3

Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a vulnerability that the machine doesn't have. Confused, I ran an nmap version scan on the local address of the machine in question. Sure enough, (at least locally) it is listening on port 8080 (http) with this service: Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP).

I recently disabled UPnP in the router's settings out of security fears. The actual program running on the machine that is tied to that port is...well...the system itself (PID 4). If we weren't getting network intrusion attempts I'd think nothing of it, but obviously, something is being forwarded to the public internet for this to happen. How can I fix this?

Improve this question

1 Answer 1

Reset to default
-2

I think port 8080 is being used by Java apps, check if you have installed programs like Tomcat or anything else, also run: netstat -ba with administrator account and this will give you :

-b tells netstat to output executable name of the socket owner.

-a tella netstat to list all listening and client sockets.

Is there installed Apache by any chance ?

Improve this answer
4
  • 1
    8080 is used by a ton of stuff. I wouldn't limit this to just Java. Good suggestion on the netstat though.
    – MikeSchem
    Nov 12, 2019 at 20:12
  • 1
    The question already pointed out that the process holding the port is the kernel (PID 4, ntoskrnl.exe, "System"). I know of no legitimate reason for a driver or other kernel component to listen on 8080 (it's not happening on my computer).
    – CBHacking
    Nov 12, 2019 at 22:30
  • @CBHacking: MS HTTPAPI is in pid 4. netsh http show servicestate should give the port(s)/URLs it is accepting and per stackoverflow.com/questions/23042566/… tasklist /m httpapi.dll (must be elevated!) shows the process(es) using it. Though I've never observed Tomcat do so.
    – dave_thompson_085
    Nov 13, 2019 at 6:08
  • Apache is not installed- no web server software at all. As previously stated, the system itself is running Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) on 8080.
    – Spikeedoo G
    Nov 16, 2019 at 18:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .