Backdoor in vsftpd download

The FTP protocol uses plain text. Taking into account that it is most frequently deployed by web hosting companies, that lack of encryption implies a real risk for everyone.

It's not a rocket science to launch a network sniffer in an airport, a Starbucks or any other shared network, and capture the FTP credentials of a designer making quick changes to client's ecommerce site.

What makes it really bad is that nearly all web apps today include full database credentials, enabling an attacker to either wipe out the data or just copy it.

As we have already learned many times, the passwords are rarely stored securely, and users tend to routinely reuse their passwords. A database of any moderately succesful service makes it really easy to get access to hundreds of email, or Facebook, accounts.

Of course, this is just an example. There are few other attack vectors relying on that inherent weakness of the FTP protocol.

While it is not a backdoor technically, it comes pretty close to it, as it provides an effortless method to gain an unauthorized access.

In the past, FTP daemons were buggy and used to run as a root, making them pretty handy to exploit. Now, with privilege separation enabled, it's much better for the administrators but regular users are still at risk.

FTP tweaks, like FTP-SSL, are nice in theory but, in practice, they are provided as an option, some FTP clients do not support them, and they do not work well with many standard firewall configurations, due to the secondary data connection port.