{"id":149975,"date":"2021-01-08T16:00:23","date_gmt":"2021-01-08T13:00:23","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/"},"modified":"2021-01-08T16:00:23","modified_gmt":"2021-01-08T13:00:23","slug":"why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/","title":{"rendered":"#Why Are Some Network Ports Risky, And How Do You Secure Them? \u2013 CloudSavvy IT"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af01499af0ec\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af01499af0ec\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Network_Addressing\" >Network Addressing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Standard_Port_Numbering\" >Standard Port Numbering<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#No_Port_is_Inherently_Safe\" >No Port is Inherently Safe<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_21_File_Transfer_Protocol\" >Port 21, File Transfer Protocol<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_22_Secure_shell\" >Port 22, Secure shell<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_23_Telnet\" >Port 23, Telnet<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_80_Hypertext_Transport_Protocol\" >Port 80, Hypertext Transport Protocol<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_1080_SOCKS_Proxies\" >Port 1080, SOCKS Proxies<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_4444_Transport_Control_Protocol\" >Port 4444, Transport Control Protocol<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_6660_%E2%80%93_6669_Internet_Relay_Chat\" >Port 6660 \u2013 6669, Internet Relay Chat<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_161_Small_Network_Messaging_Protocol\" >Port 161, Small Network Messaging Protocol<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Port_53_Domain_Name_Service\" >Port 53, Domain Name Service<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#Memorable_Numbers\" >Memorable Numbers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/buradabiliyorum.com\/en\/why-are-some-network-ports-risky-and-how-do-you-secure-them-cloudsavvy-it\/#How_To_Secure_These_Ports\" >How To Secure These Ports<\/a><\/li><\/ul><\/nav><\/div>\n<p><strong>&#8220;#Why Are Some Network Ports Risky, And How Do You Secure Them? \u2013 CloudSavvy IT&#8221;<\/strong><\/p>\n<div id=\"article-content-area\">\n<figure id=\"attachment_8867\" style=\"width: 700px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-8867 size-full\" src=\"https:\/\/www.cloudsavvyit.com\/thumbcache\/0\/0\/8610df780ecaac5de96a24c2c1967225\/p\/uploads\/2021\/01\/93942e4b.png\" alt=\"\" width=\"700\" height=\"300\" data-crediturl=\"https:\/\/www.shutterstock.com\/image-photo\/network-cable-binary-fiber-otics-backgound-126976088\" data-credittext=\"Shutterstock\/PeterPhoto123\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.shutterstock.com\/image-photo\/network-cable-binary-fiber-otics-backgound-126976088\">Shutterstock\/PeterPhoto123<\/a><\/span><\/figcaption><\/figure>\n<p>There\u2019s a network port for every type of traffic. Some ports are more at risk than others.\u00a0Here are the worst offenders and what you can do to secure them.<\/p>\n<h2 id=\"network-addressing\"><span class=\"ez-toc-section\" id=\"Network_Addressing\"><\/span>Network Addressing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Network and internet\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_protocol_suite\">Transport Control Protocol\/Internet Protocol<\/a>\u00a0connections are made from one\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/IP_address\">IP address<\/a>\u00a0to another. For convenience, we may use a website name like cloudsavvyit.com, but it\u2019s the underlying IP address that is used to route your connection to the <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>ropriate webserver. The same thing works in reverse, too. The network traffic that <em>arrives<\/em> at your computer has been directed towards its IP address.<\/p>\n<p>Your computer will have lots of programs and services running inside it. You might have an email application and a browser open on your desktop. Perhaps you use a chat client like\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/slack.com\/intl\/en-gb\/\">Slack<\/a>\u00a0or\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"http:\/\/redirect.viglink.com?u=https%3A%2F%2Fwww.microsoft.com%2Fen-gb%2Fmicrosoft-365%2Fmicrosoft-teams%2Fgroup-chat-software&amp;key=204a528a336ede4177fff0d84a044482\">Microsoft Teams<\/a>. If you\u2019re administering remote machines you might be using a\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/SSH_(Secure_Shell)\">secure shell<\/a>\u00a0(SSH) connection. If you\u2019re working from home and need to connect to your office you might use a\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Remote_Desktop_Protocol\">Remote Desktop Protocol<\/a>\u00a0(RDP) connection or a\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Virtual_private_network\">Virtual Private Network<\/a>\u00a0(VPN) connection.<\/p>\n<p>The IP address only identifies the computer. It cannot be any more granular than that. But the real end-point for a network connection is an application or service run. So how does your computer know which application to send each network packet to? The answer is by using\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Port_(computer_networking)\">ports<\/a>.<\/p>\n<p>When a courier delivers a parcel to a hotel, the street address identifies the building. The room number identifies the room, and the hotel guest. The street address is like the IP address, and the room number is like the port address. Applications and services use specific, numbered ports. So the actual destination for a network packet is to a port at an IP address. That is enough to identify the application or service on a particular computer that the packet is destined for.<\/p>\n<h2 id=\"standard-port-numbering\"><span class=\"ez-toc-section\" id=\"Standard_Port_Numbering\"><\/span>Standard Port Numbering<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some ports are dedicated to specific types of traffic. These are called the\u00a0<em>well-known ports<\/em>. Other ports are registered by applications and reserved for their use. These are the\u00a0<em>registered ports<\/em>. There\u2019s a third set of ports that are available for any application to use. They are requested, allocated, used, and freed up on an\u00a0<em>ad hoc<\/em>\u00a0basis. These are called\u00a0<em>ephemeral ports<\/em>.<\/p>\n<p>A mixture of ports will be used in a connection. The network connection needs a port at the local end of the connection\u2014in the computer\u2014to connect to the remote end of the connection\u2014a webserver, for example. If the webserver is using\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/HTTPS\">Hypertext Transfer Protocol Secure<\/a>\u00a0(HTTPS) the remote port will be port 443. Your computer will use any of the free ephemeral ports to make a connection to port 443 at the IP address of the webserver.<\/p>\n<p>There are 65535 TCP\/IP ports (and the same number of\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/User_Datagram_Protocol\">User Datagram Protocol<\/a>\u00a0(UDP) ports).<\/p>\n<ul>\n<li><strong>0 \u2013 1023<\/strong>: Well-known ports. These are allocated to services by the\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.iana.org\/\">Internet Assigned Numbers Authority<\/a>\u00a0(IANA). For example, SSH uses port 22 by default, webservers listen for secure connections on port 443, and\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Simple_Mail_Transfer_Protocol\">Simple Mail Transfer Protocol<\/a>\u00a0(SMTP) traffic uses port 25.<\/li>\n<li><strong>1024 \u2013 49151<\/strong>: Registered Ports. Organizations can make requests to the IANA for a port that will be registered to them and assigned for use with an application. Although these registered ports are called semi-reserved they should be considered\u00a0<em>reserved<\/em>. They\u2019re called semi-reserved because it is possible that the registration of a port is no longer required and the port is freed up for reuse. However\u2014even though it is currently unregistered\u2014the port is still in the list of registered ports. It is held in readiness to be registered by another organization. An example of a registered port is port 3389. This is the port associated with RDP connections.<\/li>\n<li><strong>49152 \u2013 65535<\/strong>:\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Ephemeral_port\">Ephemeral ports<\/a>. These are used on an ad-hoc basis by client programs. You are free to use these in any application you write. Typically they are used as the local port inside the computer when it is transmitting to a well-known or reserved port on another device in order to request and establish a connection.<\/li>\n<\/ul>\n<h2 id=\"no-port-is-inherently-safe\"><span class=\"ez-toc-section\" id=\"No_Port_is_Inherently_Safe\"><\/span>No Port is Inherently Safe<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Any given port is no more secure or at risk than any other port. A port is a port. It is the use the port is put to, and how securely that use is managed, that dictates whether a port is secure.<\/p>\n<p>The protocol that is used to communicate through a port, the service or application that consumes or generates the traffic that passes through the port needs to be current implementations, and within their manufacturer\u2019s support period. They must receive security and bug fix updates and these should be applied in a timely fashion.<\/p>\n<p>Here are some common ports and how they can be abused.<\/p>\n<h2 id=\"port-21-file-transfer-protocol\"><span class=\"ez-toc-section\" id=\"Port_21_File_Transfer_Protocol\"><\/span>Port 21, File Transfer Protocol<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>An insecure FTP port hosting an FTP server is a huge security flaw. Many FTP servers have vulnerabilities that can allow anonymous authentication, lateral movement within the network, access to\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Privilege_escalation\">privilege escalation<\/a>\u00a0techniques, and\u2014because many FTP servers can be controlled via scripts\u2014a means to deploy\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Cross-site_scripting\">cross-site scripting<\/a>.<\/p>\n<p>Malware programs such as Dark FTP, Ramen, and WinCrash have made use of insecure FTP ports and services.<\/p>\n<h2 id=\"port-22-secure-shell\"><span class=\"ez-toc-section\" id=\"Port_22_Secure_shell\"><\/span>Port 22, Secure shell<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Secure Shell accounts (SSH) configured with short, non-unique, re-used, or predictable passwords are insecure and liable to easy compromise by\u00a0password dictionary attacks. Many vulnerabilities in past implementations of SSH services and daemons have been discovered, and are still being discovered. Patching is vital to maintain security with SSH.<\/p>\n<h2 id=\"port-23-telnet\"><span class=\"ez-toc-section\" id=\"Port_23_Telnet\"><\/span>Port 23, Telnet<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Telnet is a legacy service and one which should be retired. There is no justification for using this ancient and insecure means of text-based communication. All the information it sends and receives through port 23 is sent in plain text. There is no encryption at all.<\/p>\n<p>Threat actors can eavesdrop on any Telnet\u00a0 communication and can easily pick out authentication credentials. They can perform\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Man-in-the-middle_attack\">man-in-the-middle attacks<\/a>\u00a0by injecting specially-crafted malicious packets into the unmasked text streams.<\/p>\n<p>Even an unauthenticated, remote attacker can exploit a buffer-overflow vulnerability in the Telnet daemon or service and, by crafting malicious packets and injecting them into the text stream, execute processes on the remote server. This is a technique known as\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Arbitrary_code_execution\">Remote (or abitrary) Code Execution<\/a>\u00a0(RCE).<\/p>\n<h2 id=\"port-80-hypertext-transport-protocol\"><span class=\"ez-toc-section\" id=\"Port_80_Hypertext_Transport_Protocol\"><\/span>Port 80, Hypertext Transport Protocol<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Port 80 is used for unsecured\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Hypertext_Transfer_Protocol\">Hypertext Transport Protocol<\/a>\u00a0(HTTP) traffic. HTTPS has all but replaced HTTP, but some HTTP still exists out on the web. Other ports commonly used with HTTP are ports 8080, 8088, 8888. These tend to be used on older HTTP servers and web proxies.<\/p>\n<p>Unsecured web traffic and the associated ports are susceptible to cross-site scripting and forgeries, buffer-overflow attacks, and\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/SQL_injection\">SQL injection attacks<\/a>.<\/p>\n<h2 id=\"port-1080-socks-proxies\"><span class=\"ez-toc-section\" id=\"Port_1080_SOCKS_Proxies\"><\/span>Port 1080, SOCKS Proxies<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/SOCKS\">SOCKS<\/a>\u00a0is a protocol used by SOCKS proxies to route and forward network packets on TCP connections to IP addresses. Port 1080 was one of the ports of choice at one time, for malware such as\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Mydoom\">Mydoom<\/a>\u00a0and many\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Computer_worm\">worm<\/a>\u00a0and\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Denial-of-service_attack\">denial of service attacks<\/a>.<\/p>\n<h2 id=\"port-4444-transport-control-protocol\"><span class=\"ez-toc-section\" id=\"Port_4444_Transport_Control_Protocol\"><\/span>Port 4444, Transport Control Protocol<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rootkit\">rootkit<\/a>,\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Backdoor_(computing)\">backdoor<\/a>, and <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Trojan_horse_(computing)\">Trojan horse<\/a> software opens and uses port 4444. It uses this port to eavesdrop on traffic and communications, for its own communications, and to exfiltrate data from the compromised computer. It is also used to download new malicious payloads. Malware such as the\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Blaster_(computer_worm)\">Blaster worm<\/a>\u00a0and its variants used port 4444 to establish backdoors.<\/p>\n<h2 id=\"port-6660---6669-internet-relay-chat\"><span class=\"ez-toc-section\" id=\"Port_6660_%E2%80%93_6669_Internet_Relay_Chat\"><\/span>Port 6660 \u2013 6669, Internet Relay Chat<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Internet_Relay_Chat\">Internet Relay Chat<\/a>\u00a0(IRC) started in 1988 in Finland, and it is still going. You\u2019d need to have a cast-iron business case to allow IRC traffic into your organization these days.<\/p>\n<p>There have been countless IRC vulnerabilities discovered and exploited down through the 20-something years it has been in use. The\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/UnrealIRCd\">UnrealIRCD<\/a>\u00a0daemon had a flaw in its 2009 that made remote code execution a trivial matter.<\/p>\n<h2 id=\"port-161-small-network-messaging-protocol\"><span class=\"ez-toc-section\" id=\"Port_161_Small_Network_Messaging_Protocol\"><\/span>Port 161, Small Network Messaging Protocol<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some ports and protocols can give attackers a lot of information about your infrastructure. UDP port 161 is attractive to threat actors because it can be used to poll information from servers\u2014both about themselves and about the hardware and users that sit behind them.<\/p>\n<p>Port 161 is used by the\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Simple_Network_Management_Protocol\">Simple Network Management Protocol<\/a>\u00a0which allows the threat actors to request information such as infrastructure hardware, user names, network share names, and other sensitive information that is, to the threat actor, actionable intelligence.<\/p>\n<h2 id=\"port-53-domain-name-service\"><span class=\"ez-toc-section\" id=\"Port_53_Domain_Name_Service\"><\/span>Port 53, Domain Name Service<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Threat actors need to consider the exfiltration route their malware will use to transmit data and files from within your organization to their own servers.<\/p>\n<p>Port 53 has been used as the exfiltration port of choice because traffic through the\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Domain_Name_System\">Domain Name Service<\/a>\u00a0is rarely monitored. Threat actors would loosely disguise the stolen data as DNS traffic and send it to their own fake DNS server. The phony DNS server accepted the traffic and restored the data to its original format.<\/p>\n<h2 id=\"memorable-numbers\"><span class=\"ez-toc-section\" id=\"Memorable_Numbers\"><\/span>Memorable Numbers<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some malware authors pick easy to remember sequences of numbers or repeated numbers to use as ports. Ports 234, 6789, 1111, 666, and 8888 have all been used for this. Detecting any of these odd-looking port numbers in use on your network should instigate a deeper investigation.<\/p>\n<p>Port 31337, which spells elite in\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Leet\">leet speak<\/a>, is another common port number for malware to use. It has been used by at least 30 malware variants including\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Back_Orifice\">Back Orifice<\/a>\u00a0and\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/en.wikipedia.org\/wiki\/Shellcode\">Bindshell<\/a>.<\/p>\n<h2 id=\"how-to-secure-ports\"><span class=\"ez-toc-section\" id=\"How_To_Secure_These_Ports\"><\/span>How To Secure These Ports<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>All ports should be closed unless there is a documented, reviewed, and approved business case. Do the same for exposed services. Default passwords must be changed and replaced with robust, unique passwords. If possible, two-factor authentication should be used.<\/p>\n<p>All services, protocols, firmware, and applications must still be within the manufacturers\u2019 support life-cycles, and security and bug fix patches must be available for them.<\/p>\n<p>Monitor the ports that are in use on your network and investigate any oddities or inexplicably open ports. Understand what your normal port usage looks like so that unusual behavior can be identified. Perform port scans and penetration tests.<\/p>\n<p>Close port 23 and stop using Telnet. Seriously. Just stop.<\/p>\n<p>SSH ports can be secured by using public-key authentication and two-factor authentication. Configuring your network to use a different port number for SSH traffic will help too.<\/p>\n<p>If you must use IRC make sure it is behind a firewall and require IRC users to VPN into your network to connect to use it. Allow no outside traffic to directly hit your IRC.<\/p>\n<p>Monitor and filter DNS traffic. Nothing should leave port 53 other than genuine DNS requests.<\/p>\n<p>Adopt a defense- in-depth strategy, and make your defenses multi-layered. Use host-based and network-based firewalls. Consider an intrusion detection system (IDS) such as the free and open source\u00a0Snort.<\/p>\n<p>Disable any proxies that you didn\u2019t set up or that you no longer need.<\/p>\n<p>Some SNMP return strings have plain-text default credentials in them. Disable this.<\/p>\n<p>Remove unwanted HTTP and HTTPS response headers, and turn off the banners that get included by default in the responses from some networking hardware. These needlessly give away information that only benefits the threat actors.<\/p>\n<p>\u00a0\n<\/p><\/div>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.cloudsavvyit.com\/8844\/why-are-some-ports-risky-and-how-do-you-secure-them\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#Why Are Some Network Ports Risky, And How Do You Secure Them? \u2013 CloudSavvy IT&#8221; Shutterstock\/PeterPhoto123 There\u2019s a network port for every type of traffic. Some ports are more at risk than others.\u00a0Here are the worst offenders and what you can do to secure them. Network Addressing Network and internet\u00a0Transport Control Protocol\/Internet Protocol\u00a0connections are made&#8230;<\/p>\n","protected":false},"author":1,"featured_media":149976,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.cloudsavvyit.com\/p\/uploads\/2021\/01\/93942e4b.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-149975","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/149975","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=149975"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/149975\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/149976"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=149975"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=149975"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=149975"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}