R.I.P. FTP 359
On July 1st I found that one of my less important websites, hosted on a low-cost shared Web hosting service, had been broken into. A friend emailed me to say that the site was showing up in Google's search results with the Google "This site may harm your computer" warning listed next to it. I found that on one of the pages, about 1,500 HTML script tags had been inserted, loading JavaScript files from pseudo-random Russian hostnames like "www.chk06.ru" and "www.errghr.ru", none of which are currently resolving. Usually, when such script tags are maliciously inserted into a page on a website, the script tags attempt to install spyware on the machines of people who visit the site.
I immediately replaced the infected file on the website with the backed-up clean copy from my machine, and changed the password on the website in case the attacker had gotten in by using the old one. (The original file with the script tags inserted is here if you want to examine it, but use with caution -- if the .ru hostnames in the script tags start resolving again, then opening the file could cause the JavaScript on the pages to be loaded, which might infect your machine.) Then I started investigating (a) how this probably happened; (b) whether future similar attacks could be prevented, by changing some defaults in the way that hosting accounts are set up; and (c) whether the incentives for hosting providers are such that these changes are likely to happen by themselves, or whether it will require some third-party advocacy to change what we think of as "best practices".
Denis Sinegubko, the webmaster of Unmask Parasites, a free service that scans websites on demand for signs of break-ins, says:
The majority of web site compromises happen because of:
- Stolen FTP credentials. Spyware on webmasters' computers: key-loggers, traffic sniffers (FTP protocol sends username/password as plain text), trojans that steal credentials from various programs' configuration files (FTP clients, DreamWeaver, etc).
- Security holes in popular web software: CMS (Joomla, Drupal, etc), Forums (phpBB, vBulletin, Simple Machines, etc), Blogs (WordPress). Once a vulnerability discovered, hackers configure their automated tools to search the web for websites running vulnerable versions of the software and exploit them. This can be done easily and at almost no cost when they have an army of zombie computers.
- Security hole in "in-house" web software. Many novice (and even many experienced) web developers don't properly sanitize user input making various attacks possible (SQL injections, XSS, etc)
- Poor security practices (Something that should be manually configured by site/server admins and cannot be fixed with automated security updates): Weak passwords, open ports, insufficiently strict permissions for limited accounts, files and directories with world write permissions, etc.
I didn't have any third-party web software or custom-made software installed on the PublicEditorMyAss.com site, the password was a seven-letter meaningless mix of letters and numbers, and I didn't have permission to change most of the things like open ports and file permissions. That left the possibility of stolen FTP credentials. This is in fact what Sinegubko says is the most common cause of such break-ins:
I guess 90% of attacks use stolen FTP credentials this year. Check this Google's graph that shows the top 10 malware sites as counted by the number of compromised web sites that referenced it:
http://googleonlinesecurity.blogspot.com/2009/06/top-10-malware-sites.html
I reviewed 4 most widespread of them (Gumblar, Martuz, Goooogleadsense, Googleanalytlcs). All four used stolen FTP credential to penetrate web sites and upload malicious content. The chances are the rest used this vector too.
When the PublicEditorMyAss.com site was set up, the default setting was for pages to be edited over FTP. Even though FTP sends and receives passwords without encrypting them (in contrast with alternatives like SFTP or "secure FTP", which encrypts passwords), for a long time I had assumed that this was not a major security problem, because in order for an attacker to intercept the passwords in transit, they would have to control a machine somewhere on the path between my home computer and the PublicEditorMyAss.com server. I figured this wasn't worth worrying about, because it was much more likely that an attacker would attempt to steal the password by installing spyware on my home computer. And if an attacker managed to do that, then I assumed that the risk of passwords being stolen by spyware was about the same whether I used FTP or SFTP -- because either way, the spyware could just steal my password by reading it out of a configuration file where the password was stored. (Even though FTP and SFTP programs both store passwords in an encrypted format, the programs have to be able to decrypt the passwords in order to use them whenever the user wants to open a connection. So the spyware could just mimic whatever steps the client programs use to decrypt the stored passwords, in order to steal one of my passwords stored in a file.) So, I assumed it made no difference whether I used FTP or SFTP.
But according to what Sinegubko told me, this reasoning was probably wrong. The problem is that even though spyware installed on your machine could read passwords that are stored in configuration files, it would be a lot of work to write a spyware program that could do this, because every FTP program and SFTP program stores passwords according to a different algorithm. It's much simpler for spyware to simply watch the traffic sent and received from your machine, so that any unencrypted passwords will be spotted:
[Passwords can be stolen by] sniffers that read all TCP traffic on local computers. Like personal firewalls but malicious. They can easily intercept FTP credentials since they are sent as a plain text.
Sinegubko describes how one of his contacts obtained evidence that a common spyware program was doing exactly this:
One of them even infected a spare WinXP computer (with Gumblar) to test the consequences. On the infected computer he created a new account in a popular FTP client and saved it. The server address was correct (his server) and the username/password pair was not valid. A few hours later in FTP logs, he discovered login attempts that used that invalid username/password pair from a Singapore IP, then from a Florida IP, the some other country's IP. Apparently the FTP credentials were somehow stolen from that infected computer.
I know of only two instances where I've ever definitely been infected with spyware. I don't do stupid things like downloading and running strange programs from third-party sites, so I think both infections were probably caused by a site exploiting a security hole in Internet Explorer, or in a plug-in like Adobe Acrobat or the Flash player. Both times, once I noticed I was infected, I got rid of the infection with Malwarebytes, but I don't know how much damage the spyware did in the meantime.
So this was a case where a little knowledge can be a dangerous thing. If I had known nothing about Internet architecture, and someone told me "FTP is less secure than SFTP," I would have found a way to switch to administering the site via SFTP. But because I knew that the main reason FTP was considered "insecure" was because it transmitted passwords unencrypted, but I also knew that most of of the machines relaying those passwords in transit were secure and trustworthy, I thought it didn't matter. Now it seems that is probably how my password got compromised after all.
In that case, why don't more people switch to administering their sites via SFTP instead of FTP? Here are the steps it took me to enable SFTP on my GoDaddy hosting account. Feel free to use this as a reference, but the obvious point is that as long as this many steps are required, it's safe to say that most users won't be switching:
- Go to the "Hosting" menu and pick "My Hosting Account."
- Next to the name of your website, pick "Manage Account." This will open the Hosting Control Center.
- In Hosting Control Center, click to expand the "Settings" options.
- In the "Settings" control panel, click the "SSH" icon.
- You will see a page saying "SSH is not set up", and prompting you to enter a phone number so that their automated service can call you with a PIN number. After you enter your phone number, the phone rings a second later, and you enter the PIN in a form on the GoDaddy website.
-
You will then see a page which says:
Current Hosting Account Status: Pending Account Change
Your request to enable SSH is being processed. This upgrade may take up to 24 hours.
In fact, even if only one step were required to switch, most users probably wouldn't change from the default setting to use FTP, due to the eternal, unchangeable fact that most people do not change their default settings, ever. (What percent of users ever change the default set of toolbars that are displayed at the top of their Web browser window?)
If more Web hosting companies made SFTP the default, then the number of websites that were compromised by stolen login credentials, would probably go down. Spyware authors might start to make their programs smarter at that point, enabling them to read the passwords stored by popular FTP and SFTP programs, so that it would make no difference whether the passwords were transmitted in the clear or not. However, this would be harder for spyware authors to do correctly, so it would at least raise the bar for a successful malware attack, and the number of compromised websites would be reduced.
Unfortunately, Web hosting companies don't have much incentive to make users switch to the more secure SFTP protocol. This isn't necessarily true of all security risks; sometimes the hosting company has a strong incentive to pass on the right wisdom (and select the right default settings) for their customers. From the hosting company's point of view, you could divide risks into three categories:
-
Risks where the hosting company pays a large part of the price for a customer's machine being compromised. For example, if a cyber-criminal takes over a customer's machine and uses it to launch a denial-of-service attack by sending it a flood of traffic, the hosting company will see that traffic spike on their network. The hosting company has the most incentive to help prevent these types of attacks.
-
Risks where the hosting company doesn't directly pay a price for the customer's machine being compromised, but they may have to deal with complaints sent in by third parties. For example, a customer's website could get broken into, and script tags could be inserted into the pages that cause visitors' machines to be infected with spyware. Those visitors might complain to the webmaster of the infected site, or they might complain to the hosting company, which then forwards the complaint to the webmaster. The hosting company may have to provide a few minutes of tech support to the customer, advising them to change their password and scan their own machine for spyware, but they probably won't incur any other material costs.
-
Risks where neither the hosting company nor the customer pays a price for the machine being infected, but the price is paid by "Internet users as a whole." The only attack that I can think of in this category, is an attack where a cyber-criminal inserts key words into your web page and links them to his site, in order to increase his Google ranking for searches for those key words. Neither the website owner, nor any visitors to the website, are victimized directly; the harm being done is that the quality of Google search results is reduced for everybody. The only reports of the attack would probably come from "good Samaritan" Web surfers, who tell the hosting company or the webmaster that one of their pages has been vandalized.
When a customer's FTP credentials are stolen, the price paid by the hosting company lies somewhere in the middle. An attacker who stole my current PublicEditorMyAss.com credentials would only be able to deface the content on the site, but they wouldn't be able to launch an attack against a third-party network (my PublicEditorMyAss.com hosting account doesn't have the ability to initiate an outgoing connection to a third-party site).
Weighing in the other direction are the costs of switching to SFTP. If existing customers are forcibly switched over, phone lines will be clogged by customers wanting to know why their old method of logging in to their site has suddenly stopped working. A better choice would be to allow existing customers to stay with FTP while making SFTP the default for new customers. But there is a time and money cost of changing anything, even a default setting.
So GoDaddy doesn't have much incentive to make SFTP their new default. Indeed, I've used many different shared hosting companies before I started running proxies exclusively on dedicated servers, and none of the shared hosting companies ever used anything but FTP as the default method for customers to administer their websites. So who can blame them? They're not making the choice that makes the most sense for their customers or for Internet security as a whole, they're making the choice that makes the most sense in terms of costs and benefits for themselves, and I'm not being judgmental about that. We shouldn't expect most companies to ever behave in any other way.
That's why I think that glib "solutions" to security problems, like "Everybody install anti-virus software", or "Everybody stop using Windows", aren't helpful, because regardless of whether these ideas would work if everybody actually followed them, the fact is that most people won't. The problems have to be addressed in terms of changing incentives for the choices people make.
What's an idea for reducing the risks of FTP credentials stolen by malware, that addresses the incentives problem? Maybe give tax breaks to Web hosting companies that set up customer accounts to use SFTP instead of FTP by default? Or ask more computer vendors to include a desktop link to pre-installed SFTP software, so that when Web hosting companies present options to their customers, it's easier for users to choose the SFTP option since they have a client already installed? (I was tempted to recommend that Microsoft include a universal SFTP client pre-installed in Windows with a prominent desktop link, but the problem with that is that if almost everybody used the same SFTP client, malware authors would have greater incentive to reverse-engineer the algorithm that the client used to store saved passwords -- and then passwords would be just as easily accessible to spyware, as if the user were using FTP all along. So a good mix of SFTP clients is safer for this purpose.)
Since the difference between SFTP and FTP usually only matters in cases where a customer's machine has been infected with malware, obviously the best solution is to avoid malware altogether, but that's much harder problem to solve, as long as malware authors can keep finding security holes in Internet Explorer and other popular programs. Making SFTP the new standard for Web hosting accounts is something that we know how to do, right now. The incentives aren't currently right for Web hosting companies to make it happen. But there may be ways to change that, and I'll bet some people can think of better ideas than the ones I've suggested. I'm just saying that the incentives problem is where attention should be focused.
All you need to know: (Score:5, Insightful)
Malwarebytes is good software, but as you point out you don't know how much damage was done. Secondary infections can easily be missed, and many malware programs open your machine to further exploitation. As tired as the suggestion is, you needed to do what you did with your website: revert the machine to a known good backup of the system state, formatting first. Anything less and you *should* have that nagging doubt that you haven't actually cleaned everything up. There are ways to diminish the concern: inspecting the machine for unexpected packet flows, using anti-rootkit tool, etc... but only by formatting and restoring a know clean state or formatting and just restoring your data files will you be confident).
It doesn't matter (Score:5, Insightful)
Look, if your machine is infected by malware, it's not going to make any difference if you use FTP or SFTP or god know what else.
Either your passwords are stored on your harddisk or you're going to have to type them in at a later point. In both cases software is going to be able to get your passwords. And they have that they can get in without a problem, regardless of protocol used.
So instead of this looooong article, some more vigilance online to avoid the infection to begin with would be more helpful.
And if you _have_ to use MSIE, use SandboxIE.
Re:Amusingly.. (Score:5, Insightful)
So, how does one upload to a website? CPanel? Secure Shell? Do Tell! You know, not everyone manages their own server ....
Keyloggers don't care (Score:5, Insightful)
SSH, SFTP, SCP, FTP, ZMODEM, KERMIT, AND ALL THAT CRAP MEANS NOTHING!
Why? because moron employees surfing for p0rn at work will get a keylogger by accident installed and grab more information then packet sniffers EVER will. Regardless of how well the encryption is the keylogger and malware will trump all measure if employees are careless.
You can get a silent VNC session going and lockout the physical keyboard and mouse and by the time they figure out what has happened you have enough control to grab what you need.
Hell just track the next time they go to amazon.com or any onther online site. Who gives a rats ass about SSL when you are seeing them type in their info?!
FTP vulnerable? No more then your home phone line or cell phone. The problem is and always will be PEOPLE. One they have control of the physical machine all bets are off for ANY security measure.
Arguing protocols being secure or not is like arguing which unloaded gun is more dangerous....
Re:Keyloggers don't care (Score:3, Insightful)
Two words: "ssh keys".
Any passphrase associated with an ssh key is meaningless to keyloggers unless they also get the keys themselves. Far as I know, most modern keyloggers aren't that sophisticated yet. Granted, they could very well become so, but so long as Windows users are kept in the dark about SSH/SFTP and keep using Telnet/FTP, they probably won't...
Waaaaaaait... THAT'S why FTP is still around! A decoy against users with keylogger'd machines! Keeps the rest of us safe! NOW I get it!
Re:So much for regard (Score:3, Insightful)
I can't see why they should be considered well-regarded then. That's negligence. Pretty much every Windows FTP client for the last 5 years commercial or otherwise does SFTP now.
Well, third-party clients, Yes. But, why is that in 2009, Microsoft doesn't ship a client (or a server) that does SFTP with their OS?
The security lie (Score:5, Insightful)
Once you have discovered you are infected, the ONLY way to be safe is to assume that you have also been infected in at least 100 other, undiscovered, ways.
Security companies like to sell the lie of "buy our product! Be safe! And if something slips through, just hit "delete" and be safe again!" but it really doesn't work like that: If there's one, there's three, and those three turn into a hundred very easily.
The only way to be safe is not "buy some guy's security software" (you're machine's been compromised, how the hell is running something else on the same machine supposed to help??), it's "reformat, treat every backed-up file as compromised". Sad, annoying, true.
In summary: when you found out you were infected, you did the equivalent of nothing at all, then were surprised when a password was stolen several months later.
Re:It doesn't matter (Score:3, Insightful)
You know, the article addressed that, but let's have it one more time:
Sure, a determined attacker with malware on your machine can get your password for anything. But these aren't determined attackers. They are people throwing their nets very, very wide, and they rely on automation to find their passwords. Getting every keystroke isn't going to tell them what your password is without manual analysis, and nobody has the time for that. And making your keylogger smart enough to figure it out by itself requires adapting it for every possible file transfer client out there.
So it is much easier to just listen for FTP connections. That's the low-hanging fruit. The software COULD do other things, but it generally DOESN'T. At least not yet.
Re:Amusingly.. (Score:2, Insightful)
If you are maintaining a local copy and then 'uploading' it to the server, you freaking use rsync. If your host doesn't support rsync, you quit them.
Missing the point... (Score:4, Insightful)
Amazing how this article (and so many people responding) seem to be missing the point entirely. The real problem is people using operating systems that are vulnerable to these types of attacks! I don't know about Vista, but even if Linux was ever targeted for this kind of attack/spyware, you would have to run the software as root to enable packet sniffing! And anyone who uses IE for regular browsing and not just local site development is clearly not a competent web developer and has no business working in this industry! Seriously--how can anyone still use IE, FTP, or anything like that in this day and age? I think I stopped using FTP, what...10 years ago now?
The bottom line is that all hosting companies must disable all access to their services via insecure FTP. It's shameful how many companies still use it. I'm in such an isolated bubble, apparently, that I didn't even know this was still going on until recently I had to access a shared web service to migrate a particular client. I was shocked, to say the least! Secure-FTP (over SSL) is not sufficient as it only encrypts things without verifying the authenticity of the host you are connecting to. It's bad enough that people keep using Windows, but since we can't control this, competent sysadmins really need to take the initiative in disabling FTP. Likewise, unencrypted pop3, imap, telnet, or whatever unencrypted services they provide.
Re:All you need to know: (Score:5, Insightful)
This assumes your "known good" backup is really clean. If you can't tell whether your current system is clean after removing the malware, how can you know whether your last backup was clean?
Re:well then the answer is simple (Score:3, Insightful)
its very easy to blame the lusers
That's because they are the largest contributor to an insecure system.
your post means nothing
My post means that you are better off spending more time training people then finding new technological ways to make things stupid-proof.
Wrong side of the problem (Score:4, Insightful)
Where you should start changing things? replacing the ftp protocol? the ssh protocol? tcp protocol? Start changing yourself, securing your desktop in effective ways (drastically lowering odds switching away from windows could be an start), and how you use it.
Re:FTPS (Score:3, Insightful)
Horse shit. chroot is a tool. Used properly, where applicable, it can greatly enhance security. Used improperly, it does little or no good. It doesn't matter what it was invented for; it doesn't matter how many times people make blanket statements about it; the fact is that it can be used as a useful security tool.
Some of the other commenters point you to sources detailing chroot's weaknesses and pitfalls, and how to avoid them.
There is no perfect, cure-all security measure. That doesn't mean you don't use available tools to enhance security as much as possible. The world is not black and white. It is shades of grey.
I'm not quite sure where you're aiming with the statement "FTP without a chroot is not really any different than ssh without a chroot.", but it strikes me as utter nonsense.
Pardon my French, but your sweeping statements are just out of control, beginning with where you call your parent's post silly.
securing ftp (Score:2, Insightful)
There are many ways of securing plain ftp
1. FTPS
2. OpenVPN
3. IPSEC (I use transport mode)
4. GSSAPI authentication
Those are just a few.
SFTP is nice but does not have as many features as fanilla FTP
Re:Users can't tell the difference (Score:2, Insightful)
This is akin to saying if you don't know what a carburetor does, you don't know enough to be driving a car. Now, some people believe this, too, but this statement, and yours, are wrong.
Hey, look, I made a Slashdot car analogy!
RTFA! (Score:3, Insightful)
From TFA:
I figured this wasn't worth worrying about, because it was much more likely that an attacker would attempt to steal the password by installing spyware on my home computer.... So, I assumed it made no difference whether I used FTP or SFTP.
But according to what Sinegubko told me, this reasoning was probably wrong. The problem is that even though spyware installed on your machine could read passwords that are stored in configuration files, it would be a lot of work to write a spyware program that could do this, because every FTP program and SFTP program stores passwords according to a different algorithm. It's much simpler for spyware to simply watch the traffic sent and received from your machine, so that any unencrypted passwords will be spotted
Same goes for keyloggers, by the way. You can look at everything I type and hope you get a password, or you can just intercept FTP, where you know exactly where the password is being sent.
Not that we shouldn't protect against keyloggers, but why would you make it easy?
FTP vulnerable? No more then your home phone line or cell phone.
Not true -- while eavesdropping is probably easier with a phone conversation, man-in-the-middle attacks are much harder. If you said something, I know it was you who said it, because it sounds like you -- whereas with FTP, the server doesn't know if I uploaded the file, or someone in the middle uploaded the file, or someone who stole my password uploaded the file.
You can get a silent VNC session going.... Hell just track the next time they go to amazon.com or any onther online site. Who gives a rats ass about SSL when you are seeing them type in their info?!
Because you have to 0wn me first.
If you don't bother with SSL, then there's no way the user could be careful enough or savvy enough -- the next time they order something from a wireless hotspot, someone else's laptop will automatically pick out their credit card number.
If you do, they suddenly have to not only compromise your machine, but actively watch for you to hit amazon.com, or write a much more complex program that hooks into IE (but what if you're not using IE?) and watch for amazon.com, or search through pages and pages of keylogs.
The problem is and always will be PEOPLE. One they have control of the physical machine all bets are off for ANY security measure.
Both very true. But until the person or the physical machine is compromised, all of these other things mean a good deal more than "nothing".
It sounds very much like you're suggesting that we ignore security and encryption, because it's all futile anyway -- you certainly haven't offered a better approach. Well, you know what? Fuck you and your defeatist attitude. The rest of us will be working to actually make things better.
Security through being different? (Score:3, Insightful)
What I get from this overly long article is the author thinks that simply by not being the same as the herd (the herd being people who use FTP) that increases security.
While there's some truth to this, it's a lot less than you think. Being different in one way doesn't save you from all the other ways you're the same. If someone can install malware on your machine, a keylogger would grab ANYTHING you type in. It's not too hard to parse out all of that for username/passwords. It's like saying having a strange non-standard layout to your house keeps you safe from really dumb burglars that've already broken in.
FTP, rsync+ssh (Score:3, Insightful)
FTP is still fine for providing big files that don't need to be protected by a password. But yes, if you're CHANGING data, raw ftp is usually a bad idea.
If you're uploading files, I heartily recommend using rsync+ssh. It's incredibly fast, since only the files that CHANGED are uploaded, and ssh makes it all secure. It can be a pain to set up on some cheap hosting sites, but I've figured out how to make rsync+ssh work even on some cheap hosting sites [dwheeler.com]. Hope that helps.
Re:Amusingly.. (Score:3, Insightful)
I used to work at a place where we used SCP to throw files around on the local 10/100 network. Those transfers always maxed out the network speed (11MBps or so). FTP didn't go any faster... I'm guessing your problem was elsewhere :P
Re:Keyloggers don't care (Score:3, Insightful)
I recently read about a keylogger that plugs into your powergrid and can read keypresses up to 15 feet away via groundwire. There are even physical keyloggers that sit between the keyboard and box.. how easy would it be for the wife or friend to do this while you take a bio break? Software keyloggers can be very benign and go undetected for long periods of time too. Lots of programs use "global hotkeys" and similar features which function in the background to monitor all keyboard input and trigger zero anti-malwar/virus warnings.
Comment removed (Score:3, Insightful)
Re:So much for regard (Score:3, Insightful)
Probably the same reason why they don't go ahead and replace their CLI environment with some standard-ish Unix shell (e.g. bash) even though it would be a much better solution than their current command line. It's Not-Invented-Here and would increase interoperability, thereby decreasing vendor lock-in. Even if they do implement it, they'll make some weird incompatible implementation with patented "improvements".
Haven't you been paying attention?
Re:Amusingly.. (Score:3, Insightful)
You'll be fine if you take care of your own computer (which you do indeed manage). This article states that FTP is insecure, but that is based on the assumption that everyone's computer is infected periodically. So if your server is secure and your computer runs a secure OS, or at least a good firewall, a good antivirus, all security patches and is periodically scanned for malware, I don't see what harm the evil spammers can possibly cause.
Personally I barely follow a half of that advice, and yet I am never infected. If you know what you're doing, all it takes is some common sense to keep you safe. Such as not downloading and running suspicious programs, keeping your web browser(s) fully patched and making sure they are not vulnerable (VERY important) and a strong firewall (even if you get infected, it can stop your pet trojan from sending your passwords away).
Re:Whaaaaaa! (Score:3, Insightful)
And many of the cheap hosting plans if not 50% of the web hosting industry these days is run by people without a clue. They are run by business people looking for a quick buck. So they just buy a turnkey solution with cpanel or whatever else. None of them read Slashdot or any security websites and most of them could care less if they are insecure. All they care about is that they look good and that they have a pretty girl on the front of their site.
Even big ones like Dreamhost have no clue and are insecure as hell. I haven't updated it in a while and I've heard that Dreamhost fixed or obfuscated their flaws, but I wrote a list of vulnerabilities that Dreamhost has at http://suso.suso.org/xulu/Web_hosting_providers_with_poor_security [suso.org]
Re:FTPS, SFTP, FTP over SSH, ... (Score:2, Insightful)
http://www.ietf.org/rfc/rfc4217.txt [ietf.org]
Need more: read here. http://en.wikipedia.org/wiki/FTPS#Methods_of_Invoking [wikipedia.org]
http://www.rebex.net/secure-ftp.net/ [rebex.net]
It is so confusing I get confused and I have implemented these protocols. The mistake I made in my earlier post was referring to implicit FTPS as the the other mode of explicit FTPS where the user is allowed to turn the tunnel on and off. That is actually referred to as a name which escapes me.
http://www.rebex.net/secure-ftp.net/ [rebex.net]
Second, for every passive connection you most certainly have to handshake that connection. Certs are passed on the connection and the tunnel is set up each time a file is transferred. It might appear to you as a user of an FTPS client that isn't happening but I assure you it is.
So get off you high horse my little MVP friend and do some implementations and less blogging.
Re:Amusingly.. (Score:3, Insightful)
I have a 'friend'... yeah, that's it... Who back in 1997 or so had a co-located server running RedHat linux with a vulnerable dns server. It was attacked. Multiple times. I only noticed - I mean my 'friend' only noticed when a further attack caused /etc/passwd to be broken. When the box was taken down and analyzed, it was noted that the system put the ethernet port in promiscuous mode and was sniffing all of the traffic for the co-located boxes that were connected to the same switch. A file on the disk contained all the user names and protocols and passwords of the people with accounts on those co-located systems.
So when you log in with unencrypted FTP, how do you know that the server that you are connecting to is not sitting in a rack next to a compromised system sniffing the traffic? How often do people misconfigure their servers and switches like this, and how would you know?
--jeffk++