There are two types of "ports". There are the physical ports that are on the back of a network router or switch, and there are the virtual ports that live inside of a computer. They are not so different, though. Both of these ports will have a role in the journey of data transfer.
Data is sent in packets to break up information into smaller bites. Each packet gets attached meta data called headers about where it is going. The IP address tells the packet which network to travel to, and once a packet reaches a network, the physical port tells it which MAC address(computer) it is going to. Then, it will be able to find the correct computer, but only once the network port is read, will the data know how to be processed.
A computer can have many processes, services and applications running at the same time over the same network. One computer can send an email from port 587 at the same time it is receiving video data from a video server over port 443. Because data can be so varied, we need ports to make sure the correct services on our computer receive the right data.
There are over 65000 available ports on a computer, and much of the lower range of them are either well-known ports or registered ports. This lets us organize them by service, and keep better track of what type of data should be flowing through that port and how.
For example. If we see packets coming and going from port 22 and 23, we can expect a TELNET or SSH connection. Both of which allow for remote access of a device. This is the type of connection that lets us configure rented virtual machines and host a server on it. The more predictable packets are, the easier it is to spot malformed or suspicious data.
Historically, some of the well-known ports transferred data in clear text. With the example I just gave, remote access used to be on TELNET first, but all data was sent in clear text, making it easy for hackers to decipher data that could be sensitive. Many times authentication is needed for access to something like a remote access shell, so if credentials get sent in plain text, anyone could intercept those and use it to authenticate themselves falsely. SSH, on the other hand, establishes a secure connection tunnel where data is encrypted during transfer. Other ports have been migrated to support encryption as well. For example, port 80 for HTTP (web services) is encrypted on port 443 for HTTPS.
When checking for a network's vulnerabilities, most attackers start with a port scan. If a port scan returns outdated ports, like TELNET, being open, this could be a clear indicator that intercepting those packets may have sensitive data in plain text. This is exactly what firewalls defend against.
Port scans are an easy terminal command to run, and they can be ran stealthily. Networks may never even know that their network ports were scanned. nmap -sS 192.168.1.1 This command scans thousands of ports per second, and will gives clear, reliable differentiation between open, closed, and filtered states ports may be in.
A simple firewall intercepts packets and reads the headers off of it. Firewalls can be configured to deny traffic (blacklist) or accept traffic (whitelist) to specific ports or IPs. This allows us to close ports that we don't need open. It can also let us allow only specific IP address's into ports.
We can look at an event called WannaCrypt from 2017 to see how devastating this type of thing can be. Port 445. Used for file/printer sharing on windows machines. A specially crafted packet allowed for an attacker to run code on a target with no login credentials needed. Once one machine was infected, it automatically scanned surrounding networks to look for any devices accepting TCP traffic on port 445. It spread by sending the same exploit to all of them.
This hack spread to over 150 countries, infecting an estimated 200,000+ systems with days. It impacted major industries including health, mail, and phone.
Six weeks later, the same exploit was used to hit machines with a credential-stealing tool to also spread to already patched machines.
The worst part about this hack is that it could've been avoided by patching regularly. Microsoft had already known about the exploit before the hack and released a patch about a month before it happened.
Ports are vital for networking and sending data to the right places, but can also be a weak point without proper security precautions.
Top comments (0)