4 ms·
ProFTPD.org main FTP servers compromised using a 0day in..ProFTPD
- rwmj 16y agoHappens to the best of them. What really matters is how deep the attackers got beyond the FTP server, how quickly they can recover, and how quickly they can get patches out to all users / versions affected.
- mfukar 16y agoIndeed, and their response was lightning-fast, compared to today's standards.
- DanHulton 16y agoTitle is a little silly. What FTP server did you EXPECT them to be running?
- mfukar 16y agoI've heard vsftpd [1] is quite good. I certainly wouldn't expect them to be running anything other than ProFTPD, of course, but being aware of alternatives somewhat helps, no? [1] http://vsftpd.beasts.org/ http://vsftpd.beasts.org/
- nailer 16y agoIndeed. When all the Linux distros kicked out WUFTPd from being the default FTP server in the early 2000s due to security concerns, nearly every one evaluated ProFTPd and VSFTPd against each other, and VSFTPd came out on top.
- kahawe 16y agoI never really liked ProFTPd, it always seemed too huge and bloated. My favorite has always been Pure-FTPd - it really has some neat features and is very easy to setup and so far very reliable for me.
- nodata 16y agoI think the point is that normally you hear "Company X was hacked via vulnerability in Y". Here Company X actually makes Y.
- forgotAgain 16y agoattackers most likely used an unpatched security issue in the FTP daemon If they don't know exactly how the server was compromised I don't understand how they can know the vulnerability is limited to software downloaded within a certain timeframe. The added backdoor yes, but the vulnerability that allowed the attack to succeed is still unaccounted for. Or am I missing something?
- moe 16y agohow they can know the vulnerability is limited to software downloaded within a certain timeframe. It isn't. The bug has been in ProFTPd for years, here's the details: http://bugs.proftpd.org/show_bug.cgi?id=3521 http://bugs.proftpd.org/show_bug.cgi?id=3521 If anyone is running a ProFTPd version older than 1.3.3c then you should act now. Your host is open to remote code execution.
- j2d2j2d2 16y agoPeople still use ftp?
- roel_v 16y agoTo the downvoter, it's a valid question. FTP needs to go away, it's just a crap protocol that is totally out of place on today's internet.
- j2d2j2d2 16y agoThank you. I could've phrased it better, but it was serious. Everyone knows it's unencrypted and HTTP is faster for simple file serving. Right?
- kree10 16y agoI wish everyone knew. I also thought FTP was a 20th century relic, until I started doing freelance web development full-time. It turns out FTP is still the preferred (and often only) way to manage web sites with the cheap shared hosting plans that small businesses gravitate to. I started a group on Facebook called "7 Billion Strong Against FTP" to cope. 6,999,999,993 more to go. http://www.facebook.com/group.php?gid=130658460303379 http://www.facebook.com/group.php?gid=130658460303379
- roel_v 16y agoI wish... Part of the problem is that FTP is still built into today's browsers, so many people don't even know that they're using FTP, it's just a link they click. Luckily IE removed support for password in FTP links a few releases ago, but still. HTTP is ok for small files, but I'm often on unreliable links with big files to up/download, and browsers implement 'resume', ehm, let's just say 'not so well' (it's a server thing too, to be honest). Anyway I've used scp for years myself, and I've tried getting others to use it, too; I mean winscp isn't harder than any ftp client. Some would grudgingly accept if I made them, others would just say 'I can't up/download the files'. So I've given up on that part of trying to improve the internet :(
- wiredfool 16y ago