5 ms·

Wait, FTP as in actual goddamn FTP, or actually SFTP but we call it FTP? I could make fun, except in 2018, I moved a company off of FTP and onto S3. To be fair

Wait, FTP as in actual goddamn FTP, or actually SFTP but we call it FTP? I could make fun, except in 2018, I moved a company off of FTP and onto S3. To be fair to the company, no developer had worked there since 2016, so they were just running on autopilot. Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s.

deleted 6y ago
[deleted]
worstenbrood 6y ago
You can actually use ftp with implicit/explicit ssl, makes it as save as any other plain text protocol (smtp/imap/pop/...). They call it FTPS.
- lub 6y ago
  TLS doesn't necessarily mean everything is encrypted with FTP, because data and control channel have to be encrypted independently. See for example https://security.stackexchange.com/a/115565 https://security.stackexchange.com/a/115565 or https://en.wikipedia.org/wiki/FTPS#Secure_data_channel https://en.wikipedia.org/wiki/FTPS#Secure_data_channel for more detailed explanations. Most of the time both are encrypted when configuring TLS, but it's not as easy as with IMAP or SMTP where you basically disallow all commands except STARTTLS.
  - worstenbrood 6y ago
    If you use implicit tls/ssl, not using starttls, the data channel should be using tls/ssl too.
ThePadawan 6y ago
> Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s. Had the same discussion in 2018. But if the weak link in the chain is "our (paying) customer is so tech illiterate that they need a printed out tutorial to use an FTP client, and switching to SFTP would anger all clients", what are you going to do.
- earthboundkid 6y ago
  In my case, the marketing department was using the FTP server, but their client also supported S3, so I told them to use the S3 credentials instead. In another case around 2015, a coworker started and was learning the system. He found that a web store front was being powered by an FTP box that had a list of items in it, and the FTP box was periodically being updated by someone somewhere, but he couldn't figure out who or where. As far as I know, he never figured it out, and the mystery uploads continue to this day…
  - zyemuzu 6y ago
    That's great. I've built similar systems and if I disappeared off the face of the earth the same situation would likely arise... SFTP has its issues but it works.
- mattmcknight 6y ago
  Sometimes you have to just say no, it's not worth risking the whole business. It's better to just write a client app for the customer that's easier for them to use.
  - wpietri 6y ago
    In retrospect, I'm sure that's obvious to SolarWinds as a whole company. But at the time, these decisions get made by particular individuals. They're weighing an eventual low-probability risk to the whole company against direct, short-term impact on something their managers are breathing down their necks about. I'm sure there were hundreds of decisions by dozens SolarWinds managers like this that worked out fine. They made some personally and immediately beneficial choice and got praised for getting things done on time and on budget. The latent problem, be it a security risk, a hidden pile of technical debt, or a cut corner, stayed latent. Unless you can rejig the system to change the odds for those individual decision-makers, things like this will keep happening.
    - rorykoehler 6y ago
hackerpain 6y ago
wasn't even an SFTP I guess? good old FTP
Spivak 6y ago
FTPS or FTPoTLS is admittedly a somewhat awkward protocol but it’s no worse than other older protocols like IMAPS. The difference between SFTP and FTPS is just a debate over whether to use SSH as transport or TLS. Basically every SFTP server out there is also an SSH server which comes with its own issues while FTPS servers are more designed to operate on entirely virtual users coming from a DB instead of system accounts. The reasons for moving away from FTP is because it’s unergonomic and the software support isn’t there anymore, not just because it’s old. And if you use IIS on Windows you’re pretty much stuck with FTPS.
- dfox 6y ago
  SFTP is completely different protocol. Notably, SFTP is not even a "file transfer" protocol (ie. GET/PUT), but full blown remote filesystem (which even has two distinct rename operations, one with unix and one with windows semantics).
  - Spivak 6y ago
    Look, yes SFTP is an extension of SSH and is a completely independent wire protocol with some different features and semantics. But from the user’s perspective it looks just like a different flavor of FTP and all the security comes from the underlying transport. It’s remarkably easy to accidentally let your users accidentally have more access than they should with SFTP because SSH is a complex protocol. A good example is that “SFTP only” users can still port forward by default unless you remember to turn it off. And SSH doesn’t have public CAs so in practice it’s a lot of blindly accepting keys. And with FTPS you have to remember to turn off anonymous access and that that dynamic port range makes firewalls annoying. There are trade-offs and no tool is going to be better in all situations. The idea that FTPS is bad and you should feel bad is more like the JSON vs XML debate than it is legitimate security gripes.
tyingq 6y ago
Just plain old FTP. See: https://twitter.com/vinodsparrow/status/1338431183588188160/photo/1 https://twitter.com/vinodsparrow/status/1338431183588188160/...
ocdtrekkie 6y ago
FTP is fine if you have any sort of signing verifying your code. Your initial install probably shouldn't be over FTP, so that you know what you're verifying, but it's fine for updates. The issue here was that their update pipeline was compromised and they were distributing compromised updates. Stop kneeling at the altar of PKI.

deleted 6y ago

[deleted]

worstenbrood 6y ago

You can actually use ftp with implicit/explicit ssl, makes it as save as any other plain text protocol (smtp/imap/pop/...). They call it FTPS.

lub 6y ago
TLS doesn't necessarily mean everything is encrypted with FTP, because data and control channel have to be encrypted independently. See for example https://security.stackexchange.com/a/115565 https://security.stackexchange.com/a/115565 or https://en.wikipedia.org/wiki/FTPS#Secure_data_channel https://en.wikipedia.org/wiki/FTPS#Secure_data_channel for more detailed explanations. Most of the time both are encrypted when configuring TLS, but it's not as easy as with IMAP or SMTP where you basically disallow all commands except STARTTLS.
- worstenbrood 6y ago
  If you use implicit tls/ssl, not using starttls, the data channel should be using tls/ssl too.

ThePadawan 6y ago

> Still, anyone even vaguely concerned with security should have stopped using FTP since sometime in the early 00s. Had the same discussion in 2018. But if the weak link in the chain is "our (paying) customer is so tech illiterate that they need a printed out tutorial to use an FTP client, and switching to SFTP would anger all clients", what are you going to do.

earthboundkid 6y ago
In my case, the marketing department was using the FTP server, but their client also supported S3, so I told them to use the S3 credentials instead. In another case around 2015, a coworker started and was learning the system. He found that a web store front was being powered by an FTP box that had a list of items in it, and the FTP box was periodically being updated by someone somewhere, but he couldn't figure out who or where. As far as I know, he never figured it out, and the mystery uploads continue to this day…
- zyemuzu 6y ago
  That's great. I've built similar systems and if I disappeared off the face of the earth the same situation would likely arise... SFTP has its issues but it works.
mattmcknight 6y ago
Sometimes you have to just say no, it's not worth risking the whole business. It's better to just write a client app for the customer that's easier for them to use.
- wpietri 6y ago
  In retrospect, I'm sure that's obvious to SolarWinds as a whole company. But at the time, these decisions get made by particular individuals. They're weighing an eventual low-probability risk to the whole company against direct, short-term impact on something their managers are breathing down their necks about. I'm sure there were hundreds of decisions by dozens SolarWinds managers like this that worked out fine. They made some personally and immediately beneficial choice and got praised for getting things done on time and on budget. The latent problem, be it a security risk, a hidden pile of technical debt, or a cut corner, stayed latent. Unless you can rejig the system to change the odds for those individual decision-makers, things like this will keep happening.
  - rorykoehler 6y ago

hackerpain 6y ago

wasn't even an SFTP I guess? good old FTP

Spivak 6y ago

FTPS or FTPoTLS is admittedly a somewhat awkward protocol but it’s no worse than other older protocols like IMAPS. The difference between SFTP and FTPS is just a debate over whether to use SSH as transport or TLS. Basically every SFTP server out there is also an SSH server which comes with its own issues while FTPS servers are more designed to operate on entirely virtual users coming from a DB instead of system accounts. The reasons for moving away from FTP is because it’s unergonomic and the software support isn’t there anymore, not just because it’s old. And if you use IIS on Windows you’re pretty much stuck with FTPS.

dfox 6y ago
SFTP is completely different protocol. Notably, SFTP is not even a "file transfer" protocol (ie. GET/PUT), but full blown remote filesystem (which even has two distinct rename operations, one with unix and one with windows semantics).
- Spivak 6y ago
  Look, yes SFTP is an extension of SSH and is a completely independent wire protocol with some different features and semantics. But from the user’s perspective it looks just like a different flavor of FTP and all the security comes from the underlying transport. It’s remarkably easy to accidentally let your users accidentally have more access than they should with SFTP because SSH is a complex protocol. A good example is that “SFTP only” users can still port forward by default unless you remember to turn it off. And SSH doesn’t have public CAs so in practice it’s a lot of blindly accepting keys. And with FTPS you have to remember to turn off anonymous access and that that dynamic port range makes firewalls annoying. There are trade-offs and no tool is going to be better in all situations. The idea that FTPS is bad and you should feel bad is more like the JSON vs XML debate than it is legitimate security gripes.

tyingq 6y ago

Just plain old FTP. See: https://twitter.com/vinodsparrow/status/1338431183588188160/photo/1 https://twitter.com/vinodsparrow/status/1338431183588188160/...

ocdtrekkie 6y ago

FTP is fine if you have any sort of signing verifying your code. Your initial install probably shouldn't be over FTP, so that you know what you're verifying, but it's fine for updates. The issue here was that their update pipeline was compromised and they were distributing compromised updates. Stop kneeling at the altar of PKI.