2

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP?

Or is Port 80 by default not always open? It waits for the host to initiate a connection via specific application/service to a host application then the port is opened at that time? Is a hacker required to fake that specific host application in order to hack into our computer?

4

We normally say port 80 is firewall friendly.

Firewalls can be used to filter both incoming and outgoing connections. While in the simpler use case firewalls are only used to filter incoming connections, in more restrictive environments they also restrict outgoing traffic, i.e. what kind of external services can be reached from inside a company.

The phrase "firewall friendly" has to be seen in the latter context. It means that while almost all outgoing traffic is denied (incoming anyway, unless it is a response to outgoing traffic), visiting external websites from inside a company is usually allowed. This means access to external port 80 (http) and 443 (https). With simple packet filter firewalls it also usually means that no additional restrictions are applied to port 80 and 443 and even more complex firewalls with content inspection (i.e. DPI or proxies) usually only apply a blacklist which sites/URL's are forbidden but still allow outgoing web access in general.

Because this kind of port based restrictions is common enough in corporate networks and even with many public WiFi hotspots, most communication on the internet now tend to work over HTTP/HTTPS or at least use HTTP/HTTPS as fallback in case they notice traffic restrictions. For example Skype usually uses a wide range of UDP and TCP ports but can fall back to a tunnel via HTTPS if these ports are blocked.

But can hacker just hack into port 80 via TCP or UDP message?

Taking into account that the meaning of this phrase means that incoming traffic is denied (unless being a response to outgoing traffic) and outgoing traffic is restricted to web surfing, then it should be clear that it is not that simple to "...just hack into port..." from the outside. And given that the meaning applies to web surfing it also applies only to TCP since UDP is in restrictive environments blocked both for incoming and outgoing anyway.

But what actually is done by attackers is to use outgoing traffic on port 80 and 443 for C2 (command and control) communication and data exfiltration once they've managed to infiltrate a network (for example with phishing mails or drive-by-downloads).

And what is also done by attackers is to make users inside the company network visit a site which delivers malware. This is for example done by infecting sites the user commonly visits (watering hole attack) or using targeted advertisements (malvertising). Similar the attacker might make the victim provide login credentials by luring the victim (typically using phishing mails) to sites which mimic common services the victim uses (i.e. Paypal, web mail, Netflix...). Given that mostly unrestricted access is allowed on port 80/443 it means that the firewall will not block these kind of attacks.

  • Thanks a lot. So can I say hacker can only take advantage of response and manipulate the response message? If the victim computer doesn't initial a request or hacker doesn't know which service the victim computer use via specific port, then there is no way hacker can attacked the victim PC? – NewPy Jul 21 '18 at 5:32
  • @NewPy: kind of. The attacker can still make the victim visit sites delivering malware, i.e. watering hole attack or malvertising as described in my updated answer. – Steffen Ullrich Jul 21 '18 at 5:42
  • Thanks. But this would still be initiated by victim (not in purpose). If user didn't request to visit this site, and assume there was no malware or any other service hijacked the port, then there is no way hacker can attacked victim's PC from scratch right? – NewPy Jul 21 '18 at 13:21
  • @NewPy: correct - the hacker can not attack the victim directly, only indirectly by somehow making the victim request the malware. – Steffen Ullrich Jul 21 '18 at 13:25
  • Clear. So when a hacker did a port scan and found victim's pc certain port is opened, this is an opportunity for them to attack this connection because the victim has already started a request. But still, without faking as a response looks like remote host (destination IP and port), then there is no way a hacker can attack? – NewPy Jul 21 '18 at 13:30
7

A port itself cannot be hacked, rather, it comes down to if the service running on that port contains any vulnerabilities. If you're running a web service on port 80 that contains no known vulnerabilities, your chances of being hacked are low depending on your situation. If you're running a vulnerable service on port 80, you're at risk to be popped by an attacker or botnet.

Port 80 is not open by default on most operating systems, you will need to manually launch a service that utilizes that port. Also, no, an attacker is generally not required to pose as another host in order to compromise your computer externally.

  • When you said web service contains vulnerabilities, are you referring to web service that in plain text that a hacker can sniff or you referring to web service that visit a malware website? – NewPy Jul 21 '18 at 13:34
  • Hey NewPy, I would like to recommend the Web Application Hacker's Handbook to you. It gives a great introduction to penetration testing web services. I would also like to recommend the GPEN, as it will give you a great overview of basic penetration testing. – Henry F Jul 22 '18 at 7:40

protected by Community Feb 28 at 10:25

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.