Pierluigi Paganini March 28, 2017

The Cyber Division of the U.S. Federal Bureau of Investigation (FBI) warns the companies in the healthcare industry of FTP attacks.

The Cyber Division of the U.S. Federal Bureau of Investigation (FBI) warns the healthcare industry that malicious actors are actively targeting File Transfer Protocol (FTP) servers of medical and dental facilities that allow anonymous access.

The attackers aim to steal protected health information (PHI) and personally identifiable information (PII) and use them for criminal purposes.

“The FBI is aware of criminal actors who are actively targeting File Transfer Protocol (FTP)a servers operating in “anonymous” mode and associated with medical and dental facilities to access protected health information (PHI) and personally identifiable information (PII) in order to intimidate, harass, and blackmail business owners.” reads the alert issued by the FBI.

The vulnerable FTP servers can also be abused by crooks to power cyber attacks of to store malicious tools.

“The FBI recommends medical and dental healthcare entities request their respective IT services personnel to check networks for FTP servers running in anonymous mode. If businesses have a legitimate use for operating a FTP server in anonymous mode, administrators should ensure sensitive PHI or PII is not stored on the server.”

According to a 2015 study conducted by the University of Michigan titled, “FTP: The Forgotten Cloud,” over 1 million FTP servers were configured to allow anonymous access. These servers were potentially exposing sensitive data due to the anonymous extension of FTP that allows a user to authenticate to the FTP server with a generic username (i.e.  “anonymous”, “ftp”) with no password or using a generic password.

“In general, any misconfigured or unsecured server operating on a business network on which sensitive data is stored or processed exposes the business to data theft and compromise by cyber criminals who can use the data for criminal purposes such as blackmail, identity theft, or financial fraud,” the FBI warned.

In order to prevent FTP attacks, the FBI recommends medical and dental healthcare entities to check FTP servers in their organizations running in anonymous mode.

In case companies need to have an FTP server running in anonymous mode, they should not store sensitive PHI or PII on the server.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – FTP attacks, hacking)