0

I decided to check out my home through the BullGuard IOT Scanner. I used my Android phone and the Opera browser, and it came up that I was vulnerable: ports 22, 8090, 8098, and 9100 were all reported as "public," via Shodan.

I then opened my laptop and checked it, and it came up as "Not Public." Then I turned on my phone's WiFi hotspot, and checked my laptop again through the phone. "Not Public."

Then I checked again from my phone, this time using Firefox. "Not Public." However, when I checked again using Opera I got the same results as the first time. So the only time I showed up as "public" was when using Opera on my phone.

Is Opera unnecessarily exposing me when I use it? Should I dump Opera? Or is there a legitimate explanation for this?

Re: Hax's questions

  1. The phone uses IPv4, but the laptop uses IPv6. I think the router prefers IPv6, but I'm not clear on the whole v4/v6 thing. When I check my IP with the phone I get a v4 response, and a v6 from my laptop.
  2. Everything was done on my WiFi network, which is behind the firewall on the router. I run my own home VPN, so I definitely have ports forwarded; however, they aren't any of the ports that BullGuard detected. I have the VPN set up with PKI and an HMAC key, and I don't use 22 for SSH.

Re: Franz - I know that Opera offers a free VPN, but I think it requires a separate program. It may be that their browser is listening on those ports (but why not 1194?) just in case, but how is the scanner seeing those ports when they're located BEHIND the firewall?

Everything is behind a firewall for these tests, so how can the scanner see open ports for one device operating behind the firewall and not the others, and then only for one program?

I'm not familiar with Shodan or nmap, but I'll explore your suggestions. (Edit: Shodan returned no results for my home IPv4). I don't see how this is an issue with the Comcast router, but the GRC Shields Up scan reports a ping response from those ports, as well as some other random higher-numbered ports their standard scan doesn't check. I put my phone in airplane mode, but the results remained constant. There is nothing in the router settings indicating that any ports are open except for those I've manually opened. But even if the router is partially to blame, why does Opera fail and both Firefox and Chrome pass (on the phone), and the laptop passes?

  • opera is owned by the chinese and has been known to be compromised on other matters; not as bad as maxthon, but better alternatives (chromium, vivaldi) exist. – dandavis Oct 28 '16 at 18:56
  • If you are using Opera Turbo or Opera VPN, this is expected. Your IP is not acessing the internet, Opera is acessing, filtering, compressing, and sending back to you. The IP Shodan is seeing is Opera's, not yours. – ThoriumBR Oct 28 '16 at 19:41
2

Your little experiment and the inferences are actually inconclusive.

  1. Verify if you are using IPV4 or IPV6. [ You can do this by checking your public IP in any of the websites for that. ]
  2. If you are using IPV6, it is likely that the ports listed open are exposed to public network.
  3. If you are using IPV4, your devices are likely to be behind NAT. In that case your public IP is the IP address of your router. The router will have open ports only if the administrative interfaces of router are configured so, or if port forwarding is enabled for specific services. So it is very likely that the exposure is not because of your phone, but because of a misconfigured router.

To verify this manually, do the following.

  1. Search in shodan.io with your public IP
  2. Note down the results. Do an nmap scan on your own network from another network.
  3. Verify if port forwarding is on.

PS: If you can give information specific to the model of router you have, I might be able to provide some help regarding the configuration.

| improve this answer | |
  • Adding something to "hax"'s answer... Opera includes a free VPN service, maybe it can be related to this problem. Try to repeat this test while connected to a firewall, log your sessions and compare the results. – Franz Oct 28 '16 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.