I have been using node.js and running live-server package in my project for a while with the following command:

node node_modules/live-server/live-server.js . --ignore=\"css/sass\" --open=./ --cors

Which uses the default address. The laptop I am using has "Norton Security" installed and today, without doing any change to the project's files, the program popped up a high severity alert with the following:

  • Name: Web Attack: CCTV-DVR Remote Code Execution
  • Action performed: No action is required
  • Attacker's computer:, 50473
  • Attacker's URL:${IFS}&&ping$IFS-c1$IFS-s41${IFS}>/dev/null&&tar${IFS}/string.js "MY_PC_NAME ( 8080)
  • Destination address: MY_PC_NAME (
  • Origin address:
  • Traffic's description: TCP, Port 50473
  • Notes: the attack matches the signature of a known attack.

I am on wi-fi (WPA2-Personal) and just ran nslookup and confirmed that this is one of the PCs in the network I'm connected. I am not in Sweden, but this is a place where different foreigners come to use the network, and I can tell by the attacker's computer name that the person is not likely to be Swedish either.

I don't know this person and what this kind of attack attempts to do. The Norton Security program I have installed is finishing its trial period in 4 days, and I was planning to use the default Windows Defender (Windows 10) after that. Any suggestions on how to proceed which doesn't require me cutting off the wireless?

  • I just disabled private network discovery in Control Panel\Network and Internet\Network and Sharing Centre\Advanced sharing settings (guest/public were already disabled)... Not sure if this will prevent these attacks though.
    – CPHPython
    Jan 5, 2018 at 12:57
  • This looks like it might be related.
    – user82155
    Mar 26, 2018 at 23:41
  • @duskwuff thanks but I don't believe it is, since that "attack happens simply by providing an URL which points to the router's default network name". When the attack happened, I was not navigating or using any web service that called any URL.
    – CPHPython
    Mar 27, 2018 at 8:29

2 Answers 2


Which uses the default address. is localhost and not reachable from outside. If you would really only bind to this address then the attacker would not be able to connect to this server from another computer but only connections from your computer itself would be possible.

But the software you are using does not use the default address of as you claim. To cite from the documentation:

--port=NUMBER - select port to use, default: PORT env var or 8080
--host=ADDRESS - select host address to bind to, default: IP env var or ("any address")

Thus, it will not bind to but to by default. This means your server is reachable by default also from outside your own computer. To fix this you should

  • set --host= when starting the server. This will make the server only accessible from the local machine.
  • and better also enable firewall on your machine in case you have other services running which should not be reachable from outside.
  • Thank you! I had no idea that that my local server could be seen from outside. I am now running it with that parameter and Norton also comes with a firewall embedded. I just added the attacker's IP to the list of the devices with restricted access. I also changed the trust-ability of the network from "public" to "restricted" (which they say it prevents other devices to access my PC).
    – CPHPython
    Jan 5, 2018 at 13:26
  • "I just added the attacker's IP to the list of the devices with restricted access" - and then the attacker changes its IP. You should better not blacklist systems but you should deny all incoming traffic, maybe except for a few explicitly whitelisted systems. Jan 5, 2018 at 13:31

As Steffen Ullrich helpfully suggested I restricted my live-server executions with the --host= parameter, only allowing it to deploy to my local IP address (limiting its chance of being deployed to other addresses).

Norton Security has an almost permanent active firewall, but I still did a few adjustment steps:

  • I modified the trust-ability of the specific network I am connected to from Public to Restricted, which prevents all direct access to my PC from other network devices.
  • I added to the list of "trusted" devices the attacker's IP address, and set its access to restricted. I am aware that this may be redundant, since the last step should prevent all communication from it, and its network's IP may change in the future. For now, it's mostly for logging purposes.

Since Norton's trial is ending in 4 days for me, I found that a similar operation can be done through Windows Firewall Advanced Security Inbound Rules:

  1. Add a "New Rule...";
  2. Choose the Custom option;
  3. On the Program tab, choose "All programs";
  4. On the Protocol and Ports tab, choose Any in the Protocol type field (this automatically considers All Ports, local and remote);
  5. On the Scope tab, choose Any IP address for the local field (you can define IP addresses ranges in the remote access, if you want some remote inbound connections);
  6. On the Action tab, choose Block the connection;
  7. On the Profile tab, make sure this rule applies to the group which the wi-fi network belongs to (or just leave them all selected: Domain, Private, Public);
  8. Give an obvious Name to the rule for remembering it later, just in case you need to change the range of IP addresses to block, e.g. "CUSTOM: BLOCK ALL INBOUND (private networks)"

I guess this is another way to solve the problem and seems to do what Norton does behind the scenes.

However, I am still curious to know more about this type of attack. If it wasn't for the development I am doing with node.js, I would probably haven't written the question and this answer. So I still appreciate any explanation about what the attack may attempt to do.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .