Common incoming TCP/UDP hacker scans against your firewall

A common DoS attack is an echo-loop, where the
attacker forges a UDP from one machine and sends it to the other, then
both machines bounce packets off each other as fast as they can (see
also chargen).
[CA-96.01]

Another common thing seen is TCP connections to this port by DoubleClick. They
use a product called “Resonate Global Dispatch” that connects to this
port on DNS servers in order to locate the closest one.

Harvest/squid caches will send tbese UDP echoes from port 3130. To quote their document:
If the cache is configured with source_ping on, it also bounces a
HIT reply off the original host’s UDP echo port. It can generate a lot
of these packets.

Some people come here looking for ICMP port 11. To repeat: firewall logs are confusing, ICMP doesn’t have
ports; if you see something that says “ICMP port 11”, you probably
want ICMP type=11.

In early 2003, I occasionally see people trying to exploit the FTP server using
a wide sprectrum of vulnerabilities. For example, I see them try several kinds
of buffer-overflows.

*2020 – We have seen numerous port scans including Decoy Scans

In 2002, numerous vulnerabilities in most all versions were discovered, exploited, and routinely scanned for.
Many security professionals had their boxes compromised through SSH — in many cases, SSH was the only service
they had remotely reachable.

Also note that the ssh package comes with a program called
make-ssh-known-hosts that will scan a domain for ssh
hosts. You will sometimes be scanned from innocent people running this utility.

UDP (rather than TCP) packets directed at this port along with
port 5632 indicate a scan for pcAnywhere. The number
5632 is (hex) 0x1600, which byte-swapped is 0x0016, which is 22 decimal.

[CA-2002-36]
[CA-2002-18]
[CA-2001-35]
[CA-1999-15]

The most common use by scanners is to get the banner
that prompts the user for a login name. The banner tells a lot about system — often the attacker isn’t interested
in actually exploiting Telnet as to figure out more about the system when attacking other ports.

As of 2002, most attackers are interested in finding network equipment such as switches and routers, especially
Cisco equipment. When my honeypot gives them a command prompt, they spend more time trying out Cisco commands
than they do things like “uname” to figure out what system they are running on.

Historically (and still common as of 2002), hackers look for Unix systems with default
accounts. They will try a series of logon names and empty passwords. Since Unix systems
have largely fixed this problem of default accounts, this has become a less popular attack.

Scans against this port are almost certain coming from spammers (and occasionally anti-spammers)
looking for “open relays”. An open relay is a mail server that will accept e-mail from anyone
and forward it on. This allows the spammer to hide behind the relay, as well as take advantage
of the fact that they can submit one e-mail with 20 recipients — and the relay will do the job
of sending copies to each recipient. This lowers the spammer’s bandwidth costs.

Note that there continue to be vulnerabilities in mail servers themselves.

Ways of breaking into DNS servers are frequently discovered, such as the BIND exploit in 2002.
The BIND (Berkeley Internet Name Daemon) is the most popular DNS server. Many UDP packets you see
rejected by the firewall are looking for the name “version.bind”, which will tell the hacker
what version of BIND you are (hopefully) running, and therefore which exploits they can run to
break into your service. If you put a vulnerable version of BIND on the Internet, it will likely
be compromised in a few days.

DNS information tells the hacker a lot of about the intended victim. Rejected TCP attempts probably
reflect a desire by the hacker to do a “zone transfer”, which will list all the computers in your
domain. Victims often name systems in ways that help hackers figure out what is going on, such
as “cisco-rtr.example.com” or “payroll.example.com”.

Since DNS is such an important protocol to the Internet, firewall administrators often allow
port 53 when they shouldn’t. They sacrifice security in order to get ease-of-use and
reliability. This allows hackers to use port 53 for protocols other than DNS.
An important thing to note is that you will frequently see port 53
used as the source UDP port. Stateless firewalls frequently allow such
traffic on the assumption that it is a response to a DNS query. Hackers are
increasingly exploiting this to pierce firewalls.

Firewalls will see (and reject) a lot of DHCP requests from your local network.
This is an interesting problem with cable and DSL modems, because they create “virtual”
local networks including people in your nearby physical neighborhood.
You can identify these local requests because they are not sent to you, but are
are instead to what’s called the “local broadcast” address: 255.255.255.255
These machines are asking to for an address assignment from a DHCP server. You could probably
hack into them by giving them such an assignment and specifying yourself as
the local router, then execute a wide range of
man-in-the-middle
attacks. The client requests configuration on a broadcast to port 68 (bootps). The
server broadcasts back the response to port 67 (bootpc). The response
uses some type of broadcast because the client doesn’t yet have an IP address
that can be sent to.

You rarely see attackers from remote parts of the Internet trying to exploit DHCP vulnerabilities.

As of 2003, an important exploit has been found in a DHCP service, so remote hackers may
start scanning for this. [CA-2003-01]

• discover user information
• fingerprint the operating system
• exploit known buffer-overflow bugs
• bounce finger scans through your machine to other machines.

*2020 – We have seen numerous port scans including Decoy Scans

*2020 – We have seen numerous port scans including Decoy Scans

Note that by putting a logging daemon, IDS, or sniffer on the wire,
you can find out what programs the intruder is attempting to access
in order to figure out exactly what is going on.

Microsoft runs its DCE RPC end-point mapper for its DCOM services at this port.
This has much the same functionality as port 111 for UNIX
systems. Services that use DCOM and/or RPC register their location with
the end-point mapper on the machine. When clients remotely connect to
the machine, they query the end-point mapper to find out where the service
is. Likewise, hackers can scan the machine on this port in order to find out
such things as “is Exchange Server running on this machine, and which version?”.

This port is often hit in order to scan for services (for example, using
the “epdump” utility), but this port may also be attacked directly. Currently,
there are a few denial-of-service attacks that can be directed at this port.

No RPC service except the endpoint mapper runs on this port, except that “broadcast”
messages intended for other RPC services can be forwarded through this port.

2000

Attempts on this port were common at the beginning of 1999, but tapered off near
the end. Now at the start of year 2000, attempts on this port have picked up again.
Several VBS (IE5 VisualBasic Scripting) worms have appeared that attempt to copy
themselves on this port. Therefore, it may be worms attempting to
propagate on this port.

2001

In late 2001 and early 2002, the Nimda worm would share the C$ drive when it
infected a machine. Many attempts against this port are from people scanning
for drives left open by Nimda.

2002

In late 2002, the ALEVIR worm is propagating heavily throughout the Internet
infecting Win95/Win98/WinMe machines. These have a bug that allows a hacker
to connect to a password-protected share by using only the first character
of a password, which is easy to guess. Most connection attempts to port 139
are from this worm.

* 2020 Window 10 still uses this port.

This port is also used for IMAP2,
but that version wasn’t very popular.

Several people have noted attacks from port 0 to port 143, which appears
to be from some attack script.

SNMP packets may be mistakenly directed at your network. Windows machines running
HP JetDirect remote management software uses SNMP, and misconfigured
machines are frequent. HP OBJECT IDENTIFIERs will be seen in the packets.
Newer versions of Win98 will use SNMP for name resolution; you will see
packets broadcast on local subnets (cable modem, DSL) looking up sysName
and other info.

In early 2002, a university in Finland released its “PROTOS” tool that demonstrated many
flaws in popular SNMP implementations. These flaws had been known for more than a decade,
but this was the first time security implications were shown for these flaws.

This port is used for secure web browser communication. Data transferred across such connections are highly resistant to eavesdropping and interception. Moreover, the identity of the remotely connected server can be verified with significant confidence. Web servers offering to accept and establish secure connections listen on this port for connections from web browsers desiring strong communication security.

Once established, web browsers inform their users of these secured connections by displaying an icon — a padlock, an unbroken key, etc. — in the status region of their window

* 2020 We have seen numerous port scans including Decoy Scans

In Windows 2000, Windows XP, Windows 7, Windows 8, and Windows 10 port 445 is essentially a duplicate of port 139. These ports
are used for Micrsoft’s file and printer sharing, remote registry access, named pipes services,
and many MS-RPC services. The difference is that port 139 supports these services on top of NetBIOS,
whereas port 445 gets rid of this middleman, supporting these services directly over TCP/IP.

Whereas many ISPs now filter port 139, many do not filter port 445. As of mid-2002, we are
seeing more scans for port 445 as hackers learn to get around port 139 filters. In late 2002,
we are seeing worms propogate via this port.

As of late 2002, this is one of the more common ports probed, both because of Linux
worms propogating, but also from hackers looking for well-know vulnerabilities.

Some script kiddies feel they’re contributing substantially
to the exploit programs by making a minor change from ingreslock to pcserver
in constant text.

In the year 2000, much activity on this port was for the purpose of connecting to
IRC chatrooms. Usually the goal was DoS the chatroom. For this reason,
most IRC servers will not scan your machine for SOCKS out of self-defense: they want to make sure
that you are a legitimate user and now somebody who left the SOCKS service running that a hacker
is tunneling through.

In the year 2003, most of this activity is now by spammers. They are looking for SOCKS
servers in order to funnel spam through. This hides the original source of the spam.

There are several websites that maintain lists of open SOCKS servers. In 2002, most of the scans
I see were from people who maintain these lists.

*We have seen numerous port scans including Decoy Scans

In the year 2002, several worms started exploiting this port.

2020 *We have seen numerous port scans including Decoy Scans
– SQL injection attempts

On January 26, 2003, the SQLslammer worm took down parts of the Internet in the early

hours of the morning. It took advantage of a buffer overflow on this service. Administrators
quickly respond by widely configuring packet filters throughout the Internet, so by the time
many people woke up in the morning in the U.S., much of the problem had gone away.

Also used as a backdoor port left behind by exploit scripts, such as those
in the Ramen worm. While some scans for this port may be due to SubSeven,
others may be looking for a remote shell.