Understanding Ports Used By Hackers In Cyber Attacks

In the world of cybersecurity, open ports can be a gateway for attackers if not properly secured. Hackers often scan networks for vulnerable ports to exploit weaknesses, launch attacks, and gain unauthorized access. Here are some commonly targeted ports:

Port 22 (SSH) – Brute-force attacks are common on SSH, as attackers attempt to gain access using weak credentials.
Port 23 (Telnet) – An unencrypted remote login service that is highly vulnerable to sniffing and brute-force attacks.
Port 25 (SMTP) – Often exploited for spamming and email spoofing.
Port 53 (DNS) – Can be used for DNS poisoning, amplification attacks, and tunneling.
Port 80 & 443 (HTTP/HTTPS) – Web servers are prime targets for SQL injection, cross-site scripting (XSS), and other web-based attacks.
Port 445 (SMB) – Infamous for ransomware attacks like WannaCry and EternalBlue exploits.
Port 3389 (RDP) – A favorite for attackers looking to gain remote access to systems through brute-force or credential stuffing.

You Should Know:

1. Closing Unnecessary Ports:

Use the following command to check open ports on a Linux system:
```
sudo netstat -tuln
```
To close a port, disable the associated service or use a firewall rule:
```
sudo ufw deny <port_number>
```

2. Securing SSH (Port 22):

Disable root login and use SSH keys for authentication:
```
sudo nano /etc/ssh/sshd_config
```

Set `PermitRootLogin no` and `PasswordAuthentication no`.

Restart the SSH service:
```
sudo systemctl restart sshd
```

3. Protecting SMB (Port 445):

Disable SMBv1 if not needed:
```
sudo apt-get remove samba
```
Use firewall rules to block SMB traffic:
```
sudo ufw deny 445
```

4. DNS Security (Port 53):

Use DNSSEC to prevent DNS poisoning:
```
sudo apt-get install bind9
```
Configure DNSSEC in your DNS server settings.

5. Web Server Security (Port 80 & 443):

Regularly update web server software:

sudo apt-get update && sudo apt-get upgrade

Use tools like ModSecurity to protect against SQL injection and XSS:
```
sudo apt-get install libapache2-mod-security2
```

6. RDP Security (Port 3389):

Change the default RDP port:
```
sudo nano /etc/rdp/rdp.conf
```

Modify the `port` value.

Use Network Level Authentication (NLA) for added security.

7. Firewall and IDS:

Implement a firewall using ufw:
```
sudo ufw enable
```
Set up an Intrusion Detection System (IDS) like Snort:
```
sudo apt-get install snort
```

What Undercode Say:

Securing your network ports is a fundamental step in protecting your systems from cyber threats. By closing unnecessary ports, using strong authentication methods, and regularly updating your systems, you can significantly reduce the risk of exploitation. Tools like firewalls, IDS, and DNSSEC add additional layers of security. Always stay vigilant and proactive in your cybersecurity practices to stay ahead of potential attackers.

For further reading:

References:

Reported By: Dharamveer Prasad – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Listen to this Post