Blog

Top 4 FTP Exploits Used by Hackers

Businesses depend on reliable and secure access to information in order to meet today’s fast-paced market demands. Relatedly, sharing data, both internally and externally, is crucial to any organization. One of the oldest and still-often used methods of sharing data is file transfer protocol (FTP). While familiar to IT teams and business users alike, FTP lacks many of the crucial security, compliance, or workflow needs of today’s modern organization. How does FTP put security of data at risk?

Here is a look at 4 different FTP exploits used by hackers:

1. Anonymous Authentication

Anonymous Authentication Anonymous authentication is an FTP vulnerability that allows users to log in with a user name of FTP or anonymously. In many cases, users will provide their email address as the password. (Microsoft Docs) However, a user’s login credentials (username and password) and the commands used unencrypted, visible, and vulnerable to access. At the same time, any data sent through FTP or is hosted on an anonymous FTP server is also left unprotected. In 2017, the FBI discovered hackers actively targeting medical and dental facilities using FTP to gain access to protected health information (PHI)

 

2. Directory Traversal Attack

Directory Traversal Attack Another FTP vulnerability includes directory traversal attacks in which the successful attack overwrites or creates unauthorized files that are stored outside of the web root folder. In turn, the original FTP owner is then subject to the file or directory permissions and controls of the hacker. (Acunetix)

 

 

 

3. Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser-side script to an end user. Flaws that allow attacks to succeed are quite widespread and can occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.

An attacker can use XXS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. (Open Web Application Security Project)

 

4. Dridex-based Malware Attack

Dridex-based Malware Attack First identified in 2014, after banks were targeted in the U.K., Dridex malware has been reinvented and reintroduced in an unexpected way. Dridex malware targeted Windows users that would open Word or Excel email attachments, which would then cause macros to download the malware and infect the computer, exposing the user to the banking theft. In the latest version of the Dridex malware, the hackers use FTP sites and credentials to avoid detection by email gateways and network policies that trust FTP. Regularly updating FTP credentials can help deter a Dridex-based exploit. (ZDNEt)

 

Protect Your Organization With a Managed File Transfer Solution

FTP servers alone lack the system capabilities that many organizations need to meet today’s business requirements. From security, productivity, and compliance, an FTP server by itself can’t scale to either cost or complexity. A Managed File Transfer (MFT) platform was designed to address all of the business needs described above, and more. In some cases, a MFT platform can work with FTP during a transition to a more secure and efficient flow of information.

  • MFT technology offers a higher level of control and security than FTP, often featuring:
  • In-depth reporting (like notification of completed file transfers)
  • Global visibility into all data transfer activity
  • End-to-end security with encryption of data in transit and at rest
  • Performance metrics, monitoring, support of regulatory compliance requirements
  • Workflow automation, and so much more

How to Avoid the Security Risks of Inefficiency with File Transfer Automation

Today’s business demands are fast paced and unrelenting. When it comes to meeting these demands, efficiency is often the crux. Inefficiencies within the IT infrastructure can create a chain reaction of problems. The end result? More time and money is spent troubleshooting and problem solving. Even worse is failing to deliver services and products to customers or failing to meet compliance regulations. Needless to say, an inefficient IT infrastructure causes a great deal of headaches and costs a great deal of money.

Letting Go of Outdated Homegrown, Legacy IT Systems

According to a Harvard Business Review Analytic Services study, more than a third of surveyed IT respondents believe that “current IT systems make it difficult or time-consuming for employees to access core business data and apps without help.” They were also “too busy supporting legacy tech” to spend time improving systems for employees. 

How High-Risk Legacy Systems are Hurting Your Business

According to research specialist Vanson Bourne, organizations that modernized their legacy IT system would help reduce their business operational costs by 13%. In the same study, they report the potential boost in annual revenue by over 14%, which can be an increase of more than $1 billion a year.