0

Today I scanned my router and found out open port 12345, which when googled displays to be NetBus which is potential threat.

As a reference I scanned my router many times before for open ports (all ports) using nmap, and never before seen this port opened.

I logged in to my router via remote shell and ran netstat which showed that the there is connection from to this port from internal IP, which I was able to figure out is my firestick. I own firestick for a long time, and performed many scans on my router since then but port 12345 was never opened. However whenever I ran top or ps I could not see anything that was never there, or anything that would make me anymore scared than I already am.

Is there any step I should take or is this known behaviour, and I simply missed it out when performing my previous scans, or is this coming perhaps from any new update?

Also using canyouseeme.org I checked whatever port 12345 is available to outside world, but the website shows that this port could not be reached.

1

If you're running your nmap scan from inside your network, it's entirely possible to get a different set of open ports than from outside your network. Services can bind to interfaces, and presumably your router has firewalling rules of its own. If the port is not accessible from the internet side, then an attacker will not be able to use that to get into your network.

Unless you have a really old Windows machine on your network, there'd be no reason for netbus to be involved.

Most likely, you have UPnP enabled and some recent firmware update to your firestick has caused it to use UPnP to open port 12345. Try disconnecting the firestick and see if it goes away after some time.

0

The first step is to look at the traffic, from outside the router, using for example Wireshark. For this to work you need to intercept the traffic: you can mirror it, tap it or arpspoof it.

Then analyze the traffic: if it's not encrypted, that's easy. If not, you can still look at the IP and port it's connected to.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.