4

I'm using my iPhone personal hotspot to connect to the internet on my computer via usb connection. I don't go through any other router or connection. The phone is my only means of connecting my computer to the internet. The phone is jailbroken.

I did a nmap scan of my public IP address and it shows that port 21 is open. Everything I've ever read has said ftp is unsecure shouldn't be used. So it seems strange to find this port open on a public ip address. I don't use ftp for anything (that I'm aware of.)

$ nmap -Pn xxx.xxx.xxx.xxx --reason

Nmap scan report for xxx.xxx.xxx.xxx
Host is up, received user-set (0.014s latency).
Not shown: 999 filtered ports
Reason: 999 no-responses
PORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack

Nmap done: 1 IP address (1 host up) scanned in 6.72 seconds
  1. Is a public ip address exclusive to a single device or are there other devices in the cellular network sharing the same ip?

  2. Is there any risk that someone could gain access to the data on my phone or computer through this open ftp port?

  3. And if there is a risk, how would I go about closing this port?

  • Run 2 tests: try using an FTP client and connect to the IP, second, disconnect your hotspot and turn off your phone and use a web-based nmap scanner like hackertarget.com/nmap-online-port-scanner - this will tell you everything. Typically, IPs are shared between many devices (read about NAT) – schroeder Feb 28 '17 at 15:41
  • On a WiFi network, nmaping my iPhone reveals that ports 80 and 62078 are open. – Bailey Parker Feb 28 '17 at 15:51
  • @schroeder It might not be the best idea to use a third-party web scanner to investigate a potential vulnerability. – Arminius Feb 28 '17 at 16:09
  • @Arminius I'm not classifying it as a vuln. Just to see if the port persists. If persists, then it is not the OP's equipment, just an open port. – schroeder Feb 28 '17 at 16:15
  • Ok I tried connecting to the IP with Cyberduck and using an online FTP test @ ftptest.net. I selected anonymous login for both tests and left the password blank. The connection timed out both times. Results from web based nmap scanner: Host is up. All 100 scanned ports on xx.xx.xx.xx are filtered – I0_ol Feb 28 '17 at 16:59
0
  1. Typically the IP is shared / NAT'd amongst many devices.

  2. Yes it would be a risk if the port was actually open

  3. It would most likely be opened by an app, so uninstall apps until the port disappears or restore back to factory defaults.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.