One of my hosting providers still just offers FTP access to the server...

  • Is authorisation safe (i.e. resistant to network sniffing) despite the content of the transmission is plain text?
  • Is it possible to hijack such a FTP session?

When is comes to content, I only upload resources available publicly, and eventual auth keys by websites are strong salted hashes, so network sniffing of content is not my concern. What I am afraid is if network sniffing could allow others to gain unauthorised access. I am not sure what FTP authorisation mechanisms are possible and how to check which one a given server is using.

To make the question/answer complete for the reader, am I correct that such a FTP connection would still be vulnerable to man-in-the-middle attack and session hijacking?

up vote 2 down vote accepted

The authorization with FTP is plain text username and password and there is no protection against passive sniffing.

FTPS (FTP over TLS, not to be mixed up with SFTP which is file transfer over SSH) offers protection against sniffing. But many FTP clients don't check the TLS certificate properly or let the user easily skip the check and thus can be vulnerable against active sniffing (man in the middle attack).

Classical session hijacking as known from HTTP is not a problem here because there is no such kind of session. It is still possible to hijack the underlying TCP connection. But this needs an active man in the middle and works only with plain FTP in which case using passive sniffing to get the password would be the much simpler attack.

  • So it seems like me suggesting provider to offer sftp or ftps (or obscure way: vpn to pass ftp over it) is the only way. (Yes, they do not provide ssh account, so I could do ssh tunelling...) – Grzegorz Wierzowiecki May 16 '16 at 8:13
  • To confirm. Is following fair summary of your answer? : Yes, sniffer gains all authorization details, so attacker can later own account. – Grzegorz Wierzowiecki May 16 '16 at 8:17
  • @GrzegorzWierzowiecki: correct, with passive sniffing the attacker gets all credentials to own the account. – Steffen Ullrich May 16 '16 at 8:19
  • Thank you ! I hope this question/answer will be helpful also to other readers -> (cross-linking:) security.stackexchange.com/q/123413/4077 – Grzegorz Wierzowiecki May 16 '16 at 8:26

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.