Let’s check how to Stop Port Scanning Attacks on Your Website. In the age of the internet, network security has obviously become extremely important. Without strong network security, both organisations and individuals are at risk of attacks.

While there are many different types of network-based attacks, our focus today is on an often overlooked (thus dangerous) type of attack called a port scan attack.

Let’s check out how it works, what its different types are, and how network admins can protect their infrastructure from such attacks.

What Is a Port?

All devices that are connected to the internet use something called a “logical port”. This is a software-defined endpoint that is used for receiving or sending specific types of internet traffic.

In a typical device, there are 65536 ports (0-65535). Each port has its own number and is used for a specific purpose, for example:

• Port 80 is used for receiving HTTP traffic.
• Port 443 is used for receiving HTTPS traffic (with TLS/SSL).

Both of these are used for loading websites. Other examples include:

• Port 20: used for File Transfer Protocol Data Transfer(used for receiving or sending files).
• Port 25: used for Simple Mail Transfer Protocol (SMTP) email routing.
• Port 23: used for Telnet-Remote Login Service, and unencrypted text messages.

What is a Port Scanning Attack?

In a port scanning attack, a bad actor scans the network for open ports and uses them for infiltration. Here’s how it works in general

• The bad actor scans the network to find host machines.
• Then it sends packets to various ports on the machines to find out which ports are open.
• Depending on which ports are open, the attacker identifies services running on the host machines and uses exploits related to those services to gain unauthorized access to the machine.

For example, let’s say that port 20 is open, and the port scan identifies it as open, a bad actor will be able to use it to inject a malware-laden file into the system. The malware could hijack the system and give control to the bad actor, who can use it to compromise the whole network.

That’s why it’s important to secure open ports and prevent them from being abused. To do that, you need to know how different port scan attacks work.

Different Types of Port Scanning Attacks

Here are different ways in which ports can be scanned. Most of these methods can be used by anyone who is tech-savvy, which is why it is a very accessible form of attack. So, learning these methods is necessary to stop them.

Vanilla Scan

This is a very straightforward scan in which all 65536 ports are scanned at once. It is done by sending a SYN (synchronize) flag or a connect request to the host machine. However, this method is not used a lot because it is always logged by the firewall. So, it tips off admins that somebody is trying to search for open ports.

Ping Scan

Another basic type of scan. In this one, ICMP packets are sent out by a device to various servers and host machines to elicit a response. This is known as a Ping. Pings, however, can be blocked or filtered with a firewall, so it is not a very useful method of doing a hidden port scan.

SYN Scan

SYN scan, or a “Half-open” scan, is a technique in which a device sends a SYN flag to the target. If there are open ports, the target responds with a SYN-ACK. However, the scanning device doesn’t respond to the SYN-ACK, so the TCP connection doesn’t complete. An incomplete connection is typically not logged by the firewall, so the network admin is unaware that a port scan took place. This is a popular technique of doing a port scan because of its anonymity.

FIN Scan

In a FIN scan, the attacker sends a FIN (finish) flag to various ports on the target device. Open ports ignore the flag, while closed ports send back a “reset” response. Both reactions can be used by the attacker to map which ports are open or closed in a target machine.

The bad part is that because no clear handshake occurs, the interactions are not logged either, so network admins don’t know that someone did a port scan on their devices.

Those are just a few examples of port scanning. Now, let’s see how you can protect against such unwanted scans to improve your security posture.

How To Stop/Prevent Port Scanning Attacks

There are a few ways to prevent port scanning attacks. You can install a firewall, keep unnecessary ports closed, or use TCP wrappers. Here’s how they work.

Install a Firewall

A firewall is a powerful network security measure. It can scan incoming packets and prevent them from entering the network if they are malicious. Network admins can set up network-level firewalls that prevent unauthorized access to the network. This prevents the attacker from getting the access required to do a port scan.

Additionally, you can fine-tune firewall rules to allow or prevent additional types of traffic. You can set up rules to control port visibility and prevent port scans. Some firewalls are powerful enough to detect scanning attacks and stop them too.

That’s why you must make sure a firewall is active on your network, server, and any other devices.

Do a Preemptive Port Scan

Sometimes a network is so large that it is difficult for admins to have full visibility. They can use an online port scanner to scan their own network, servers, or other devices for open ports they may be unaware of.

Finding such ports is paramount for security because you can close them and prevent unauthorized access. Even if someone does a port scan, they will only find that most ports are closed and that there are no vulnerabilities.

Use TCP Wrappers

A TCP wrapper is a powerful security tool in addition to firewalls. It is host-based, so you can install it on your server.

TCP wrappers allow network admins to allow or deny connections to their server based on IP addresses and domain names. So, if the server is sensitive, then admins can authorize only a few IP addresses and domains that need to connect with it and deny all others. This is a popular way of preventing access to open ports.

Conclusion

So, port scans are harmless on their own, but they pave the way for future exploits. That’s why taking preventive measures lets network admins safeguard the servers and devices on their networks by making port scans useless. The way to do it is to have a strong security posture. That can be achieved by using firewalls, preemptive scans, and TCP wrappers for authorization.