02.26.01
Before we begin today, we are looking for your input to help us better provide you with the articles you want to see. So if you could take a moment to answer this one question survey to let us know what operating system your network is running on, we will take the results into consideration in future issues. Thanks in advance for your help.

Click here to take the poll.

Many machines on the internet are left wide open, leading to problems we might otherwise avoid, not only for the owner of that machine but for everyone who accesses the internet. In this article, we look at security issues relating to some common TCP/IP ports and how they are often times left exposed by default. In order to stop a hacker we need to think like a hacker, so lets get to it!!

Any questions/comments can be directed to myself:

Jay Fougere
NetworkNewz Editor

First of all let's look at ports and what they are. When two machines across a TCP/IP network communicate with each other via a service (such as NetBIOS, HTTP, FTP, etc...) each machine will need to know not only the IP address but the port number that translates to the service that is being used. For instance, when someone is "surfing the web" the service that they will be using will be HTTP (hyper-text transfer protocol), which uses port number 80 by default.

Most port numbers can be changed so that vulnerable services can be disguised by using a non-standard port number. For instance, if you knew that certain software exposed a vulnerability in a service, you could try to change the port number in order to circumvent that weakness. However, you would need to be sure all machines on the network are configured as such in order to continue using the service.

Unfortunately, a hacker will likely have a port scanner and will be able to see which services are being run on which ports even if you change the port number. In other words, simply changing a port number will not hide the susceptible service. Additionally, you may create connectivity problems by using these non-standard ports. In general, it is considered to be poor practice to change default ports unless you have a good reason to do so. A better solution would be to determine which services are necessary to keep your network up and running and then uninstall all services that you are not using and close all ports associated with these unused services.

Let's suppose you are setting up a web server on a Windows NT/2000 Server based machine. By default, Windows will install NetBEUI (NetBIOS Extended User Interface), which is a non-routable protocol and unnecessary for your web server to perform its duties. NetBIOS is also at risk for Denial of Service attacks, which may or may not hurt your data but will prevent your server from perfoming its job (i.e. web serving). Another point to consider, some ports that show up in a port scan can identify the operating system of the machine that is being scanned. NetBIOS, which operates on ports 137-139, is a good example of this. Most Unix/Linux boxes don't use NetBIOS, and are not going to be using ports 137-139. When a hacker sees these ports open he has a good idea that the operating system being used is Windows, and thus knows which tools to use for his attack. In summary, if you do not use it, uninstall it.

Once you have disabled all unused ports, you will need to take a closer look at the ports that you have left. You may be able to further lock down these open ports and services by using IP filtering and by configuring remaining services appropriately. For example, if you must use FTP, do not allow anonymous FTP traffic unless you are fully aware of the security risks. I cannot imagine a situation when an anonymous user should ever have FTP write access on a machine. If someone is sharing files with you, helping you with your web site, or needs the ability to upload to your machine for any reason, give them an account on the server. It is too easy for someone to upload malicious software to your machine otherwise.