When security requires extra steps, history and human nature provide evidence that operators will take the path of least resistance and not secure the files. Someone has to take action to either encrypt files before sending via FTP, or write the scripts necessary to tackle those as part of the file transfer process. FTP is still used for many legitimate business transactions, and it can be both secured and automated-if done properly. These security issues underscore the value of managed file transfer platforms that are engineered to be secure and automated. To date, many malware distribution campaigns launch their attacks by compromising FTP servers and downloading malware on an end user’s device using the FTP protocol.”

“The biggest security risk is that FTP transfers data in cleartext, allowing attackers to steal, spoof and even modify the data transmitted. Furthermore, the article notes the Mozilla’s security team statement regarding FTP’s use as an attack vector for threat actors engaged in malware campaigns. Google Chrome ended FTP support with the release of version 88 in December.Īccording to a ZDNet article, even though FTP remains a popular, low-cost option for moving files between computers, FTP is “burdened by enough security issues that browser makers are dropping support for the protocol.”įiles exchanged via FTP are sent in the clear and are not encrypted, thus they are inherently non-secure.

Not sure if you noticed, but Mozilla recently announced it was dropping file transfer protocol (FTP) support in version 90 of its popular Firefox browser.

Mozilla ftp site