4 ms·
> I'm not so sure that FTP can be so easily ruled out. (This is assuming FTP means FTP and not FTPS or SFTP). It could be that they've simply checked the FTP s
by ahje 7y ago
> I'm not so sure that FTP can be so easily ruled out. (This is assuming FTP means FTP and not FTPS or SFTP).
It could be that they've simply checked the FTP server's log files and determined they didn't come in that way?
But yes, I really hope they mean (S)FTP(S) and not FTP.
- zaarn 7y agoIf you're not careful on FTP and you expose the FTP servers logs writeable then an attacker can wipe them. If they use FTP to generate a reverse shell it gets even easier.
- shakna 7y agoSo I did try digging into this again a bit more. According to the community, TLS was not in use, and nor was SFTP. (There's some suggestions that it was the IIS FTP server, but I can't confirm it.) As to logging, most FTP servers log the forwarded IP and not the connecting IP when you enable forwarding. So yes, FTP may well be the point of entry. (Worth noting that a couple minutes looking at the palemoon site still comes up with quite a few security red flags. Like unenforced SSL on download pages, archive.palemoon.org still has no SSL, etc.)