0

Consider we have port 65434 open on router (open for WAN). The port forwarding is done to a host which does not exist. Can a hacker exploit this open port on router which leads nowhere?

  • A hacker probably (I'm not 100% sure) can't exploit it, but you shouldn't have it open if you are not using it. It's always better to close the port. – Aulis Ronkainen Feb 14 at 13:10
1

Depending on how your network is configured a hacker might be able to in a phishing email.

So pretend hack sends you an email which you open by accident. They now have control of your computer.

  1. They can now change your IP to the non-existent one, and have a direct way in and out of your network.
  2. Setup a virtual PC with said IP address and communicate with their servers.

Also if it does have an IP, it should be on a different subnet to further mitigate the risks. Otherwise attacks 1 & 2 above are even easier.

You didn't specify exactly how your router was configured to forward. If it is simply based on IP, and the hacker can place a virtual PC on your network with that IP game over.

If your forwarding to a specific network adapter say eth5 then it doesn't care about the IP.

Either way your consuming routing resources unnecessarily, instead of just dropping the packets.

  • When you have a router that uses NAT, can an open port still pose a threat? Thanks. – Moab Feb 14 at 13:31
  • 1
    Yes the forwarding is based on IP. Example: all incoming connections on 65534 forwards to 192.168.1.140 65534. Why i am asking this question? In fact let's say my pc with ip 192.168.1.140 is running a program which is able to redirect streams basing on the task it's gained from a client. So in 99,99% of time this program is not listening on any port at all, but when it receives a task the port is opened but only during acceptation of the client and then closed immediately. – A.Bras Feb 14 at 13:40
  • 1
    @Moab Yes, the hacker can attempt to use the port for there own business. Your forwarding the traffic to a real IP inside your network. If the application connected to said port has vulnerabilities the hacker can exploit them. – cybernard Feb 14 at 14:06
  • @A.Bras This is security through obscurity. So when the hacker figures out what your doing, which they will via trial and error, they will just submit random data until they figure out how to trigger the open port event. Now they can open 65534 at will, yay!! FTW. (Hackers have automated tools they can set and forget) Now,if you limited the set of incoming IPs allowed through port 65534 that would improve security. So instead of ALL 4 billion IP allowed a 1.1.1.0/24 (254 ip) or 1.1.0.0/16 (65535 ip) or similar. – cybernard Feb 14 at 14:14
  • @Cybernard - The whitelisting of ip's is already implemented. To trigger an open port event is very difficult due to several protection mechanisms: ssl client authentication - a valid certificate must be present and also additional password protection verified on server side. In fact we are testing a remote desktop connection system for good time. We have complete activity logging and the results are very positive - so it's a bit strange:), so now i wont to know any potential risks aswell. – A.Bras Feb 14 at 14:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.