Subject: RE: FTP password cracking

From: "Roger A. Hanke" <[email-masked]>
Date: Thu, 5 Jun 1997 12:11:13 -0400

Dear WUFTPD'ers,
 Got two responses to my question about why WUFTPD Beta 13 (and previous
versions) rejects a bad userid in the following manner without prompting for
the password first as it should:

530 User garbage access denied....
Login failed.

One response said they have same problem with Beta 13, one response
said they were prompted for password with Beta 13, even when they 
entered a non existent userid like "garbage".

Obviously the ones of us who have this problem need to get to the bottom
of this since it is a serious security problem. Could some other people please   
try this exercise (just takes a couple minutes to try logging on
with a nonexistent user id like "garbage") and report back whether they get
the above error or get prompted for a password first. Feel free to respond
to me directly ([email-masked]) to avoid cluttering up the list (as well as
potential security issues). I will report back the findings in only a general 
manner to let people know roughly what percentage of us have this 
problem. This will help immensely to try to pin down what exactly is the
difference causing this. Please include your OS type and version, as well
as your WUFTPD version and any patches or changes you may have made
so we can try to start pinning down similarities or differences in the systems
that do have this problem.
	Thanx,
	Roger Hanke

----------
From: 	Roger A. Hanke[SMTP:rah@lynxhub]
Sent: 	Friday, May 30, 1997 11:36 AM
To: 	'WUFTPD List'
Subject: 	FTP password cracking

Dear WUFTPD'ers

 In trying to check some possible security holes, ran across one that WUFTPD
seemed to make worse. Hope someone can possibly point out a way around 
this. 

 Normally with UNIX, on purpose, they do not give you any feedback during
the login process until after you enter both the user id and password. 
This increases the number of permutations exponentially required to crack
into an account.

 But with Beta 11 version at least (and I strongly suspect all versions) if you
enter a "garbage" user name you get the following response:

530 User garbage access denied....
Login failed.

 Of course if you enter a valid user id that has proper access authorization
you get the password prompt. So it is very easy for a computer program 
being used to crack in, to realize when they have discovered a valid id.
Then can then shift to cracking the 8 character (on UNIX anyway) password
for this account. Even if you limit their consecutive logon tries to 3 like I 
do, this just slows them down a little, they just try 3 iterations at a time before
doing another open and 3 more tries....

 This scenario can occur on any WUFTPD server but in our case it is a FTP
download server that is on the internet. Many of our customers have been
given guest class ids that they use to setup private download areas. But since
their end users can come from any possible IP address, there is no way
to use guest class IP restrictions.

  Thought of using the UNIX account LOCKOUT mechanism (despite the
recent CERT on SGI's ;-(  but this introduces the possibility of denial of
service attacks on all accounts on this server. Which could render this
server useless if someone cracked valid user ids and then started cracking
the password resulting in account lockouts.

 Am not able to go to a skey implementation because our customers do
not want to put up with the extra inconvenience. But even this just means
an internet cracker would need to crack a 28 (or so) character password
instead of an 8 character one. It does not prevent them from discovering
valid user ids which is the real problem as I see it.

 So anyway to have WUFTPD suck in user id and password and then do
its access checks? So that valid user ids could not be discerned at least.
So that no access denied, or invalid password, or any other error messages
would come out prior to entering both user id and password?

 Thanx for hearing me out,
	Roger Hanke

---

From: Lou Katz <[email-masked]>
Date: Mon, 9 Jun 1997 16:14:38 -0700 (PDT)

BSDI/OS 2.1
OK here

(lou@diablo) [/users/lou]-19% ftp ftp.metron.com
Connected to ftp.metron.com.
220 orange.metron.com FTP server (Version wu-2.4(1) Fri Feb 23 17:06:34 MST
1996) ready.
Name (ftp.metron.com:lou): garbage
331 Password required for garbage.
Password:
530 Login incorrect.
Login failed.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> quit
221 Goodbye.