3 ms·
Can anyone explain why malware distributors would prefer (or be somehow forced into using) non-default TCP ports?
by schoen 2y ago
Can anyone explain why malware distributors would prefer (or be somehow forced into using) non-default TCP ports?
- VoidWhisperer 2y agoMy (naive) guess is that it makes them slightly less likely to be picked up by scanners like shodan. I'm probably wrong though
- 9cb14c1ec0 2y agoThis is a big part of it. There are companies that scan the internet in search of malware, and if you run on a different port it makes the search space so much bigger.
- sambazi 2y agobecause the original owner of the box would mind if the application on default port stops working
- amne 2y agoor wonder why weird routes like "/i" or "/bin.sh" are among the top accessed URLs in their monitoring dashboards
- cess11 2y agoThe low ports typically require root privileges to map to, and people are more likely to keep track of what runs on them. It's not about Shodan, Shodan will find it. Probably Greynoise too.
- rvnx 2y agoIt's because they typically hack web servers, and then they spawn a fresh web server on a random port. Anything below 1024 requires root access, which can be problematic, and 80/443 may already be used.