I'm s server-side developer and used to invoke the nc command to check whether a remote port is open.

Suddenly, the security guy prohibited the command and as soon as I use the nc command my accessibility to the EC instance get lost.

They're saying

Use telnet.

My questions are

  • Is the nc command dangerous?
  • Has any security hole?
  • Has any functionality can be used in any dangerous way?
  • I'm fairly certain telnet sends credentials in plain text. So if this is all on a local segmented network and no possibility of your traffic being sniffed you should be fine. If you working outside of a local network, ssh is a safer substitution for accessing remote machines. – pemby Jul 17 '19 at 2:38

The specific difference between netcat and telnet is:

  1. nc has the ability to act as a server (listen for connections),
  2. most nc variants have an option that links the socket to another program's input/output.

Both are quite legitimate features, but combined together they're also commonly used by malware as a convenient tool to bring up shell access without any authentication. That is, as soon as someone figures out a hole that lets them run one command e.g. through your website, they'll almost always use it to run nc -e to get a fully featured interactive shell.

So the issue is not about security holes within netcat (indeed, netcat doesn't even perform any processing on the data it receives, whereas Telnet clients do); it's more about making it slightly more difficult to abuse security holes elsewhere.

(Note: There are several netcat tools that have similar names and options but come from different sources. The original netcat, GNU netcat, Nmap ncat all have the -e option, meanwhile openbsd-netcat does not.)

I think the restriction is somewhat silly, but imposing it without any explanation, with just a rude error message, is even more so.

  • So can we assume that because the openbsd-netcat variant does not include the nc -e command that it may be safer to use in this case? – Yokai Sep 11 '20 at 5:19

Netcat is not dangerous "per se".

Usually security areas recommend not to include any advanced diagnostic tool that may allow an attacker with access to console to get additional information from the network where the vulnerable server is attached. This includes netcat, nmap, etc.

So, to answer your question: yes, it can be harmful if an attacker has access to a vulnerable server that includes this tools, because it can be used to sneach into the remaining hosts in the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.