You've probably opened ports on your router on more than one occasion, maybe for remote access, maybe for a game.And although opening ports isn't necessarily the safest thing to do, many people treat it as something super harmless, because hey, how's anyone going to find that one port? Unfortunately, the internet doesn't work that way.Security researchers have watched brand new internet-facing services receive their first attack attempts in less than a minute, and you don't need to be a high-profile target for this to happen to you.
Hackers can find an open port in less than a minute Sometimes, it really is that fast Close You'd think that hackers probably don't care about your port in particular, but that doesn't erase the fact that they can find it really quickly.One of the most striking examples is Sophos's honeypot experiment.Sophos set up SSH (Secure Shell) honeypots in 10 AWS (Amazon Web Services) regions around the world and waited for someone to knock on the door.
It only took 52 seconds after the server went online for the first login attempt to show up from a location in São Paulo.Even the slowest honeypot, located in Ireland, made it just under two hours before the first login attempt popped up: It took one hour and 44 minutes.It wasn't just that one scanner that stumbled upon every server and disappeared.
After setting up the honeypots, Sophos recorded an average of about 13 login attempts per minute on each, which means over five million attack attempts over the 30-day testing period.Can I just say, oof.The most interesting bit (to me at least), is that these servers weren't advertised, linked to, or even given DNS names.
They should've been as stealthy as can be without going the extra mile, but nope.According to Sophos, attackers found them simply because the services were accessible from the public internet.This doesn't mean that the moment you open a port, you can expect hackers to come knocking on your virtual door in one minute or less.
These were SSH login attempts to the honeypots, and the time it takes to detect a specific port can vary.But the test shows that stealth cannot be relied on to protect a vulnerable service, and if you forward a port to something on your home network, you should probably just assume that automated scanners will stumble upon it sooner or later.Related Stop using your router's default settings (change these 3 things immediately) I left my router on default settings for years—here’s why you should change yours today Posts 17 By Patrick Campanale Internet-wide scanning makes finding your port surprisingly easy Nobody needs to know your IP address first Finding an exposed service doesn't mean that someone needs to know your exact IP address, unfortunately.
Network scanners spend their time scanning public IPv4 addresses and checking whether a specific port is accessible.Tools like ZMap are specifically designed for this, actually, and ZMap was able to scan the entire public IPv4 address space for a single port in under 45 minutes.This was done with just one PC with a gigabit Ethernet connection.
A scanner on the prowl for something like SSH doesn't necessarily need to test all 65,535 ports on every IP address.It just needs to scan port 22 across large IP ranges, and then dig deeper into the systems that actually respond.Broader scanning is more than feasible, too.
Censys says it scans the IPv4 internet and performs discovery across all 65,535 ports.But this is a legitimate security platform, so that's not an issue.However, it does serve to prove that a hacking operation can do the same thing.
Finding your open port doesn't mean you're getting hacked Discovery is only the first step I'm not here to start a panic, though, so let's make one thing clear: finding a port doesn't equal you getting hacked.Similarly, using a weak Wi-Fi password doesn't necessarily mean someone's going to exploit that fact ...but that doesn't mean you should just shrug and leave it alone.
Still, the distinction between an open port and actually getting hacked was made clear by Palo Alto Networks' Unit 42.This was demonstrated with 320 honeypots running SSH, PostgreSQL, RDP, and Samba.They were made to be pretty hackable, with weak credentials that'd make it easier for attackers to actually get in, but Unit 42 measured an average time to first compromise of 184 minutes for SSH, 511 minutes for PostgreSQL, 667 minutes for RDP, and a whopping 2,485 minutes for Samba.
Long story short, scanners may have exposed the service almost immediately, but the actual hack took way longer.Unit 42 also found that 80% of its 320 honeypots were compromised within the first 24 hours, and every single one gave way within a week.One particularly aggressive attacker even compromised 96% of the 80 PostgreSQL honeypots in just 30 seconds.
What's the lesson here? Caution, as is usually the case where networking is concerned.Treat every port you forward as publicly discoverable Secure it before you expose it I've talked about port forwarding a fair bit here at How-To Geek, including why you shouldn't use it on your home server.I stand by it.
The only way to be sure your port's not going to be discovered is to not make it publicly discoverable.Sure, doing this doesn't automatically mean it's not safe, but it does mean you should sort out some security basics before exposing the port.Install updates, use strong authentication, disable default credentials, and get rid of old forwarding rules the moment you don't need them and not in three years' time.
If it's open, assume it's visible All those honeypot tests make one thing clear: No one needs to specifically target you in order to find your open port.It might take mere seconds for someone to find it automatically, and you won't even know unless things go south.The best solution is to assume that every public port will be found sooner or later.
Read More
