Strange devices & open ports on my network

Question

I have performed several Nmap scans on my network to determine what devices are connected and which ports are open. To my surprise I found a very strange device connected(which I do not know physically where it is) and some devices have very suspicious ports open.

Below I will list the scans of the suspicious devices.

Nmap scan report for 192.168.1.1
PORT     STATE SERVICE       VERSION
23/tcp   open  telnet        Cisco or Actiontec MI424WR router telnetd
80/tcp   open  http
443/tcp  open  ssl/https
992/tcp  open  ssl/telnet    Cisco or Actiontec MI424WR router telnetd
8080/tcp open  http-proxy
8443/tcp open  ssl/https-alt

The above result is of my modem, the thing that is strange about it is that it has port 23 & 992 open. Whenever I log into my modem on the web user interface, I cannot see these ports open? I do have the option to open these ports, but they are unchecked. Which means it should be closed. So how can I close these ports?

Nmap scan report for 192.168.1.64 (Cisco Spvtg) Service Info: OS: Linux
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         Dropbear sshd 0.52 (protocol 2.0)
9001/tcp  open  tor-orport?
49152/tcp open  upnp        Portable SDK for UPnP devices 1.4.6-6 (Linux     2.6.31-3.3-isb6030; DLNADOC 1.50; UPnP 1.0)

The above scan is a device that I do not know where it is physically? It also has some very suspicious ports open? How can I identify this device? Should I try to kick it off my network?

Another scan that I cannot post currently, has an open port '12345 Netbus'? Is this some type of malware? The device is an android TV box. I will post the scan for this one later.

Thanks for helping :)

Answer 1

The above result is of my modem, the thing that is strange about it is that it has port 23 & 992 open.

These are probably ports to internally manage it, see if you can connect to it using telnet/ssh/putty and login with the credentials you have; but probably baked in into the firmware, and potentially with credentials that are specific to the device manufacturer.

The web interface on home devices (which I assume this is), is often for non-expert users to manage the device without many chances to break it. There's no rule that every interface has to be manageable over the web interface. Lookup your device online and see if there's any way to log into it; and configure these services.

A quick google for your device:

"The default user name for the Verizon MI424WR router is "admin," and the default password is "password"

I do have the option to open these ports, but they are unchecked. Which means it should be closed. So how can I close these ports?

That's usually to allow ingress traffic; i.e - where you open a port on your WAN interface to be forwarded to an internal host. This allows you to run services and make them accessible on the Internet.

[..snip...] The above scan is a device that I do not know where it is physically? It also has some very suspicious ports open? How can I identify this device? Should I try to kick it off my network?

If you don't have WIFI, run a ping on this IP and try to unplug each device sequentially and see when it stops responding. Looking at the DNS reverse looking (Cisco Spvgt), it may be an extra IP address that your modem has. Note that IP addresses are just based on IP stacks and not physical interfaces.

Another scan that I cannot post currently, has an open port '12345 Netbus'? Is this some type of malware? The device is an android TV box.

No, it's a service running on that port. You can run any service on that port if you want. NetBUS used to be known RAT that was using that port, and possibly the most known one. Telnet to us, run Amap, or so - to see what is running.

THC's Amap may help you out more to see what protocol is behind these ports.