Stopping ALL Buffer Overflow, And Related Exploit Attacks? WHY DOESN'T THIS WORK.?

Question

So exploits are used all the time by hackers against a running web service like an FTP server, web server etc. etc. MY question is say you're running a small network that has some FTP servers running on port 21 for whatever reason.

IF you are running an open source FTP server or even a closed source popular FTP server there's a huge chance a hacker(s) can get a hold of the source code and find vulnerabilities to try and exploit so as to gain access to the machine right? Right! No mystery there. 

Now say instead of installing someone ELSE'S FTP server I create program and code MY OWN FTP SERVER PROGRAM just especially for that small network. The ftp server hypothetically isn't used anywhere else and isn't distributed . 

Since a hacker wouldn't have access to the source code OR EVEN THE BINARIES, wouldn't that technically mean that a hacker would have a very hard to impossible time trying to exploit that service running?

Someone talk about this? lol

Anonymous · Accepted Answer

While I comment your programing skills, your though process here is a bit skewed. A hacker does not exploit FTP based on source code. FTP or TCP port 21 is governed by the RFC standards. It is the protocol that is exploited, not the application. As you have to have certain things happening for an active or passive FTP connection, these actions and the process can still be exploited. Unless you are writing a FTP type protocol that does not apply the RFC standards that uses port 21, but then most firewalls will block that kind of communication anyway as to it's actually an exploit to change the procedures.

Simply put, you've painted the door but it's still the same door.

Kodlee Yin · Answer

Well, first off:

1. The hacker needs to find your FTP address
2. The hacker needs to know what program your using to even know vulnerabilities
3. Patches for bugs and vulnerabilities are always updated.
4. The hacker can always figure a way in

To answer your question, yes, but why run the time making your own client? 
The first problem is easily figured out, sure. The second, however, is more complicated and even when they figure it out, they still need to try to hack into it which brings us to number 3. Keep your system updated, you shouldn't have a problem.
Finally we reach number 4. Yes, there is always a possibility, but then again, thats why there are laws. 
Read up: http://www.law.cornell.edu/uscode/18/1030.html
Persecution is easy, and tracking IP's is even easier.

Hope this helps!

Trending News

Stopping ALL Buffer Overflow, And Related Exploit Attacks? WHY DOESN'T THIS WORK.?

2 Answers