Ports & Infection Vectors

Ports are numbers that are used in TCP and UDP protocols for identification of applications. While some applications use well-known port numbers, such as 80 for HTTP, or 443 for HTTPS, some applications use dynamic ports. Open port refers to a port, on which a system is accepting communication.

Open port does not immediately mean a security issue. But, it can provide a pathway for attackers to the application listening on that port. Therefore, attackers can exploit shortcomings like weak credentials, no two-factor authentication, or even vulnerabilities in the application itself.

When open for the Internet, attackers can use open ports as an initial attack vector. Furthermore, listening ports on a local network can be used for lateral movement. It is a good practice to close ports or at least limit them to a local network. If necessary, you can make applications accessible to remote workers via a secure VPN.

Scanning tools used by both attackers and security professionals allow an automated detection of open ports. Many network-based IDS/IPS solutions, and even workstation-based endpoint security solutions can detect port scanning. It is worthwhile to investigate port scanning originating from inside the local network, as it often means a compromised device. However, computers running some security solutions can generate false positives. This is because vendors of security solutions feature a port scanner to detect vulnerable devices inside a home network.

Here are the below list of Infection vectors abusing the respective ports