3

I understand that everything is potentially an attack vector, but I would like to ask a practical question about UDP ports

Suppose you're pentesting some small organisation and you found a couple of open UDP ports. Some of them appear to be constantly open. On the first thought, perhaps the ports should be closed, sure.

But I look up the exploits, and it appears that whatever the exploits there are around target everything based on TCP. Furthermore, the networking knowledge suggests that UDP ports are required to be open for basic tasks such as web-browsing...

Am I wrong? Practically, do the UDP ports need to be taken seriously, or is it OK for them to be left open?

5
  • Might be helpful for reference: en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers
    – forest
    Dec 26 '19 at 5:00
  • 2
    Furthermore, the networking knowledge suggests that UDP ports are required to be open for basic tasks such as web-browsing... - This is completely wrong.
    – MechMK1
    Dec 26 '19 at 13:47
  • How did you determine the ports were open, and which ports and running services were they? Dec 26 '19 at 15:58
  • @multithr3at3d The services are largely unknown, but I used nmap to identify open UDP ports as well as some of their purpose
    – tabdiukov
    Dec 26 '19 at 16:49
  • @multi just for reference, you'll need to add the "-sU" flag to scan for UDP ports
    – tabdiukov
    Jan 8 '20 at 13:17
4

UDP ports are required to be open for basic tasks such as web-browsing...

There is no need to have an open UDP port for web browsing. E.g. my home computer is behind a firewall which blocks all 65,535 UDP ports, and everything is fully functional, including the web browser. UDP is indeed necessary for web browsing, as DNS is typically done over that protocol, but that does not require opening ports, just support for sending and receiving the datagrams over the network

whatever the exploits there are around target everything based on TCP.

This is just because most services use TCP, not because TCP is inherently more or less secure.

Practically, do the UDP ports need to be taken seriously, or is it OK for them to be left open?

It depends entirely on what service is using them. Without knowing that, there's no way to tell if the ports should be closed (denying access to the service over UDP from the outside), or can be left open. Verify that the services are necessary. If any of them are unnecessary, close their ports, whether UDP or TCP.

2

NFS is an example of a service that can run over UDP (2049) but can result in data disclosure if exploited.

UDP is technically hard to block without a stateful firewall. Many internet services use outbound-initiated UDP connections (most notably voice-related) but any outsider could set the source port to a well-known UDP port (RTP, DNS) and probe your network. You can permit UDP outbound and let the stateful firewall only permit inbound responses. (This still allows data exfiltration and would be a PCI violation from a PCI segment).

TCP is easier to block with a stateless ACL because you can permit tcp established (only) inbound.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.