3

I'm actually working in a medium sized company with security concerns. Let me explain you my problem :

The context:

  • My office has one single internet line.
  • This line is accessed by anyone in the office over WIFI.
  • My server use the same line in LAN, this server needs to send periodically important information to a distant server via FTP.

The problem / threat:

I’m afraid that a potential hacker could sniff my FTP credential and use them again to alter or get important information. I’m aware that the FTP protocol is unsecure because the credentials are sent in plain text over the network/internet but I cannot change the protocol the servers are using at the moment. I know that SFTP or FTPS would be a better way to encrypt the data/credentials.

So anyone using the office WIFI would be able to sniff the credential using a tool like Wireshark?

Possible solutions:

  1. Open a second internet line dedicated only for the people in the office using WIFI. The first line would be EXCLUSIVELY dedicated to our system/server to discuss with our remote server via FTP. So both networks would be separated.

  2. Maybe install a hardware / firewall on our internet line to secure, protect from sniffing. But I honestly don’t know if this kind of router/firewall can make the job and protect us from sniffers?

So here are my questions:

  • First of all, did I say anything that doesn’t make sense?
  • What would be the easiest solution to avoid those sniffers to get my credentials?

Thank you in advance for any advice.

  • You are fighting a losing battle. If you really care about your data you are sending, use FTPS/SFTP, or tunnel your connection through SSH or VPN. Anything else is irresponsible. – Lie Ryan Feb 13 '15 at 10:58
5

If I understand correctly, your connection to the Internet gateway is wired and everyone else is WiFi. If that is the case, the WiFi users cannot capture your FTP credentials because there is no need for the WiFi AP to transmit them, and it won't.

But really, the answer is to convince the people at the other end to replace FTP with SFTP.

0

The problem isn't just on your local network. If you are using FTP to transmit the data to a remote server, then that traffic could be intercepted at many points between you and the remote server. The problem is that your FTP credentials are being sent in plain text. Admittedly, this would be easier to do on your local network, but that is not your only threat. Consider also the threat at the remote site's network too.

The extent to which this is an issue with users on your local wifi network will depend on a number of factors. However, it sounds like your company is quite small and I suspect your ADSL (or whatever) modem and WiFi access point are the same bit of equipment and probably of the SOHO type, which means the security is probably pretty bad. Normally, if you have more enterprise equipment and a separate access point, you can have more control or isolation over what the wifi users can see in your LAN network. However, with SOHO combined modem and access point solutions, this is likely not the case and wifi users will be able to easily sniff your LAN and WLAN traffic.

The real solution is to just not use FTP. However, if you cannot change this, you could look at setting up an SSH tunnel and forwarding your FTP connections through that tunnel. If that isn't possible, then you need to consider other ways of reducing the risk. for example, encryupting the data you send and changing your FTP credentials on a regular basis. However, this is not a great way to go - you really need to get the company to change their process. If you can't, then be very sure to clearly articulate the risk and let the executive sign-off (accept) that risk. Sometimes that is all we can do. Provided you clearly communicate the risk in an accurate manner, you have done your job. Management can decide to accept any level of risk, but the decision must be based on full and accurate information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.