Is an Ethernet FTP server on a local network safe if an attacker can't access the router?

Question

I'm having trouble understanding certain security concepts and I was wondering if someone could help me out with some questions.

Imagine this setup:

1. A home router with a very strong password, that has a wireless AP (WPA2) also with a strong password.
2. Connected to this router via Ethernet is a device that is hosting a local FTP server.

In this current setup, is it possible for someone in the area to sniff packets coming from the router and capture FTP login credentials? Or would they need to be connected to the router in order to sniff for FTP credentials?

Or is it not possible to sniff the packets no matter what because the FTP is connected via Ethernet to the router (and is not connected to the wireless AP)?

Answer 1

Assuming your wireless network is secure and the attacker cannot otherwise connect to your network, then they won't be able to get access to the plaintext packets to sniff them. Your wireless network will be encrypted, so without credentials, an attacker will not be able to decrypt the data even if they do get the encrypted packets.

If an attacker can get access to your local network, then you should assume they can see everything on it. There are tools that do this via ARP spoofing, for example. That type of attack can cause packets to be sent over the Wi-Fi when they normally would not be.

There are of course possible attacks that might result in an attacker gaining access to your network, such as a vulnerability in the router (which is actually very common), so keeping your firmware up to date is important here.

You can practice defense in depth by using TLS for your server. Let's Encrypt can be used to issue a publicly trusted certificate. However, one of the reasons I typically recommend against FTP (there are many) is that due to many implementations incorrectly implementing the standard, FTP servers often don't cover the entire connection with TLS, and even when they do, the client also has to implement the protocol correctly, which is not common. As a result, securing FTP with TLS is difficult in practice, and other protocols, such as SFTP or HTTPS, are easier to get right.

Answer 2

To be fully secure, you have to make sure WiFi is off.

No WiFi is secure nowadays, they can all be cracked by a worthy adversary. If you need WiFi try and use a Guest network that only allows internet access but not LAN access, that will segment them off your LAN.

If your WiFi is off and your LAN is wired only, you are safer, but WiFi routers are extremely vulnerable to attacks. I don't know of any consumer grade router sitting directly on the Internet that doesn't eventually suffer from a compromise. If your router gets hacked, the attacker will be able to sniff your FTP credentials and gain access.

To prevent this, all you have to do is use Secure FTP (SFTP) or FTP over TLS. Most free FTP clients support these protocols and you can generate a self-signed certificate with 4096bits which will strongly encrypt your traffic and render all sniffing futile.

If you use FTP over TLS you can be sure that nobody will be able to sniff your connection.

Another layer of security I would recommend is running a firewall on your FTP server allowing only authorized internal IPs to connect. This helps prevent any exploitation of vulnerabilities that may be present in your FTP software by other clients on your LAN.

Of course, if someone does gain access to your local network there are many other attack vectors that could be used to infiltrate your systems.