How Do Hackers Attack FTP Servers and What Can You Do About It?
Reading Time: 5 minutesEven the process you use to transfer files between devices can be attacked by hackers so data can be stolen. Here’s what you need to know.
Your data could be at risk simply by transferring files between your own device and a website. To safeguard your personal information, the firewall settings for both external and internal servers must be properly set up. That is why it is critical you’re familiar with the FTP server and to understand various attack strategies from the perspective of an attacker.
So what are FTP servers? How can cybercriminals intercept your data if they’re not configured properly?
What Are FTP Servers?
FTP stands for File Transfer Protocol. It provides file transfer between two computers connected to the internet. In other words, you can transfer the files you want over to your website servers via FTP. You can access FTP from the command line or Graphical User Interface (GUI) client.
The majority of developers who use FTP are people who regularly maintain websites and transfer files. This protocol helps to make maintenance of the web application easy and hassle-free. Although it is quite an old protocol, it is still actively used. You can use FTP not only to upload data but also to download files. An FTP server, on the other hand, works like an application using the FTP protocol.
For an attacker to effectively assault the FTP server, the user’s rights or general security settings must be wrongly set up.
How Do Hackers Compromise RCP Communication?
RCP stands for Remote Procedure Call. This helps computers in a network make some requests between each other without knowing the network details. Communication with RCP does not contain any encryption; the information you send and receive is in plain text.
If you use RCP during the authentication phase of the FTP server, the username and password will go to the server in plain text. At this stage, the attacker, who is listening to the communication, enters the traffic and reaches your information by capturing this text packet.
Likewise, since the information transfer between the client and the server is unencrypted, the attacker can steal the packet the client is receiving and access the information without the need of a password or username. With the use of SSL (Secure Socket Layer), you can avoid this danger, because this security layer will encrypt the password, username, and all data communication.
To use this structure, you must have SSL-supported software on the client side. Also, if you want to use SSL, you will need an independent, third-party certificate provider, i.e. Certification Authority (CA). Since the CA does the authentication process between the server and the client, both parties must trust that institution.
What Are Active and Passive Connection Configurations?
The FTP system works over two ports. These are the control and data channels.
The control channel operates on port 21. If you’ve done CTF solutions using software like nmap before, you’ve probably seen port 21. Clients connect to this port of the server and initiate data communication.
In the data channel, the file transfer process takes place. So this is the main purpose of FTP’s existence. There are also two different types of connection when transferring files: active and passive.
Active Connection
The client selects how the data will be sent during an active connection. They then request that the server start the data transmission from a certain port, and the server does so.
One of the most significant flaws in this system begins with the server starting the transfer and the client’s firewall approving this connection. If the firewall opens a port to enable this and accepts connections from these ports, it is extremely risky. As a consequence, an attacker can scan the client for open ports and hack into the machine using one of the FTP ports discovered to be open.
Passive Connection
In a passive connection, the server decides which way to transfer data. The client requests a file from the server. The server sends the client information from whichever port the server can receive it. This system is more secure than an active connection because the initiating party is the client and the server connects to the relevant port. That way, the client doesn’t need to open the port and allow incoming connections.
But a passive connection can still be vulnerable as the server opens a port on itself and waits. The attacker scans the ports on the server, connects to the open port before the client requests the file, and retrieves the relevant file without the need for details such as login credentials.
In this case, the client can take no action to protect the file. Ensuring the security of the downloaded file is a completely server-side process. So how can you stop this from happening? To protect against this type of attack, the FTP server must only allow the IP or MAC address that requested the file to bind to the port it opens.
IP/MAC Masking
If the server has IP/MAC control, the attacker must detect the IP and MAC addresses of the actual client and mask themselves accordingly to steal the file. Of course, in this case, the chance of the attack’s success will decrease because it’s necessary to connect to the server before the computer requests the file. Until the attacker performs IP and MAC masking, the computer requesting the file will be connected to the server.
Timeout Period
A successful attack on a server with IP/MAC filtering is possible if the client experiences brief disconnection periods during file transfer. FTP servers generally define a certain timeout period so that the file transfer does not end in case of short-term breaks in the connection. When the client experiences such a problem, the server does not log off the client’s IP and MAC address and waits for the connection to be re-established until the timeout expires.
Performing IP and MAC masking, the attacker connects to the open session on the server during this time interval and continues to download files from where the original client left off.
How Does a Bounce Attack Work?
The most important feature of the bounce attack is that it makes it difficult for the attacker to be found. When used in conjunction with other attacks, a cybercriminal can attack without leaving any traces. The logic in this type of attack is to use an FTP server as a proxy. The main attack types for which the bounce method exists are port scanning and passing basic packet filters.
Port Scanning
If an attacker uses this method for port scanning, when you look at the details of the server logs, you will see an FTP server as the scanning computer. If the target server that’s to be attacked and the FTP server acting as a proxy are on the same subnet, the target server does not do any packet filtering on the data coming from the FTP server. The sent packets are not plugged into the firewall. Since no access rules will be applied to these packets, the attacker’s chance of success increases.
Passing Basic Packet Filters
Using this method, an attacker can access the internal server behind an anonymous FTP server protected by a firewall. The attacker connecting to the anonymous FTP server detects the connected internal server by the port scanning method and can reach it. And so, a hacker can attack the server that the firewall protects against external connections, from a specially defined point for communicating with the FTP server.
What Is a Denial of Service Attack?
DoS (Denial of Service) attacks are not a new type of vulnerability. DoS attacks are done to prevent the server from delivering files by wasting the resources of the target server. This means that visitors to a hacked FTP server cannot connect to the server or receive the files they request during this attack. In this case, it is possible to incur huge financial losses for a high-traffic web application—and make visitors very frustrated!
Understand How File Sharing Protocols Work
Attackers can easily discover the protocols you use to upload files. Each protocol has its strengths and weaknesses, so you should master various encryption methods and hide these ports. Of course, it’s much better to see things through the eyes of an attacker, in order to better find which measures you need to take to protect yourself and visitors.
Remember: attackers will be one step ahead of you in many ways. If you can find your vulnerabilities, you can gain a great advantage over them.
Reference: https://www.makeuseof.com/how-hackers-attack-ftp-servers/
Ref: makeuseof
MediaDownloader.net -> Free Online Video Downloader, Download Any Video From YouTube, VK, Vimeo, Twitter, Twitch, Tumblr, Tiktok, Telegram, TED, Streamable, Soundcloud, Snapchat, Share, Rumble, Reddit, PuhuTV, Pinterest, Periscope, Ok.ru, MxTakatak, Mixcloud, Mashable, LinkedIn, Likee, Kwai, Izlesene, Instagram, Imgur, IMDB, Ifunny, Gaana, Flickr, Febspot, Facebook, ESPN, Douyin, Dailymotion, Buzzfeed, BluTV, Blogger, Bitchute, Bilibili, Bandcamp, Akıllı, 9GAG