FTP

What is FTP?

FTP (File Transfer Protocol) is a network protocol for transferring files between a client and a server over a TCP/IP network, sending commands, passwords and file contents without encryption. The protocol was defined in RFC 959 in 1985, but its first version dates back to 1971, which makes it older than the internet itself. FTP was designed for simplicity and interoperability between very different computers, not for security.

In OT environments, FTP is still used to exchange recipes, log files, configurations and firmware, mainly on older equipment. Because everything crosses the network in readable form, it is strongly discouraged for new applications.

🧠 How does FTP work?

FTP uses two separate TCP connections between client and server:

• Control connection - the client connects to port 21 on the server and sends text commands such as USER, PASS, LIST, RETR (retrieve a file) and STOR (store a file). The server replies with three-digit status codes, for example 220 (ready), 230 (logged in) or 226 (transfer complete).
• Data connection - a new connection is set up for every file transfer or directory listing. Which side opens that connection depends on the mode.

A typical session runs in four steps:

1. The client opens the control connection to port 21.
2. The user logs in with a username and password, both in plaintext. With anonymous FTP the username is anonymous.
3. The client selects the transfer type: ASCII for text files or image (binary) for programs, firmware and images. The wrong type can corrupt binary files.
4. For each file a data connection is opened, filled and closed again.

FTP has no built-in encryption and no integrity check: anyone who can read the network traffic sees the password and the file contents.

🔄 What is the difference between active and passive FTP?

The separate data connection makes FTP awkward to combine with a firewall or NAT. That is why there are two modes:

Passive mode is now the default in most clients. RFC 2428 (1998) added EPRT and EPSV for IPv6 and to reduce problems with NAT. Firewalls that allow FTP often use an FTP helper that inspects the control connection to open the right data port temporarily. That only works as long as the traffic is unencrypted.

🏭 Where is FTP used in industrial networks?

FTP is remarkably persistent in legacy systems, because it is easy to implement and runs on almost every embedded platform:

• PLC communication modules - many Ethernet modules for PLCs include an FTP server for loading files, web pages or firmware.
• HMI panels and SCADA - HMIs and SCADA stations export recipes, alarm logs and trend data as files to a server.
• Vision cameras and scanners - cameras store images of rejected products on a network share via FTP.
• Data export - measurement data is sent via FTP to a historian, a laboratory system or an external party.
• Firmware and configuration - network equipment and controllers fetch firmware or configuration files. TFTP is also used for this, an even simpler variant over UDP port 69 without any authentication.

A concrete example: in June 2023 CISA published an advisory on Mitsubishi Electric EtherNet/IP modules (RJ71EIP91 and FX5-ENET/IP). Their FTP function contained hard-coded credentials (CVE-2023-2061), weak password requirements (CVE-2023-2060) and unrestricted file upload (CVE-2023-2063). The recommended measures were to disable FTP where the firmware allows it, configure an IP filter, place the module behind a firewall and replace it in due course.

🔍 What is the difference between FTP, SFTP and FTPS?

SFTP is not FTP over SSH but a protocol of its own. It uses a single connection, which makes it much easier to pass through a firewall. FTPS keeps the FTP structure with separate data connections; because the control connection is encrypted, a firewall FTP helper can no longer read the data port, so a fixed passive port range has to be opened.

🔐 What are the security risks of FTP?

• Eavesdropping - passwords and files cross the network in plaintext and are directly readable with a tool such as Wireshark.
• Tampering - an attacker in a Man-In-The-Middle position can modify a recipe, program or firmware file in transit; FTP does not check integrity.
• Spoofing and Session Hijacking - without cryptographic server authentication, the client cannot be sure who it is talking to.
• Password reuse - a sniffed FTP password is often also the password for other systems.
• Anonymous and default accounts - anonymous FTP and factory passwords give unauthorised users write access to a device.

Security standards such as IEC 62443 and ISO 27001 do not mention FTP by name, but set requirements that unencrypted FTP cannot meet. IEC 62443-3-3 calls for, among other things, user authentication (SR 1.1), communication integrity (SR 3.1) and information confidentiality (SR 4.1). ISO 27001:2022 contains controls for information transfer (A.5.14) and the use of cryptography (A.8.24). Web browsers have drawn the same conclusion: Chrome and Firefox removed their built-in FTP support around 2021, partly because the protocol lacks encryption.

🛠️ How do you phase out FTP in an OT environment?

Replacement rarely happens in one go, because older equipment often only speaks FTP. A practical approach:

1. Inventory - record in the asset inventory which devices have an FTP server or client and which flows are actually used. Passive network monitoring on port 21 quickly shows where FTP is active.
2. Disable what is not needed - switch off unused FTP servers on PLCs and HMIs; this immediately reduces the attack surface (see hardening).
3. Replace where possible - choose SFTP or FTPS for new connections, or a modern interface such as OPC UA or HTTPS.
4. Shield what has to stay - keep FTP within one zone following the zones and conduits model, place an SFTP server in the DMZ as an intermediate hop and only allow fixed IP addresses through firewall rules and access control.
5. Restrict accounts - no anonymous login, unique strong passwords per device, and write permissions based on least privilege.
6. Verify integrity - compare hashes of firmware and programs before use and enable logging of FTP sessions.

For organisations within the scope of NIS2, which the Netherlands implements through the Cyberbeveiligingswet, phasing out unencrypted protocols is a logical part of appropriate measures. Under the Cyber Resilience Act, manufacturers of new products also face requirements for protecting data in transit.

❓ Frequently asked questions

Is FTP still safe to use?

FTP is not secure in itself, because passwords and files are sent unencrypted. FTP is only defensible inside a strongly segmented network, for equipment that supports no alternative, and with additional measures such as firewall rules and logging.

Which ports does FTP use?

FTP uses TCP port 21 for the control connection. In active mode the data connection runs from port 20 on the server; in passive mode FTP uses a high port that the server announces for each transfer.

What is the difference between FTP and TFTP?

TFTP (Trivial File Transfer Protocol) is a separate, heavily simplified file-transfer protocol that runs over UDP port 69 and has no login or directory listings. In OT and IT, TFTP is mainly used to send firmware and configurations to network equipment and controllers, which makes it even more vulnerable than FTP.

Should I choose SFTP or FTPS to replace FTP?

SFTP is usually the best replacement for FTP, because it uses a single connection over port 22 and is easy to handle in a firewall. FTPS is useful when an existing system only supports FTP variants, but it requires a fixed passive port range and certificate management.

Why do PLCs and HMIs still support FTP?

PLCs and HMIs support FTP because the protocol is small, old and universal, so it fits on constrained embedded hardware. Many manufacturers offer encrypted variants on newer models, but older equipment often stays in service for decades.

How can I detect FTP traffic on my network?

FTP traffic can be recognised by connections to TCP port 21 and by readable commands such as USER and PASS in a packet capture. An IDS or OT monitoring platform flags FTP use automatically, including the device acting as the server.

📌 In summary

FTP is one of the oldest internet protocols and is still widespread in industrial equipment, but it sends everything in plaintext and does not check file integrity. Recent vulnerabilities in PLC modules show that FTP functions are a real point of attack.

FTP is an insecure, outdated protocol still found in legacy OT systems: inventory it, disable it where you can, shield it where you must, and replace it with encrypted alternatives such as SFTP or FTPS.