why can't hackers attack via well known ports that are open by necessity?

[BlahBlahYouToo]

you're supposed to keep as few ports open as possible to prevent intrusion through those ports.
but at the same time, you need to keep certain ports open for various services.
so whats the difference between attacking an open port 80 and an open port 65535?

 

[TruePaige]

They do. It's called Internet Explorer Exploits and that's where spyware comes in. =p

I jest, but in all seriousness, outgoing and incoming connections are handled much differently.

Basically for port 80 (or 8080 as the case may be) for most things YOU initiate the connection, random people don't just connect to you.

With many new firewalls as well, you set initiating applications that can pierce through the wall, but not leave ports open.

 

[BlahBlahYouToo]

Originally posted by: TruePaige
They do. It's called Internet Explorer Exploits and that's where spyware comes in. =p

I jest, but in all seriousness, outgoing and incoming connections are handled much differently.

Basically for port 80 (or 8080 as the case may be) for most things YOU initiate the connection, random people don't just connect to you.

With many new firewalls as well, you set initiating applications that can pierce through the wall, but not leave ports open.

i was speaking from the server side.
client initiates the connection with the server's open port 80, right?

 

[DaveSimmons]

You close applications listening to ports, like PING responders, DNS and print servers, etc.

If a port is open on a server, it means some application is listening to the traffic on that port. You have to hack that application not "the server."

If Apache is running port 80, you must find some hack into Apache and modules it runs like PHP. You can't directly hack the DNS server through port 80, it isn't listening.

 

[QED]

Originally posted by: DaveSimmons
You close applications listening to ports, like PING responders, DNS and print servers, etc.

If a port is open on a server, it means some application is listening to the traffic on that port. You have to hack that application not "the server."

If Apache is running port 80, you must find some hack into Apache and modules it runs like PHP. You can't directly hack the DNS server through port 80, it isn't listening.

Exactly.

You are not "disabling" a port--- you are disabling an application listening on that port.

The lesser-used ports tend to be used by applications that are not updated as frequently as the more common network apps, and therefore have higher odds that they are vulnerable to some form of remote attack.

 

[jagec]

Because hacking isn't as simple as IM IN UR SURVUR, HACKING UR GIBSON.

 

[flxnimprtmscl]

Originally posted by: jagec
Because hacking isn't as simple as IM IN UR SURVUR, HACKING UR GIBSON.

Exactly. It's actually like IM IN UR SURVUR STEALING JOUR MEG@HURTZ LOL LOL LOL, which a much more difficult exercise.

 

[jagec]

Originally posted by: flxnimprtmscl

Originally posted by: jagec
Because hacking isn't as simple as IM IN UR SURVUR, HACKING UR GIBSON.

Exactly. It's actually like IM IN UR SURVUR STEALING JOUR MEG@HURTZ LOL LOL LOL, which a much more difficult exercise.

Very true. The internet is serious business!

 

[hiromizu]

Originally posted by: jagec
Because hacking isn't as simple as IM IN UR SURVUR, HACKING UR GIBSON.

Yes it is, my friend says so and does it all the time. He's a major hacker of the Gibson.

 

[gsellis]

Originally posted by: hiromizu

Originally posted by: jagec
Because hacking isn't as simple as IM IN UR SURVUR, HACKING UR GIBSON.

Yes it is, my friend says so and does it all the time. He's a major hacker of the Gibson.

I am switching to Fenders then.

 

[Skeeedunt]

LOL this thread got moved to security.

 

[Evadman]

Originally posted by: Skeeedunt
LOL this thread got moved to security.

cause that's where it should be

 

[degibson]

Server applications, including those running on your desktop machine, bind to ports. That, in effect, "opens" the port on a particular machine. Once an application has bound to a port, it can communicate with the outside world via outgoing connections (like Firefox, for instance) or incoming connections (like Apache). The latter type is often the troublesome one, because a hacker can initiate an incoming connection whenever he likes.

Lets say you run Apache, on port 80 (80 is the standard for web servers). Now, if Apache has a bug (and Apache has LOTS of bugs), then those bugs might make apache itself a vulnerability. One common attack is a buffer overrun, in which a malicious hacker convinces apache to accept some code, then fools apache into executing it. The point is, it is the application that has the vulnerability, not the port itself.

So why run on a well known port, like 80? The only thing holding the web together is the assumption that web servers bind to port 80! (or 8080 for https). 80 is a 'well-known' port for HTTP. '22' is for secure sockets. '25' is SMTP, if I remember correctly. There are others. If you're interested, check out http://www.iana.org/assignments/port-numbers

So here is the difference between attacking port 80 and port 65535:
80 is a very commonly used port, and you're very likely to find either Apache or Windows Server there -- both of which are widely used and have widely-known exploits.
65535 is in the 'unassigned' range -- usually it is only used for outgoing connections, and it is pretty unlikely you'll find something easy to exploit.

 

[spidey07]

One quick correction - it's common to sense/know that a web server is running on a port, no matter what the port based on the response. Other types of application finger printing are available as well. Step one - find open ports, step two - find out what apps are running on those ports, step 3 - use known exploits.

 

[degibson]

Security isn't about being invulnerable -- its about being less vulnerable than someone else. Chances are, if a hacker doesn't care /who/ he targets, he'll go for the low-hanging fruit. After all, anyone with sufficient determination will probably succeed, eventually.

Its not that invulnerable systems can't be made -- its just that nobody has certifiably demonstrated one.

 

[SecPro]

Originally posted by: degibson
Security isn't about being invulnerable -- its about being less vulnerable than someone else. Chances are, if a hacker doesn't care /who/ he targets, he'll go for the low-hanging fruit. After all, anyone with sufficient determination will probably succeed, eventually.

Its not that invulnerable systems can't be made -- its just that nobody has certifiably demonstrated one.

What? That's the worst security philosophy I've ever seen articulated. Security is about 1. Identifying what is valuable (can only be done by the owner). 2. Identifying the threat to what is valuable. and 3. Putting protection in place to mitigate the threat to an acceptable level. It doesn't matter one little bit what the guy next door, down the street or around the world is doing to protect his property, you should be doing what you need to do to protect yours.

 

[degibson]

Originally posted by: SecPro

Originally posted by: degibson
Security isn't about being invulnerable -- its about being less vulnerable than someone else. Chances are, if a hacker doesn't care /who/ he targets, he'll go for the low-hanging fruit. After all, anyone with sufficient determination will probably succeed, eventually.

Its not that invulnerable systems can't be made -- its just that nobody has certifiably demonstrated one.

What? That's the worst security philosophy I've ever seen articulated. Security is about 1. Identifying what is valuable (can only be done by the owner). 2. Identifying the threat to what is valuable. and 3. Putting protection in place to mitigate the threat to an acceptable level. It doesn't matter one little bit what the guy next door, down the street or around the world is doing to protect his property, you should be doing what you need to do to protect yours.

Our philosophies are not incompatible. "Mitigate(ing) the threat to an acceptable level" was precisely my point. I referenced the guy next door because often attackers don't particularly care who their targets are.