Many individuals have experience with opening ports on their routers for various reasons, such as remote accessibility or online gaming. Commonly, this action is perceived as harmless, as the assumption is that a hidden port won’t attract attention. However, this perspective can lead to oversights in internet security.
Security Risks: Open Ports are Easy Targets
Finding Vulnerable Ports is Quick
It might seem that hackers wouldn’t be interested in your specific open port, but they can discover it in no time. A noteworthy example comes from Sophos, which conducted an experiment deploying Secure Shell (SSH) servers as honeypots across ten Amazon Web Services (AWS) regions globally. They monitored for login attempts once these services became accessible.
Remarkably, just 52 seconds after activation, the first login attempt originated from São Paulo. Even the slowest-performing honeypot, located in Ireland, received its first try in just under two hours—specifically, one hour and 44 minutes. Not only that, Sophos documented around 13 login attempts per minute, cumulating over five million attack attempts throughout the month-long test.
Perhaps the most surprising aspect was that these servers were both unlisted and unadvertised, providing a layer of anonymity. However, their mere exposure to the public internet was enough for attackers to locate them.
It’s crucial to note that while these servers experienced login attempts shortly after going online, this doesn’t imply that every port you open will face an immediate attack. The experiment illustrates that being discreet doesn’t guarantee protection for an exposed service. As a result, if you choose to forward a port, it’s prudent to assume that automated scripts may eventually find it.
The Ease of Internet-wide Scanning
No IP Address Required
Shockingly, finding an open service doesn’t necessitate knowledge of your specific IP address. Network scanners can quickly probe public IPv4 addresses to identify accessible ports. For instance, a tool named ZMap can scan the entire IPv4 address landscape for a specific port in under 45 minutes using just a single computer connected to a gigabit ethernet network.
Scanners aiming for SSH don’t have to check all 65,535 ports for each address. They simply focus on port 22 across extensive IP ranges and dive deeper into systems that respond. Legitimate scanners, like Censys, actively scan all public addresses and report findings, underscoring the potential ease of similar operations being carried out with malicious intent.
Discovery Does Not Equate to Being Hacked
Initial Detection is Just the Beginning
It’s important to clarify that the discovery of a port does not instantly equate to being hacked. For example, while weak Wi-Fi passwords signal vulnerability, they don’t guarantee exploitation. According to research by Palo Alto Networks’ Unit 42, which assessed 320 vulnerable honeypots using various services, initial compromises did not happen instantly despite the rapid detection of these ports. The average time for an SSH compromise was around 184 minutes, whereas PostgreSQL took over eight hours.
While 80% of the honeypots were compromised within 24 hours, not all attacks were swift. Some attempts took a substantial time to materialize, highlighting the urgency of securing networks appropriately.
Manage Your Port Forwarding with Care
Secure Services Before They Go Live
When discussing port forwarding, I often suggest avoiding it on personal servers due to security concerns. If you must forward a port, consider it as publicly discoverable, and strengthen security beforehand. Update your software, enforce robust authentication practices, disable default credentials, and promptly remove unnecessary forwarding rules.
If it’s Open, Assume it’s Visible
The findings from honeypot studies emphasize that you might not be the specific target of hackers, yet they can identify open ports incredibly rapidly. It’s wise to presume that any public-facing port will eventually be discovered. This proactive mindset is your best defense against potential intrusions.
