Secure Encrypted FTP
June 21st, 2009These things come in cycles but it seems as if the dreaded FTP hackers are back. Inserting malware in the form of hidden iframes, unescaped javascript into people’s sites via their own FTP details. No brute force, no server exploits, just logging in as the owner and adding the details to the bottom of (usually) index.* or default.* files. The logs show it happening so quickly that it’s obviously a robot designed to do this and this alone.
The infected sites usually download some malware to the user’s machines; usually Windows I might add (I’ve not seen it compromise anything else but never say never eh?) and then we’re not sure what it does. However it would be logical to assume that the very malware that user has downloaded furthers the goal of the original malware i.e. self-propagation or indeed zombie spam.
What we are clear on is that the original hack almost always comes from users uploading and downloading their files to the FTP in PLAIN FTP. Note the obvious here… ‘PLAIN’. FTP is a protocol from the 80s, and whilst it’s quite simple, hence why it exists today, it’s inherently insecure. Authenticating with PLAIN FTP is the digital equivalent of shouting your username and password out of your window. Would you do that? It’s trivial, absolutely trivial for a robot or someone with a packet sniffer to obtain these details.
3DPixel.net has always always recommended the use of secure FTP, namely FTP over SSL / explicit TLS via our guide at http://3dpixel.net/faq/how-to-upload-your-website-via-ftp
It is saddening to see when we receive notification that ‘my site has been hacked’ and ‘your servers have a virus’. I’m afraid to say, that our servers don’t have viruses (as much as one can say as a security focused sysadmin working on a *nix system with all the security / scanning in place) and that the site was accessed legitimately with the valid username and password. There is nothing, as server admins, that we can do to stop this. This robot / hacker HAS your FTP details. They are legitimate users to the server.
Naturally, we could implicitly ‘force’ all users to connect via FTP over TLS. As you can no doubt imagine, the amount of complaints we received about ‘not being able to connect’, ‘my old host didn’t do this’, ‘why are you making it “hard” for me to upload my website?’ questions flooded in. We even tried to persevere through the ‘we fear change’ 3 month window but, 6 months later it was obvious that this was not going to stick and we had to revert to it being ‘optional’ with a strong recommendation to use FTP over TLS. Spineless? Maybe.
Just remember, please always try to connect to your site using FTP over TLS. There is even a better, read: more secure method of FTP which is SFTP. FTP over SSH. We unfortunately do not give this to our shared customers as it requires we allow SSH access we we don’t allow in any case. Naturally, SFTP is the way to go with a dedicated or VPS server.
