In one sentence: Port 21 is the door that the File Transfer Protocol (FTP) uses to send files between computers, and it is an old design that sends passwords and files without encryption.

What runs on this port

FTP is a standard for moving files from one computer to another. RFC 959 dates from October 1985. The IANA registry lists FTP on TCP port 21, with port 20 as the default for data.

FTP uses two connections. RFC 959 describes a control connection, on port 21, that carries commands. A separate data connection carries the files. The server’s default data port is the one next to the control port, which is port 20, though the data connection can use other ports.

Why attackers look for it

Attackers scan the internet continuously for open services. CISA describes the Mirai malware doing exactly this: scanning for devices and trying common passwords. An open port 21 tells them a login prompt is waiting.

RFC 2577 warns that FTP servers can be used by attackers to guess passwords by brute force. If the account is weak, the prize is every file the account can reach.

How it gets attacked

• No encryption. RFC 2577 states that standard FTP sends passwords in clear text and sends all data and control information unencrypted. Anyone able to watch the network path can read them.
• Password guessing. An exposed login can be tried repeatedly. RFC 2577 recommends closing the connection after a small number of attempts (3 to 5) and adding a short delay.
• Bounce attack. RFC 2577 describes how the FTP PORT command can be abused to make the server connect to a third machine, which hides the attacker and can get around address-based restrictions.
• Poisoned software. CVE-2011-2523: the National Vulnerability Database (NVD) records that vsftpd 2.3.4, downloaded between 30 June and 3 July 2011, contained a backdoor that opens a shell on port 6200/tcp.

Who it affects and how badly

• Sole trader to 10 staff: an FTP server on a website host or office device. Worst case: stolen login, defaced site or leaked files.
• 10 to 50 staff: accountancy, legal and estate agency firms that swap documents with suppliers. Worst case: client documents exposed.
• 50 to 250 staff: manufacturers and retailers with older systems that upload files through FTP. Worst case: tampered files that feed other systems.
• Regulated and public bodies: personal data sent over FTP in clear text is a weak control for the UK GDPR, the EU GDPR and equivalent laws in the US and Armenia.

How to check whether yours is exposed

• Read your firewall rules for inbound TCP 21 and for ranges used by passive FTP data connections.
• Check your asset list for anything that offers FTP: web hosting, scanners, cameras, old servers and file-exchange tools.
• Run the free web vulnerability scan on your public site, and check your own public addresses from outside your network. Only test addresses you own.
• Look in the FTP server log for failed logins from unfamiliar addresses.

How to secure it

1. Turn FTP off if you do not need it, and close inbound port 21.
2. Replace it with an encrypted option, such as SFTP (which uses SSH), or FTP over TLS as described in RFC 4217.
3. Use strong, unique passwords or keys, and remove shared and default accounts.
4. Limit failed logins to a few attempts and add a delay (RFC 2577).
5. Restrict access to known addresses with firewall rules.
6. Disable the PORT command if you do not need proxy transfers, because it blocks the bounce attack (RFC 2577).
7. Keep the server software updated, and download it only from the official source.

Related terms

• port 22 ssh
• port 445 smb
• brute force attack
• nmap
• vulnerability scanning
• port 23 telnet

Frequently asked questions

What ports does FTP use?
FTP listens on TCP port 21 for commands, and uses port 20 as the default for data, though data connections can use other ports.

Is FTP encrypted?
Standard FTP is not. RFC 2577 says it sends passwords and all data unencrypted. RFC 4217 describes how to add TLS.

What was the vsftpd backdoor?
CVE-2011-2523 was a backdoor in vsftpd 2.3.4 downloads between 30 June and 3 July 2011 that opened a shell on port 6200/tcp.

Sources

• RFC 959, File Transfer Protocol: https://www.rfc-editor.org/rfc/rfc959.txt
• RFC 2577, FTP Security Considerations: https://www.rfc-editor.org/rfc/rfc2577.txt
• RFC 4217, Securing FTP with TLS: https://www.rfc-editor.org/rfc/rfc4217.txt
• NVD record for CVE-2011-2523 (vsftpd 2.3.4): https://nvd.nist.gov/vuln/detail/CVE-2011-2523
• IANA service name and port number registry: https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.