FTP brute force against internet-facing file servers
The short version: An FTP service exposed to the internet lets attackers try default, common, and already-breached credentials against it until one works — no exploit required, just an exposed login and one weak password.
What you need to know
There's no CVE here and nothing to patch. The weakness is the combination of exposure and weak authentication: an FTP login an attacker can reach, in front of accounts whose passwords may be a vendor default, guessable, reused, or already in a public breach dump.
Attackers automate the guessing. They'll try well-known default pairs (admin/admin, ftp/ftp, root/root), the top handful of common passwords across known usernames, and credentials pulled from breach corpora — patiently and at low volume to avoid tripping lockouts.
- How they find it — internet-wide port scanning flags open FTP services, and the service banner identifies the software.
- How they use it — automated credential guessing with default, common, and previously-breached passwords.
- What it leads to — a working login means read access to whatever the account can see, and often write access as well: a data leak, a place to stage malware, or a foothold for expansion. Underneath it all, classic FTP is cleartext, so even legitimate use exposes file contents and credentials in transit.
How serious we see it
Moderate — by default, with honest upside risk. An FTP login protected by strong, unique credentials on a locked-down account is a manageable exposure, not an emergency. But the severity climbs with what the account can reach and do: a default or reused credential that lands on a writable share, or one that exposes sensitive files, is a direct unauthenticated path to data or a foothold we'd treat as High. The reassuring part is that it's fully in your hands to fix, with no vendor patch required.
What to do
- Change every default and weak credential — enforce strong, unique passwords and check them against known-breached lists.
- Limit and monitor failed authentication — rate-limit attempts and alert on guessing patterns.
- Restrict access to trusted networks — put the service behind a VPN or source-IP allowlist wherever possible.
- Move off cleartext FTP — prefer FTPS or SFTP so file contents and credentials aren't exposed in transit.
- Confirm your exposure first — verify whether any FTP service is internet-facing at all.
How BreachRisk sees it
BreachRisk finds exposed FTP services in your external footprint the way an attacker would, and then — where authorized — goes a step further than a scanner: it safely attempts a bounded, rate-limited authentication check using default, common, and exposed (breach-corpus) credentials, within strict non-disruptive limits rather than a brute-force flood. That's the honest difference between detecting an open FTP login and demonstrating whether it actually holds. "We have FTP on the internet" becomes a straight answer: is it defended, or one default password away from access?