Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Here's something that has always baffled me. Why is it bad to have open ports on your computer? Assuming you don't have a virus on your computer or some other program listening to a port that may actually do something why does it matter if a port is open? If some malicious person starts sending packets to a port, but nothing is there to receive the data and do something with it why does it matter? A computer doesn't just arbitrarly execute any data it receives. I understand flooding a computer with packets could cause it to crash because it just can't deal with the amount of data, but I'm only considering security issues that actually change the files on the computer.

Update

Thanks for the replies so far. I understand now, that a port being open actually means there is a program that can be exploited listening on that port. But why is it so hard to write software that can't be exploited? To do any real harm to a computer wouldn't a program have to allow one or more files to be uploaded, and then one of those files would need to be executed. It seems like that would be incredibly hard to allow accidentally.

share|improve this question

7 Answers 7

up vote 26 down vote accepted

A port isn't open if something isn't listening for a connection on it.

The reason it is bad form to have all ports open to everywhere is that it exposes those services that are listening on those ports to exploits. That is why firewalls exist, to limit what is allowed to connect to certain ports, to reduce the surface area exposed by services.


EDIT

To address your question about why people can't just write software that isn't exploitable:

This is fairly easy for simple programs, but many programs that require a socket are complex. As such, they have many components, many of which aren't even written by the developer most likely (included libraries). You cannot rely on other people to keep your network secure when there are hardening methods you can use yourself, such as firewalls.

Arbitrary/remote code execution is a huge risk, as you have pointed out. Unfortunately buffer overflows and other security flaws that allow it are common. Look at any Microsoft security update and I'll bet it patches either remote code execution or elevation of privileges, and MS is a huge company with hundreds of developers and billions of dollars.

share|improve this answer
4  
Just adding: If you for example know that a service has a bug which can be used to infiltrate code or whatever and you actually see that this service is running, this is an open invitation ;) –  Felix Dec 13 '09 at 0:32
1  
best answer posted so far. –  DaveParillo Dec 13 '09 at 3:53

Actually as far as I know, an open port means that a program is listening to it. So there is some kind of service processing the data.

share|improve this answer

Regarding the update you wrote:

Thanks for the replies so far. I understand now, that a port being open actually means there is a program that can be exploited listening on that port. But why is it so hard to write software that can't be exploited? To do any real harm to a computer wouldn't a program have to allow one or more files to be uploaded, and then one of those files would need to be executed. It seems like that would be incredibly hard to allow accidentally.

It's very difficult to write software that can't be exploited!

I have read the book Building Secure Software and one things it discussed was exploiting stack overflows. There were two very scary facts in there:

  • For a program to have an exploitable stack overflow bug is very easy to do, especially when the program is written in C. In the C programming language, many functions are not safe by default and the programmer either needs to know to avoid the vulnerable functions, or has to take special actions to be safe.
  • The exploit a hacker needs to use is short - very short. It was less than half a page of assembly language, which translates to 100 or so (guess) bytes of machine code. This exploit code is sufficient to give the hacker shell(command prompt) access to your machine. No big file upload and execution required - just a tiny piece of code that can be inserted into the middle of legitimate data.

So if a hacker can find a program that (a) has a stack overflow bug that is (b) exploitable over a network and (c) has a couple 100 bytes spare in its buffer, then your computer is pwned. Fortunately knowledge about stack overflow bugs is fairly common knowledge now, but they do still pop up. 5 years ago and longer this was a much more frequent problem.

Going back to your original question, you should avoid open ports to avoid any accident with an exploitable bug in a program. You now have a second reason: the remote shell that a hacker would then use is another open port. If you have a firewall that is blocking everything except that you have specifically allowed, you would also block that remote shell (although a hacker would still be able to do other nasty things to your computer, so don't be complacent!)

share|improve this answer
2  
IIRC, Donald Knuth(?) just finished mathematically proving that one of the smaller programs he wrote was bug-free, and it took man-years –  RCIX Dec 14 '09 at 10:27

Assuming you don't have a virus on your computer or some other program listening to a port that may actually do something why does it matter if a port is open? If some malicious person starts sending packets to a port, but nothing is there to receive the data and do something with it why does it matter?

Assumption is the mother of all eff-ups :)

rather safe than sorry ... here's nice read for you at makeuseof.com:

Technology Explained: Open Router Ports & Their Security Implications

share|improve this answer
    
a good, short read. –  DaveParillo Dec 13 '09 at 3:50
  • Open port: When anyone asks, the computer responds that there is a service listening on this port. This means anything coming to this port will get processed by a program (a service) running on that computer.
  • Closed port: When anyone asks, the computer responds that there are no services listening on that port. The akser will know there is a computer responding at the address.
  • Stealth port: When anyone asks, they get no reply. The point is to hide if there is a computer at the address at all. It might not be very effective, though, as joschi poits out in the comments.

If you have an open port, you are safe provided the program processing the incoming stuff has no available exploits. But exploits are found all the time, and it's good to know that there are a lot of port scans travelling around the net, looking for targets.

Closed ports still respond to the akser, so possible attacker knows to proceed checking other ports. Then again, this is how the internet is specificed to work. While stealth ports attempt to not give the potential attacker any information, in theory they break the specification.

From a security point of view, any open port is a huge gaping hole, since code is being used to process foreign data. What a firewall (or a NAT router) does is make sure no incoming traffic gets to your computer, even if the system has some open ports. This way, they effectively close all ports.

share|improve this answer
    
Your definition of a "stealth port" is wishful thinking. Actually an attacker knows that there is a computer if he doesn't receive any answer. If there was no computer on that particular IP address, the preceeding router would send a message about that. With "stealth ports" that does not happen... –  joschi Dec 13 '09 at 12:28
    
@joschi: Well, it's a concept that I've seen around the internet, so I think it's good to define it. You make a good point, though. I edited the answer to reflect your comment. At least it makes the target IP look like it's behind a NAT router, I guess. I've never been a fan of the concept myself: If you have open ports, you should make sure they're running a secure service. And if you have no open ports, there's no problem telling the net that you exist. Stealth smells like security hype to me. –  Ilari Kajaste Dec 13 '09 at 13:38
    
joschi: not all routers do that. many routers simply forward blindly to IP addresses where there is no system. connection attempts time out simply because the client gets bored of trying to do a three way handsake. –  benc Dec 14 '09 at 7:04

I'm no security export, but I did a little research... An "open" port is a port that is set up to accept an incoming TCP connection.

If you have apps listening only on ports 9, 21, and 80, and your firewall blocks access to those three ports, you technically have no ports open. IOW, port 25, for instance, is not open because nothing is listening on it.

To answer your question: The reason it is bad to have open ports on your computer is because these ports can easily be discovered, and once discovered these ports are now susceptible to vulnerabilities of the listening applications.

share|improve this answer
    
Your definition of what a port is, is incorrect. A port isn't limited to TCP by any means. –  MDMarra Dec 13 '09 at 0:44
1  
I suppose one should not believe EVERYTHING they read on the 'net :) 5 of the top 6 Google results explicitly state "TCP" in their definition. google.com/… –  Shoeless Dec 13 '09 at 0:54
    
No, they say TCP/IP. Big difference. TCP/IP includes UDP –  MDMarra Dec 13 '09 at 1:00
1  
ICMP doesn't use a port, it is a layer 3 protocol that is included in the IP suite of protocols. –  MDMarra Dec 13 '09 at 1:59
1  
The only reason that I say it is that it is very important in reference to firewalls (which this is indirectly about). TCP is stateful, and thus connections are remembered, where UDP is not. Many times this means ports must be open for return UDP traffic which is initiated internally where this does not need to happen for TCP connections that are established internally. –  MDMarra Dec 13 '09 at 4:13

For the same reason that you close and lock your doors and windows at home.

share|improve this answer
2  
i lock my doors & windows 'cause it's cold outside. what does this question have to do with insulation? –  quack quixote Dec 13 '09 at 3:36
2  
Do your doors and windows not insulate if they are only closed? Does the extra bolt really provide that much more insulation. –  Dentrasi Dec 13 '09 at 22:32
    
Good point, but it's worth noting that not everyone locks their doors and windows at home. This could be "Not everyone wants to protect their property" or "Not everyone likes to live in a culture of fear", depending on your viewpoint. –  Ilari Kajaste Dec 14 '09 at 9:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.