware programs open your machine to further exploitation. As tired as the suggestion is, you needed to do what you did with your website: revert the machine to a known good backup of the system state, formatting first. Anything less and you *should* have that nagging doubt that you haven't actually cleaned everything up. There are ways to diminish the concern: inspecting the machine for unexpected packet flows, using anti-rootkit tool, etc... but only by formatting and restoring a know clean state or formatting and just restoring your data files will you be confident).

Re:All you need to know:

[Phroggy]

This assumes your "known good" backup is really clean. If you can't tell whether your current system is clean after removing the malware, how can you know whether your last backup was clean?

Re:All you need to know:

[MindStalker]

Exactly. A reinstall of your operating system is your best bet. While you will obviously have to copy the files back over you should be able to scan the files before/during copying. The files will only reinfect upon launching them generally not upon copying them (some old DOS systems excluded).

Re:All you need to know:

[clam666]

I told you people the God-damned internet was going to be a problem when you bought it, and now you're messed it up real good.

Next time listen to Daddy. Your mother and I told you pr0n and dirty pictures would lead to nasty business. Now we can add this one to the list.

1. Blindness
2. Hairy Palms
3. Broke the God-damned internets

Re:All you need to know:

[BikeHelmet]

Some of the stuff that can be missed by a thorough examination can't be purged through a reinstall.

I'm talking about those nasty buggers that hide in the BIOS chips, and re-infect on OS reinstall.

My (current) computer has never been infected by a virus or any malware - but I'm so anal that I open any possibly dangerous links in Opera, with all plugins disabled, rather than my default browser. (Firefox)

I also type many sites into the address bar in a form that'll go through Google's servers(www.slashdot.org -> "slash dot"), rather than using bookmarks. That way it'll warn me if the site could infect me with something.

Back we go then...

[Canazza]

Back we go then to HTTP based web forms...

RIPFTP!

[SteveHeadroom]

Isn't that the sound someone makes after eating enough chili or lentils?

WebDav

[lymond01]

How to secure WebDav
http://www.howtoforge.com/webdav_with_ssl_and_two_factor_authentication

It doesn't matter

[RenHoek]

Look, if your machine is infected by malware, it's not going to make any difference if you use FTP or SFTP or god know what else.

Either your passwords are stored on your harddisk or you're going to have to type them in at a later point. In both cases software is going to be able to get your passwords. And they have that they can get in without a problem, regardless of protocol used.

So instead of this looooong article, some more vigilance online to avoid the infection to begin with would be more helpful.

And if you _have_ to use MSIE, use SandboxIE.

Re:It doesn't matter

[Goaway]

You know, the article addressed that, but let's have it one more time:

Sure, a determined attacker with malware on your machine can get your password for anything. But these aren't determined attackers. They are people throwing their nets very, very wide, and they rely on automation to find their passwords. Getting every keystroke isn't going to tell them what your password is without manual analysis, and nobody has the time for that. And making your keylogger smart enough to figure it out by itself requires adapting it for every possible file transfer client out there.

So it is much easier to just listen for FTP connections. That's the low-hanging fruit. The software COULD do other things, but it generally DOESN'T. At least not yet.

Re:It doesn't matter

[hrimhari]

And it looks like the article also missed your point, since it says how intercepting packets in public internet is not the problem, but infecting your machine to sniff them from the source.

Re:It doesn't matter

[a-zarkon!]

Funny, I've heard the same arguments against implementing encrypted protocols and banning plain text protocols too many times to count:
      1) That's not possible on a LAN because we have ______ select from (switches/firewalls/antivirus/leprechauns)
      2) That's not possible because someone would have to hack into the Internet to see that traffic
      3) That's not possible because anyone who could do something that tricky would not waste their time on us
      4) It doesn't matter because we don't have any _____ select from (credit cards/SSNs/personal info/nuclear launch codes)

In my experience and at the risk being modded a troll (believe me, that is not my intent) these assertions are typically made by system admins who resent being asked to change the way they do anything and generally won't take a step in the right direction until they've already been burned. Let me state that these arguments are all wrong. However, let's conveniently side-step the proving of why these assertions are wrong for now. Instead let's examine the alternatives:

-Replace Telnet/RSH with SSH
-Replace FTP with SFTP or SCP
-Replace HTTP with HTTPS (at least for sensitive data and/or authentication)

In all cases, implementing a secure access method is relatively trivial. Even if you don't believe in Santa Claus - is it going to really cause you that much hassle to leave a couple of cookies and a glass of milk out on Christmas Eve just in case?

Re:It doesn't matter

[tehdaemon]

As if the other replier weren't enough... In order to read your IP packets some machine in the network between you and the FTP server needs to be compromised. And the easiest by far is your own machine. The whole point of this story is that malware does just that - it sniffs the packets as they leave your own machine to get those passwords. That is easier than installing a keylogger.

T

Re:It doesn't matter

[Bert64]

A lot of web hosting is done on colocated boxes, sitting on a lan with a lot of other colocated boxes... If one of them gets compromised, running a sniffer to capture insecure logins to the others is not too hard.

Re:It doesn't matter

[DavidTC]

In your universe, it's really 'far more trivial' to support dozens of different FTP and SCP programs, and/or to keystoke log and magically decide when someone's typing their username and password (And then somehow figure out what site they connected to?)...

...than to watch all outgoing traffic to port 21, wait for the standard FTP username and password prompt, and log the replies and IP?

Seriously, at this point so many people are missing the point, that I'm bemoaning the collective lack of intelligence on this site. Sniffing an FTP connection is MUCH easier than decoding obfuscated passwords and monitoring thousands of keystrokes.

FTPS

[xororand]

It's unfortunate that FTPS still seems to be widely unknown. FTPS is an extension of the FTP protocol which secures the control & data channels with TLS. It's standardized in RFC 4217.

Restricting users to their home directory is much easier with FTPS than with SSH. The latter requires you to setup a chroot jail for each user. At least OpenSSH has built-in chroot support that allows you to specify a chroot environment for each user via /etc/passwd.

Many FTP clients and servers support the FTPS protocol, for example:
* FileZilla
* curl (and curlftpfs)
* lftp

Servers:
* vsftpd (can enforce encrypted FTP)

Re:FTPS

[hardburn]

Does it fix FTP's multiple port usage? This design is a constant source of problems on firewalls, particularly stateful firewalls. Many types of firewalls from various vendors and operating systems have been penetrated over the years due to handling the complexities of FTP's port usage. There are fixes out there, of course, but the problem would go away if we standardized on OpenSSH SFTP.

Re:FTPS

[gpuk]

I have to disagree. I have no problem connecting from behind NAT to a my FTP daemon on the public internet. I run vsftpd with forced TLS encryption for both control and data channels.

Re:FTPS

[bitslinger_42]

I run the secured FTP server for my company, and I'm finding that FTPS survives through one layer of protection (i.e. a NAT on one end), but it dies if there are more (i.e. NAT on one end, firewall on the other). It isn't 100%, we do have some users that are just fine on FTPS, but the vast majority of my users are coming in through SSH-based SFTP.

Re:FTPS

[Hatta]

How does one break out of chroot?

Third, if there is no root user defined within the chroot environment, no SUID binaries, no devices, and the daemon itself dropped root privileges right after calling chroot() call (like in the code below), breaking out of chroot appears to be impossible. In other words, if there is no way to gain root shell or perform actions that only root can usually perform (e.g. create devices, or access raw memory) breaking chroot is not clearly possible. Ideally, if the custom software uses chroot for security the sequence of calls should be:

chdir("/home/safedir");
chroot("/home/safedir");
setuid(500);

Keep in mind, that after these lines are executed there will be no way for the program to regain root privileges.

Chroot can clearly add to security if used correctly.

Re:FTPS

[fnj]

Horse shit. chroot is a tool. Used properly, where applicable, it can greatly enhance security. Used improperly, it does little or no good. It doesn't matter what it was invented for; it doesn't matter how many times people make blanket statements about it; the fact is that it can be used as a useful security tool.

Some of the other commenters point you to sources detailing chroot's weaknesses and pitfalls, and how to avoid them.

There is no perfect, cure-all security measure. That doesn't mean you don't use available tools to enhance security as much as possible. The world is not black and white. It is shades of grey.

I'm not quite sure where you're aiming with the statement "FTP without a chroot is not really any different than ssh without a chroot.", but it strikes me as utter nonsense.

Pardon my French, but your sweeping statements are just out of control, beginning with where you call your parent's post silly.

Re:FTPS

[mzs]

Okay the guy you replied did not write in a pleasant way but he has a point. chroot is not jail, chroot is easy to break out of on many systems. The reason is because once you are chrooted you can call chroot yourself. The canonical approach to break out of a chroot jail that has been known about now for 10 years or so works like so:

mkdir "foo"
fd = open "."
chroot "foo"
fchdir fd
for (i = 0; i < 0x100; i++) chdir ".."
exec "/bin/sh"

Most chroots don't change the the cwd so the fchdir is often not needed also the dirent approach works as well in other cases.

So now you are running as nobody or yourself and you can use the local privilege escalation of the day to get root access, but just breaking out of the chrooted environment may have been the goal, you know like you were not supposed to be able to run a shell at all. Or you may now run some denial of service (local or remote).

So some systems prevent this. One notable is BSD where chroot fails if you have fds open. There also are other approaches for breaking out of a chrooted environment, as well as countermeasures.

One point is how would you run this stuff at all. Well one argument is that this might be a webserver where you have CGI and therefore an interpreter like perl, and doesn't that example I wrote there look a whole lot like perl. The other argument is that this was first seen in the wild against wu-ftpd back in 1999, and it used a buffer overflow to inject that same code to break out of the chroot jail and execute the shell in place.

So the argument I am trying to make in a much more civil manner is that if you need something like jail, use something like jail and not the poor substitute of chroot instead.

Re:FTPS

[mzs]

chroot failing with EPERM when euid is not 0 is not universal. In fact it is relatively recent. I think it appeared circa FreeBSD 4.8 (or was that 4.4) in fact as a result of another exploit to escape chroot. I would not count on chroot only working for root, I've used systems where it was not the default and others that were poorly configured so that it was allowed (see man 5 privileges on solaris for example). There are a whole list of ways to break out of a chroot jail, and work a rounds have been adopted over the years. Another popular one was using mknod and using the superblock in there, but that has required root for as long as I know of.

Then there is the problem that a lot of programs that are run in a chroot jail do not call setuid (and only sometimes seteuid) since they do in fact need some root permission. For example an ftp server might need it for ports below 1024. In fact Samba was vulnerable to such a chroot escape in the past a couple of times.

Again, that's another reason to use something jail like instead of chroot like, the intent is that even root cannot escape a jail.

Then there is the whole can of worms that chroot really only tried to capture you to a portion of the filesystem. There were attacks where yo could send signals to other processes and just look at processes of other users for example. It all leads to the desire of having something jail like like jail or zones.

Re:FTPS

[raju1kabir]

Here's something that actually answers my question rather than just repeating its antecedent, in case anyone else has it:

http://www.linux.edu/index.php?option=com_content&task=view&id=45&Itemid=9

Users can't tell the difference

[Anonymous Coward]

Our end users keep asking and referring to FTP, when all they need is a way to transfer files temporarily (especially when the email server doesn't like 2 gig attachments). So we setup a web interface to post files, download them, and autodelete. They have been happy with it since then. What do they call it? The FTP server.

The FTP term has lost its meaning to represent a protocol (which is what the IT staff thinks of it as) vs the end users with think of FTP as a generic term to transfer files.

Re:Users can't tell the difference

[4D6963]

I hate to point out the obvious, but it might have to do with the fact that FTP stands for File Transfer Protocol ;-).

Re:Users can't tell the difference

[vslashg]

If you don't know that FTP refers to a specific protocol, you don't know enough to be running a web site.

This is akin to saying if you don't know what a carburetor does, you don't know enough to be driving a car. Now, some people believe this, too, but this statement, and yours, are wrong.

Hey, look, I made a Slashdot car analogy!

SFTP support is still spotty ....

[King_TJ]

Switching from FTP to SFTP on the server side is great, in theory, but it's really only a trivial task for people running Unix type operating systems.

SSH isn't an integral part of most Windows operating systems, and nearly all of the well-regarded, commercial FTP servers for Windows have no SFTP support in them.

(I understand the Serv-U FTPD for Windows does support it, but it's an exception to the rule.)

I recently ran into this at my workplace. We've run the commercial WFTPD product (from Texas Imperial software) for years, but I had to get rid of it when our bank started requiring SFTP connections to send us electronic scans of daily check deposits.

My Server

[ironicsky]

I run a linux server that has FTP services on it.I did have an issue a while back where someone's ftp account got cracked, someone uploaded a malicious root kit, then executed it through the web and... BLAMO! I was compromised. Every .html and .php file on the server was over written. I didn't feel like cleaning it up, so I just loaded the back ups on the a clean server and took the compromised one out of production.

But I did make one change on the new server... I upped the security substantially. One of the changes involved enforcing SFTP and discontinuing my FTP services.

For me, all it took was one serious compromise to wake me up. I'm sure for a lot of other people it will be the same.

Re:Amusingly..

[Archangel Michael]

So, how does one upload to a website? CPanel? Secure Shell? Do Tell! You know, not everyone manages their own server ....

Keyloggers don't care

[kenp2002]

SSH, SFTP, SCP, FTP, ZMODEM, KERMIT, AND ALL THAT CRAP MEANS NOTHING!

Why? because moron employees surfing for p0rn at work will get a keylogger by accident installed and grab more information then packet sniffers EVER will. Regardless of how well the encryption is the keylogger and malware will trump all measure if employees are careless.

You can get a silent VNC session going and lockout the physical keyboard and mouse and by the time they figure out what has happened you have enough control to grab what you need.

Hell just track the next time they go to amazon.com or any onther online site. Who gives a rats ass about SSL when you are seeing them type in their info?!

FTP vulnerable? No more then your home phone line or cell phone. The problem is and always will be PEOPLE. One they have control of the physical machine all bets are off for ANY security measure.

Arguing protocols being secure or not is like arguing which unloaded gun is more dangerous....

Re:Keyloggers don't care

[Anonymous Coward]

Two words: "ssh keys".

Any passphrase associated with an ssh key is meaningless to keyloggers unless they also get the keys themselves. Far as I know, most modern keyloggers aren't that sophisticated yet. Granted, they could very well become so, but so long as Windows users are kept in the dark about SSH/SFTP and keep using Telnet/FTP, they probably won't...

Waaaaaaait... THAT'S why FTP is still around! A decoy against users with keylogger'd machines! Keeps the rest of us safe! NOW I get it!

Re:Keyloggers don't care

[Hurricane78]

Yeah! That's why I replaced all my employees by very small shell scripts. :P

Re:Keyloggers don't care

[tibman]

I recently read about a keylogger that plugs into your powergrid and can read keypresses up to 15 feet away via groundwire. There are even physical keyloggers that sit between the keyboard and box.. how easy would it be for the wife or friend to do this while you take a bio break? Software keyloggers can be very benign and go undetected for long periods of time too. Lots of programs use "global hotkeys" and similar features which function in the background to monitor all keyboard input and trigger zero anti-malwar/virus warnings.

FTP isn't going anywhere

[BigJClark]

Its an amazingly simple protocol, lightweight, and easy to setup and administrate. Concerned about security? Tunnel it with SSH. I think there is a packaged app out there somewhere (sftp?), but really, I tunnel all insecure protocols with SSH, using an incredibly simple, yet powerful app (putty).

Paper tape of course

[davidwr]

I send my files in by paper tape sent by a bonded, armed courier.

Re:Paper tape of course

[LihTox]

I send my files in by paper tape sent by a bonded, armed courier.

You only think he's a courier. Muhahahaha!

(Now where's that Anonymous button...?)

Not just unknown, incompatible

[danaris]

I have tried to set up an FTPS site.

Even with vsftpd, I was unable to configure it with settings that allowed it to connect with more than 1 different type of client at a time. So far as I can tell, there are a half-dozen different implementation of FTPS out there, none of which are able to interoperate properly.

SFTP is much more standard and well-supported, and more or less just works, and there are various tutorials out there for setting it up.

Dan Aris

Re:Authentication goes both ways.

[minsk]

Most SSH clients will verify that you are connecting to the _same_ server as last time. However they can not verify the actual identity of that server.

(Well, server with the same key as last time you connected to that domain name or IP, but close enough)

Re:So much for regard

[Trashman]

I can't see why they should be considered well-regarded then. That's negligence. Pretty much every Windows FTP client for the last 5 years commercial or otherwise does SFTP now.

Well, third-party clients, Yes. But, why is that in 2009, Microsoft doesn't ship a client (or a server) that does SFTP with their OS?

The security lie

[Lord Bitman]

Once you have discovered you are infected, the ONLY way to be safe is to assume that you have also been infected in at least 100 other, undiscovered, ways.
Security companies like to sell the lie of "buy our product! Be safe! And if something slips through, just hit "delete" and be safe again!" but it really doesn't work like that: If there's one, there's three, and those three turn into a hundred very easily.

The only way to be safe is not "buy some guy's security software" (you're machine's been compromised, how the hell is running something else on the same machine supposed to help??), it's "reformat, treat every backed-up file as compromised". Sad, annoying, true.

In summary: when you found out you were infected, you did the equivalent of nothing at all, then were surprised when a password was stolen several months later.

Re:Amusingly..

[maxume]

If you are maintaining a local copy and then 'uploading' it to the server, you freaking use rsync. If your host doesn't support rsync, you quit them.

Missing the point...

[hackel]

Amazing how this article (and so many people responding) seem to be missing the point entirely. The real problem is people using operating systems that are vulnerable to these types of attacks! I don't know about Vista, but even if Linux was ever targeted for this kind of attack/spyware, you would have to run the software as root to enable packet sniffing! And anyone who uses IE for regular browsing and not just local site development is clearly not a competent web developer and has no business working in this industry! Seriously--how can anyone still use IE, FTP, or anything like that in this day and age? I think I stopped using FTP, what...10 years ago now?

The bottom line is that all hosting companies must disable all access to their services via insecure FTP. It's shameful how many companies still use it. I'm in such an isolated bubble, apparently, that I didn't even know this was still going on until recently I had to access a shared web service to migrate a particular client. I was shocked, to say the least! Secure-FTP (over SSL) is not sufficient as it only encrypts things without verifying the authenticity of the host you are connecting to. It's bad enough that people keep using Windows, but since we can't control this, competent sysadmins really need to take the initiative in disabling FTP. Likewise, unencrypted pop3, imap, telnet, or whatever unencrypted services they provide.

Re:Amusingly..

[Hatta]

Rsync.

Re:Amusingly..

[ThePhilips]

Given the fact that most websites will be hosted on a Linux box ...

That makes it easier. Most Linux systems I have installed in past years don't have ftpd preinstalled.

On security note, default configs of ftpds found in Fedora, SUSE and Debian are [censored] insecure: they allow anonymous to access anything on hard drive while rejecting (even over SSL) valid users.

Unfortunately, raw FTP still rules when you need a high bandwidth. With SCP/SFTP I get consistently 4-5 times lower transfer speeds compared to FTP. It doesn't matter much if one transfers megabytes. But SCP/SFTP becomes a pain when one needs to upload dozens/hundreds megabyte. 'tar cf - . | ssh tar xf -' trick speed things up, but not always available.

As for how you would get around this if using a Windows/IIS server I wouldn't have the first clue and my advice would probably be along the lines of "get a man's operating system and stop using asp"!

IIRC, M$ stack uses WebDAV over HTTPS for such stuff. Abomination had spared me, thus do not have any performance numbers.

Re:well then the answer is simple

[kenp2002]

its very easy to blame the lusers

That's because they are the largest contributor to an insecure system.

your post means nothing

My post means that you are better off spending more time training people then finding new technological ways to make things stupid-proof.

Wrong side of the problem

[gmuslera]

No protocol is secure if your side aren't. A keylogger, in your pc, not in the remote site, defeats anything that is password based. Trojans that read or steal configurations of common clients (even ssh certificates) also defeats a lot of usually secure solutions. Even installing software that enables remote administration and not worrying ever about announces of remote vulnerabilities is wrong. When worrying about something that can be accesed in internet, remember that you are in internet too.

Where you should start changing things? replacing the ftp protocol? the ssh protocol? tcp protocol? Start changing yourself, securing your desktop in effective ways (drastically lowering odds switching away from windows could be an start), and how you use it.

Re:Amusingly..

[Mr. Slippery]

If you are maintaining a local copy and then 'uploading' it to the server, you freaking use rsync.

rsync can freaking use ssh, rsh, or its own daemon connection. Using an rsync:// or an rsh connection is freaking insecure. But freaking-a, rsync over ssh freaking rocks.

Re:Misconception about crypto in article

[LostOne]

Bzzzt! Fail.

That only works on the *server* side. TFA is talking about the *client* software which saves the password for you so you don't have to enter it every time. There is no possible way for the client software to provide the correct password to the server unless it can obtain it, either by decrypting its stored password or by querying the user. So, no, a one-way hash is not usable in that circumstance.

RTFA!

[SanityInAnarchy]

From TFA:

I figured this wasn't worth worrying about, because it was much more likely that an attacker would attempt to steal the password by installing spyware on my home computer.... So, I assumed it made no difference whether I used FTP or SFTP.

But according to what Sinegubko told me, this reasoning was probably wrong. The problem is that even though spyware installed on your machine could read passwords that are stored in configuration files, it would be a lot of work to write a spyware program that could do this, because every FTP program and SFTP program stores passwords according to a different algorithm. It's much simpler for spyware to simply watch the traffic sent and received from your machine, so that any unencrypted passwords will be spotted

Same goes for keyloggers, by the way. You can look at everything I type and hope you get a password, or you can just intercept FTP, where you know exactly where the password is being sent.

Not that we shouldn't protect against keyloggers, but why would you make it easy?

FTP vulnerable? No more then your home phone line or cell phone.

Not true -- while eavesdropping is probably easier with a phone conversation, man-in-the-middle attacks are much harder. If you said something, I know it was you who said it, because it sounds like you -- whereas with FTP, the server doesn't know if I uploaded the file, or someone in the middle uploaded the file, or someone who stole my password uploaded the file.

You can get a silent VNC session going.... Hell just track the next time they go to amazon.com or any onther online site. Who gives a rats ass about SSL when you are seeing them type in their info?!

Because you have to 0wn me first.

If you don't bother with SSL, then there's no way the user could be careful enough or savvy enough -- the next time they order something from a wireless hotspot, someone else's laptop will automatically pick out their credit card number.

If you do, they suddenly have to not only compromise your machine, but actively watch for you to hit amazon.com, or write a much more complex program that hooks into IE (but what if you're not using IE?) and watch for amazon.com, or search through pages and pages of keylogs.

The problem is and always will be PEOPLE. One they have control of the physical machine all bets are off for ANY security measure.

Both very true. But until the person or the physical machine is compromised, all of these other things mean a good deal more than "nothing".

It sounds very much like you're suggesting that we ignore security and encryption, because it's all futile anyway -- you certainly haven't offered a better approach. Well, you know what? Fuck you and your defeatist attitude. The rest of us will be working to actually make things better.

Security through being different?

[Vellmont]

What I get from this overly long article is the author thinks that simply by not being the same as the herd (the herd being people who use FTP) that increases security.

While there's some truth to this, it's a lot less than you think. Being different in one way doesn't save you from all the other ways you're the same. If someone can install malware on your machine, a keylogger would grab ANYTHING you type in. It's not too hard to parse out all of that for username/passwords. It's like saying having a strange non-standard layout to your house keeps you safe from really dumb burglars that've already broken in.

FTP, rsync+ssh

[dwheeler]

FTP is still fine for providing big files that don't need to be protected by a password. But yes, if you're CHANGING data, raw ftp is usually a bad idea.

If you're uploading files, I heartily recommend using rsync+ssh. It's incredibly fast, since only the files that CHANGED are uploaded, and ssh makes it all secure. It can be a pain to set up on some cheap hosting sites, but I've figured out how to make rsync+ssh work even on some cheap hosting sites. Hope that helps.

Re:Amusingly..

[HeronBlademaster]

I used to work at a place where we used SCP to throw files around on the local 10/100 network. Those transfers always maxed out the network speed (11MBps or so). FTP didn't go any faster... I'm guessing your problem was elsewhere :P

Re:Amusingly..

[Bert64]

SCP is 4-5 times slower than FTP? What kind of CPU do you have?
I am easily able to saturate a 100Mbit link using a core2 system thats a couple of years old now... Even on a 1Gbit link i think the disk is the bottleneck moreso than the encryption these days.. Yes it uses a lot more cpu, but it isn't any slower.

Perhaps you are using an extremely poor implementation of SCP?

Re:Amusingly..

[Tanktalus]

A tar trick? At least add Z, z, or j to the commands: tar cjf - . | ssh tar xjf -. Or, simpler, try rsync -avz --delete -e "ssh -l webhostuser" . myhost.org:. The bz2 compression (j option for tar) probably has better compression, but rsync compresses some things that tar can't (see rsync's man page).

Re:Amusingly..

[DavidTC]

While it is possible to read an FTP password as it travels over the wire, most hackers won't go to these lenghts to break into a shared hosting account.

You didn't read the fucking summary, did you? Apparently, malware is doing exactly that.

They figured that, since they were already intercepting net traffic (To screw with web traffic) they might as well sniff port 21 and see what passwords are being used for FTP.

They then use (probably automated) tools to break into the FTP site, see if there's any HTML files there, and add javascript that loads malicious pages.

Re:Hmm

[mcgrew]

Many summaries are pleas for us to look at the submitters' sites, but some of those sites are indeed good. Others, however, are just to someone's blog when a link to usatoady or scientific american would be far better.

It's annoying when you submit a story with a good link, and two days later someone else posts the same story with a link to some lame blog.

Re:Amusingly..

[JWSmythe]

    Actually, what I saw in the summary, for that which I read before I gave up, was that he suspected malware had intercepted his password. It's kinda silly having a packet sniffer listening to all passing traffic, when all they really needed to do was look in common places for stored passwords, and have a keystroke logger intercept interesting things. The later two I've seen quite a bit. The first, not so often.

    In working in a few hosting environments, from the admin side, I will say brute force attacks are anything but uncommon. Unfortunately, some people don't believe in upgrading anything ever. Yes, they do exist. So, they'll have 10+ year old unpatched machines without firewalls up on the Internet because "oh, who would find us?" On the same machines, you can see the FTP and SSH logs where people are attempting to brute force their way in.

    On machines that I personally have full admin control over, there are limitations to everything, even though it doesn't reflect back to the user. Sure, you can try to brute force your way in. It won't do you much good. But as far as you know, the failure notice from attempt #1 is just as legitimate as #10 and #100,000,000. Little does the aggressive hacker know, nothing beyond #5 was accepted, and his attempt on a live server was propagated to other machines under my control so they can protect themselves.

    Back to the original story. It was likely some malware that found auth files, found where the auth information is stored in their Windows registry, or captured the keystrokes. It may have been described in more detail somewhere in that novel that they called a summary, but I failed to read it all before my eyes started to bleed.

Re:FTPS (breaks load-balancers and firewalls)

[toejam13]

One major issue with FTP over SSL/TLS is that network address translation (NAT) devices, such as firewalls and load-balancers, that eavesdrop on the FTP control channel in order to open dynamic data ports fail hard with FTPS.

If you use "explicit mode" FTPS, the client negotiates up to FTPS via a standard port 21 connection. After secure authentication, they can issue a 'CCC' (clear control channel) command which backs the control channel back to a NAT compatible mode. Problem is, this is a client side option. It cannot be pushed by the server. So, it is yet another thing that users must be educated over.

If you use "implicit mode" FTPS, which runs up on port 990, negotiation is not an option. You're immediately forced into crypto mode, and you cannot back out either the control or data channel. "Implicit mode" FTPS is incompatible with NAT devices unless you do some seriously nasty hacks.

In my opinion, SFTP (the file transfer subsystem of SSH) is a much better protocol. It does not utilize dynamic ports, and it doesn't involve callbacks (like active FTP) that make firewall rule management a PITA.

Re:Amusingly..

[ThePhilips]

Nothing special: Linux to Linux over GB LAN or the internet. CPUs are C2D or AMD X2 or better.

Also note that SCP/SFTP transfer files one by one and the handshake times (especially if you have number of smaller files) dominates over actual file transfer times. That's why I have mentioned the tar trick. FTP for whatever reasons doesn't have the problem.

Re:So much for regard

[nine-times]

Probably the same reason why they don't go ahead and replace their CLI environment with some standard-ish Unix shell (e.g. bash) even though it would be a much better solution than their current command line. It's Not-Invented-Here and would increase interoperability, thereby decreasing vendor lock-in. Even if they do implement it, they'll make some weird incompatible implementation with patented "improvements".

Haven't you been paying attention?

Re:Amusingly..

[Bashae]

You'll be fine if you take care of your own computer (which you do indeed manage). This article states that FTP is insecure, but that is based on the assumption that everyone's computer is infected periodically. So if your server is secure and your computer runs a secure OS, or at least a good firewall, a good antivirus, all security patches and is periodically scanned for malware, I don't see what harm the evil spammers can possibly cause.

Personally I barely follow a half of that advice, and yet I am never infected. If you know what you're doing, all it takes is some common sense to keep you safe. Such as not downloading and running suspicious programs, keeping your web browser(s) fully patched and making sure they are not vulnerable (VERY important) and a strong firewall (even if you get infected, it can stop your pet trojan from sending your passwords away).

Re:Amusingly..

[ThePhilips]

OK. Lied. It is disabled by default but seems to be enabled selectively on my servers.

Been trying to switch users for years

[suso]

I'm the founder and main admin of a web hosting company and we've been trying to switch people to SSH/SFTP/SCP for many years. We even put an ultimatum on FTP users back in 2006 that by the end of the year, we'd be turning off FTP. You know what happened? Users backlashed and complained that their old antiquated website software like old versions of Dreamweaver or whatever couldn't do SFTP or SCP even though versions that did had been available for a few years. Also, people who came from other hosting companies too us didn't know about more secure protocols and complained when they had to switch away from their old programs that they liked, even if WinSCP works great. So in the interest of keeping customers, we had to leave it on. We've been pushing SSH since the 90s. And I wrote the # 1 ranked SSH tutorial on the net. So how do you think I feel? Its a really annoying problem and it may take several more years before it completely goes away.

On the other hand, there is one thing that I haven't seen available with SSH and that's the ability to have virtual users and let them be created by the parent user. Maybe there is a trick to make it possible in SCP/SFTP, but there are customers out there who need the ability to have sub users who manage parts of their site and so on. Many FTP servers allow this, but SSH does not. So this is another FTP feature that keeps it going.

And while I'm griping about it, it REALLY doesn't help the situation that WinSCP started supporting FTP.

Re:Been trying to switch users for years

[x2A]

Tunnelier is rather good, includes an FTP bridge. Connect to your ssh server, and it listens on localhost for ftp commands, translates and sends them to your server over ssh. Not only means encryption, but also compression (something I often care more about). Will sit in your system tray and auto reconnect if connection drops, and enable all old ftp-only software to talk to an ssh only server. I talk to everything over it, mysql, imap/smtp, even web traffic can be sped up.

Re:Whaaaaaa!

[suso]

And many of the cheap hosting plans if not 50% of the web hosting industry these days is run by people without a clue. They are run by business people looking for a quick buck. So they just buy a turnkey solution with cpanel or whatever else. None of them read Slashdot or any security websites and most of them could care less if they are insecure. All they care about is that they look good and that they have a pretty girl on the front of their site.

Even big ones like Dreamhost have no clue and are insecure as hell. I haven't updated it in a while and I've heard that Dreamhost fixed or obfuscated their flaws, but I wrote a list of vulnerabilities that Dreamhost has at http://suso.suso.org/xulu/Web_hosting_providers_with_poor_security

Re:FTPS, SFTP, FTP over SSH, ...

[rabun_bike]

And now you have confused people even more. First, implicit FTPS is deprecated. Explicit FTPS is what is being used and implemented. It is what is described RFC 4217. It is what I used in my open source FTPS library and client. Works great.

http://www.ietf.org/rfc/rfc4217.txt

Need more: read here. http://en.wikipedia.org/wiki/FTPS#Methods_of_Invoking

http://www.rebex.net/secure-ftp.net/

It is so confusing I get confused and I have implemented these protocols. The mistake I made in my earlier post was referring to implicit FTPS as the the other mode of explicit FTPS where the user is allowed to turn the tunnel on and off. That is actually referred to as a name which escapes me.

http://www.rebex.net/secure-ftp.net/

Second, for every passive connection you most certainly have to handshake that connection. Certs are passed on the connection and the tunnel is set up each time a file is transferred. It might appear to you as a user of an FTPS client that isn't happening but I assure you it is.

So get off you high horse my little MVP friend and do some implementations and less blogging.

Re:Amusingly..

[statusbar]

I have a 'friend'... yeah, that's it... Who back in 1997 or so had a co-located server running RedHat linux with a vulnerable dns server. It was attacked. Multiple times. I only noticed - I mean my 'friend' only noticed when a further attack caused /etc/passwd to be broken. When the box was taken down and analyzed, it was noted that the system put the ethernet port in promiscuous mode and was sniffing all of the traffic for the co-located boxes that were connected to the same switch. A file on the disk contained all the user names and protocols and passwords of the people with accounts on those co-located systems.

So when you log in with unencrypted FTP, how do you know that the server that you are connecting to is not sitting in a rack next to a compromised system sniffing the traffic? How often do people misconfigure their servers and switches like this, and how would you know?

--jeffk++

Re:Amusingly..

[raju1kabir]

Unfortunately, raw FTP still rules when you need a high bandwidth. With SCP/SFTP I get consistently 4-5 times lower transfer speeds compared to FTP.

Switch to the blowfish cipher, it will speed things up substantially. This is an option in most gui clients; in openssh you can use the -c switch.

Re:Amusingly..

[profplump]

FTP opens an entire new TCP connect for each file transfered, and is plenty chatty in the command channel while that happens. It's probably not the handshake times that are slowing you down.

More likely it's the relative inefficiency of SFTP on high-latency links -- SFTP has a relatively small transfer and pending request window, which means that with any significant latency you'll spend a lot of time waiting for confirmations instead of actually sending data.

For example, in OpenSSH prior to 4.7 the default limit for outstanding requests was only 16. Since 4.7 the default has been 64, and in both versions you can adjust the limit at runtime with `-R num_requests`. OpenSSH 4.7 also increased the default receive window size, which improves transfer speeds on links with non-trivial latency.