What can I do about being heavily port scanned?

Question

I have two devices connected wirelessly to my Linksys router while running Symantec Endpoint Protection on my computer. A few days ago I started using the internet by connecting the cable directly to my computer. For some reason my router slows up my download speed - I have already tried fixing it with no luck, it's probably outdated. Anyway after I hooked up directly via cable SEP started notifiying me that I am being port scanned by a certain IP which is not a part of my network. It's European. SEP automatically blocked the IP for 600 seconds. After that I noticed that I have been port scanned continously by different IP's from around the world. As I understand this is quite normal and not something I should be concerned about if I am behind a firewall. However, the previously mentioned IP keeps port scanning me about every minute repeadetly along with other various IP's. After I connected through wireless on my router I noticed that the SEP doesn't log these IP's anymore but my router does. I already blocked the IP in SEP. But it keeps scanning me which is visible in my router log. The router isn't capable of blocking the IP connections like SEP.

1. I would like to know what else can I do to improve my security?

2. Which ports should I keep open and which ports should I close? If I understand correctly the IP's are scanning for open ports that are vournable however aren't certain ports always open in order for the internet to work?

3. I don't have any ports forwarded on my router. There are some application specific ports open in the windows firewall. Can I get hacked through these ports?

4. Is heavy port scanning the reason behind slow router/wireless speeds?

5. Why am I being targeted by the same IP repeadetly? Is someone trying to hack my computer?

Answer 1

1. I would like to know what else can I do to improve my security?

First of all, you should make sure you use the newest firmware for your linksys device (if you use it). I wouldn't recommend to connect your Windows PC directly to the internet. Doing so allsows a potential attacker to directly "access" and gather information about the target machine and there's only your SEP and your Windows firewall to prevent this (and i wouldn't entrust my life to those solutions). Again, if your systems are top up-to-date you decrease the risk factor.

In my opinion the securest way is a small linux device (e.g. a raspberry pi) between your PC and the internet. You can use all solutions Alexey mentioned on it and you are able to customize it the way you want. This way, you would have many possibile defenses against port scans and network attacks.

2. Which ports should I keep open and which ports should I close? If I understand correctly the IP's are scanning for open ports that are vournable however aren't certain ports always open in order for the internet to work?

Short explanation on portscans and attacks:

Most portscans scan the lower well known ports (Well known ports) to find services (e.g. FTP servers, SMTP servers, etc) so they can exploit them to get access to the machine. You can't imagine how many unsecure servers are out there that run outdated versions of such services. Most exploit attacks run a scan automatically, compare the results with an exploit database and attack if the have a suitable exploit. For scaling, those attacks are often scripted. "Vulnerable ports" are ports on which unsecure or outdated services are listening on your machine.

-> There are no ports that should be open or closed by default. Of course, the securest way would be to have no single port open / having no service on our machine listenting to incoming connections from the internet.

You are right, there are certain open ports on your machine if you connect to the internet (see Ephemeral ports). Example: You connect to an http server by using firefox. Firefox now opens a socket on your machine on an ephemeral port (e.g. 50000) to send and receive packets to/from the http server on server port 80 (Well known port). But Firefox only listens to packets from the connection that it has initiated itself, so in your scenario you don't have to worry about them.

3. I don't have any ports forwarded on my router. There are some application specific ports open in the windows firewall. Can I get hacked through these ports?

See answer to 2., if you have services listening on such ports those services/applications are potentially exploitable. Again, keeping them up-to-date decreases the risk.

4. Is heavy port scanning the reason behind slow router/wireless speeds?

See Alexey's answer, it shouldn't be the reason.

5. Why am I being targeted by the same IP repeadetly? Is someone trying to hack my computer?

Of course, that could be the case. A "hacker" uses portscans to gather information on the system he wants to infiltrate. But it's much more likely that some chinese automated script is just that bad that it uses the same targets over and over again. As mentioned in answer 2, those attacks are often scripted to scale a few attack vectors on many many machines out there to get results.

Best Regards

Answer 2

Design your system such that incoming IPs involved in portscans directed to daemons end up in the drop zone of your firewall. There were tools like tcp_wrapper that do this for you, but I designed something myself to keep them away from reaching the daemon. The problem occurs when your system runs servers for http, ssh etc that respond to incoming requests. Over time firewall maintenance reduces portscan activity, but you have to accept that there some background noise will remain. Typically the firewall sees 25000 connect attempts that are directly dropped, some 100 IPs per day make it through the firewall and are added to an ipset table in the firewall drop zone because they were rejected by a daemon. Call it a 0.5% success rate for passing the firewall, and from there on no success in guessing account name password combinations which is typically what spammers first try to do.

Answer 3

My recipe was and is :

• Portsentry
• Proper firewall
• Retailating NMAP
• Auto-mailing via Perl scripts to abuse@xxx from whois from reverse DNS
• Auto-reporting to blacklists for malicious IP's
• Enforcing a list of bad IPs to HTTPS/SMTPS/IMAPS/POP3S

It worked and it works, but it took some time for assistance

Answer 4

Late as always...but here's what I did- ACL'd / Blocked all non US/CAN traffic.

nirsoft.net lets you download csv lists and it's easily translated to any firewall. Its effective and really clears most of the unwanted traffic as in my case it was derivative of RIPE/APNIC/AFNIC/LACNIC and in that order with the concentrated attacks being sourced mostly from RIPE and APNIC. From there I just formulate a few rules to generate logs created as connection attempts accrue. I've had maybe 4 of the smaller US blocks to deal with and even in a few cases followed up with ISPs when it's egregious and annoying. As you start surfing and seeing sites that are just not loading, find their source IP and allow them prior to the implemented non-us ACL. It really is effective.