2

I'm s server-side developer and used to invoke the nc command to check whether a remote port is open.

Suddenly, the security guy prohibited the command and as soon as I use the nc command my accessibility to the EC instance get lost.

They're saying

Use telnet.

My questions are

  • Is the nc command dangerous?
  • Has any security hole?
  • Has any functionality can be used in any dangerous way?
Improve this question
1
  • I'm fairly certain telnet sends credentials in plain text. So if this is all on a local segmented network and no possibility of your traffic being sniffed you should be fine. If you working outside of a local network, ssh is a safer substitution for accessing remote machines.
    – CupCakeThief
    Jul 17, 2019 at 2:38

2 Answers 2

Reset to default
7

The specific difference between netcat and telnet is:

  1. nc has the ability to act as a server (listen for connections),
  2. most nc variants have an option that links the socket to another program's input/output.

Both are quite legitimate features, but combined together they're also commonly used by malware as a convenient tool to bring up shell access without any authentication. That is, as soon as someone figures out a hole that lets them run one command e.g. through your website, they'll almost always use it to run nc -e to get a fully featured interactive shell.

So the issue is not about security holes within netcat (indeed, netcat doesn't even perform any processing on the data it receives, whereas Telnet clients do); it's more about making it slightly more difficult to abuse security holes elsewhere.

(Note: There are several netcat tools that have similar names and options but come from different sources. The original netcat, GNU netcat, Nmap ncat all have the -e option, meanwhile openbsd-netcat does not.)

I think the restriction is somewhat silly, but imposing it without any explanation, with just a rude error message, is even more so.

Improve this answer
1
  • So can we assume that because the openbsd-netcat variant does not include the nc -e command that it may be safer to use in this case?
    – Yokai
    Sep 11, 2020 at 5:19
3

Netcat is not dangerous "per se".

Usually security areas recommend not to include any advanced diagnostic tool that may allow an attacker with access to console to get additional information from the network where the vulnerable server is attached. This includes netcat, nmap, etc.

So, to answer your question: yes, it can be harmful if an attacker has access to a vulnerable server that includes this tools, because it can be used to sneach into the remaining hosts in the network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .