Reply to thread

Message

<blockquote data-quote="ForgottenSeer 109138" data-source="post: 1079897">If not behind a properly secured router without port forwarding one could add closing certain ports to this list as well... A couple examples... Port 135: exposes Remote Call Procedure and it can be abused to obtain information or a foothold on your system if the threat actor gets behind your router. Port 135 should never be exposed to the internet.Port 139 is absolute crap and should be shot dead on sight. It is for SMB over NetBIOS (which should be disabled itself). Threat actors routinely scan for open port 139 on the net. Then they abuse it if they get behind the router onto the LAN and LAN port security is lax.Port 445 is SMB over IP. The idiotic thing shouldn&#039;t be enabled by default either. The EternalBlue exploit used 445 to move laterally and vertically in networks.One could work on researching security for ports 135, 139, and 445 for a month and wouldn&#039;t even scratch the surface.</blockquote>

[QUOTE="ForgottenSeer 109138, post: 1079897"] If not behind a properly secured router without port forwarding one could add closing certain ports to this list as well... A couple examples... Port 135: exposes Remote Call Procedure and it can be abused to obtain information or a foothold on your system if the threat actor gets behind your router. Port 135 should never be exposed to the internet. Port 139 is absolute crap and should be shot dead on sight. It is for SMB over NetBIOS (which should be disabled itself). Threat actors routinely scan for open port 139 on the net. Then they abuse it if they get behind the router onto the LAN and LAN port security is lax. Port 445 is SMB over IP. The idiotic thing shouldn't be enabled by default either. The EternalBlue exploit used 445 to move laterally and vertically in networks. One could work on researching security for ports 135, 139, and 445 for a month and wouldn't even scratch the surface. [/QUOTE]

Verification