1

I am highly concerned about RDP security and about multiple occasions of ransomware infections through RDP, so now I am inspecting possibilities for self-defense against these threats. What interests me a lot is securing of router ports from outside. As it was thoroughly explained here, blocked/filtered port is better than just port having no services bind to it, 'cause blocked port doesn't send response to attacker.

However, what if the port is not blocked , but not forwarded anywhere on router level? Is it equivalent to blocking in sense of security?

In my understanding, unforwarded port is just simply redirected to nowhere, and attacker just cannot use it to compromise anything. Does this makes any sense?

UPDATE: Added reference links for @ISMSDEV and others who don't believe that ransomware and RDP are following in toe.
1. Ransomware and RDP – Are you vulnerable?
2. Ransomware spreads through weak remote desktop credentials
3. Ransomware using Remote Desktop to spread itself

  • 1
    This has been discussed on here a few times. Try searching RDC. I am interested in your comment about RDC ransomware infections as I do not believe I have heard of any. If you forward a port to a none running service or server then the port is in essence closed as it can't do anything. If the port is not forwarded then its closed as it's not mapped to anything. Might be worth doing some research on TCP/UDP firewall and port forwarding to get you skills up. – ISMSDEV Jun 27 '17 at 14:36
  • @ISMSDEV if it's was discussed, please drop the question here. I think I searched well, but didn't find anything similar. – Suncatcher Jun 27 '17 at 14:39
  • @ISMSDEV my friend was infected by ransomware via RDP, I can confirm this for sure 'cause I was personally involved in the investigation. But the question here address not only RDP, but any service which can be set up on port. – Suncatcher Jun 27 '17 at 16:13
  • Thanks but your RDP example is more to do with having the RDP brute forced because users have poor passwords. The RDP protocol is not at fault here or has a any direct vulnerability. – ISMSDEV Jun 28 '17 at 7:01
1

Let me make a few assumptions to try to simplify this:

  1. You're talking about a home or SOHO network, and not an enterprise environment.
  2. Your router performs Network Address Translation (NAT), hence the need for port forwarding.
  3. You're interested in explicitly blocked traffic vs a lack of forwarding.

So let's compare what happens in each case. For the case where you have explicitly told your router to drop incoming traffic on port 3389:

  1. A TCP SYN packet comes in with destination IP set to your router and destination port 3389.
  2. Your router consults pf/iptables/whatever vxworks uses and determines the packet should be dropped.
  3. The packet is dropped, the router forgets about it, and no response is sent to the attacker.

For the case where you just have nothing forwarded:

  1. A TCP SYN packet comes in with destination IP set to your router and destination port 3389.
  2. Your router consults pf/iptables/whatever and finds no explicit direction to handle it. (Including no port forwarding!)
  3. Your router consults its network state table, finds no matching connection (either established or "related"), so the packet does not need to be forwarded on via NAT.
  4. Your router checks for a listening service on port 3389 itself.
  5. Since 2/3/4 struck out, the router has no idea what this packet is supposed to do, so it sends a connection reset (TCP RST) back to the requesting host.

In either case, no TCP connection is actually established. Some people believe that dropping packets is better because it "hides your presence" online. I guess that's potentially true, but then you need to drop on every port and have no port forwarding. Otherwise, it's clear to an attacker that your IP is alive. Furthermore, most SOHO users should be most concerned about opportunistic attacks rather than targeted -- in that case, attackers will just be scanning large blocks of IPs looking for port 3389 open. Dropping a packet or resetting makes little difference to this attacker.

  • Interesting view. And in corporate networks the situation is another one? – Suncatcher Aug 27 '17 at 8:13
0

So, if you forward a port that has no legitimate service running on the backend of your network, then I would not be too concerned about it. However, I would not have open ports on my networking unless they are necessary either.

As for the RDP, 3389 should never be directly exposed to the internet. Even an obfuscated port# for RDP should never have direct internet access via port forwarding or any other means.

If you're concerned about RDP security, make sure you have a well configured VPN with RSA 4096 or ECDSA encryption set-up.

  • No, you misinterpreted me. I didn't speak about forwarding port without assigning any service to it (which is nonsense), I spoke about not forwarding port instead of explicit blocking. – Suncatcher Jun 27 '17 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.