From: Mike.Patterson@mtsg.ubc.ca
Subject: Warning -- anonymous ftp vulnerability
To: BCnet.Technical.Mailing.List@mtsg.ubc.ca
Originator: daemon@unixg.ubc.ca
X-Mts-Userid: MPAT
Organization: UBC Mail to News Gateway
Date: Thu, 30 Jul 1992 20:48:10 GMT

In the attached message, Ron Parachoniak, one of the systems
administrators in Physics at UBC reports a problem he had with
anonymous FTP. 
 
This can happen to you!!!  If you enable anonymous ftp, do not make
any directory which is accessible via anonymous ftp world writable. 
This is an invitation for people to use it for their own purposes, and
it appears that certain individuals on the Internet are actively
looking for these situations. 
 
  -- Mike Patterson, BCnet manager 
 
e-mail: BCnet@ubc.ca    BITNET: USERMPAT@UBCMTSG 
Phone:  (604) 822-3932   Fax: (604) 822-5116 
 
------------------------------------------------------------------- 
Delivery-date: Thu, 23 Jul 1992 10:32:11 UTC-0700 
Originator:    rap@physics.ubc.ca 
Send-date:     Thu, 23 Jul 1992  9:33:00 UTC-0700 
From:       Ron Parachoniak <rap@physics.ubc.ca> 
To:         <uug@unixg.ubc.ca> 
Subject:    anonymous ftp stow-aways 
 
I recently had a problem with our anonymous ftp account that might be of 
interest to others on campus. 
 
I had set up anonymous ftp a few months back, being quite careful to 
make sure that I set it up correctly so that it was secure.  Shortly 
after setting it up someone had a requirement for an incoming 
directory.  This is an area that is writeable by the anonymous ftp 
user. 
 
A month or so after I had set up the incoming directory, I found that my 
system logs were showing an unusally large number of ftp connections. 
When I looked in the ftp area I found two new directories in the 
incoming directory.  Closer inspection revealed that the directories 
contained rather explicit pornographic image files.  I deleted the files 
and didn't do anything else, assuming that when they (whomever they 
were) discover the files deleted, they would know the gig was up and 
stop.  A week later I checked the directory again and found more files 
but this time they had taken some efforts to hide them (directory named 
...  with subdirectories named .f and .r).  I again deleted the 
directories and also disabled the incoming directory.  I find that two 
weeks later I am still getting a large number of ftp logins (presumably 
people looking to see if I have enabled the incoming directory).  I have 
now disabled anonymous ftp altogether, at least for the time being. 
 
Text files in the directories indicated that people would put requests 
for certain files to someone who would then upload the files.  The 
requestor would then login in and retreive them.  Another file warned 
users to not give the name of this ftp site to anyone else since the 
machine would become flooded with ftp requests and then get shut down. 
As you see, this is exactly what happened, eventually. 
 
It's amazing to look at the logs and see how much anonymous ftp activity 
there was (continuous, 24 hrs a day) and where it was from - literally 
all over the world.  I can imagine that the amount of net bandwith being 
used for this activity is quite significant. 
Newsgroups: bc.bcnet