4

If a java application is listening on UDP port xxxxx and a firewall is allowing connections to that java application through the same UDP port xxxxx, what vulnerabilities will a Windows 7 machine be open to?

After scanning for and finding the UDP port xxxxx, can a hacker or botnet gain access to a password protected system and/or upload exploits, viruses, malware, botnets, etc.?

Either my pc has already been exploited, possibly with a botnet, or my ISP is getting attacked. Regardless of how many times I change my dynamic IP, I'm getting port scans, attempts to connect to certain services such as ssh, and other phenomena.

Improve this question
6
  • I'm no expert on java/JVM security, but your problem with being portscanned/connected to all the time is not due to you or your ISP being infected. There are thousands of bots out there trying to find vulnerable machines at random IP adresses, so what you're seeing is not surprising. Does your app absolutely have to listen on this port for connection attempts from the internet? If not, restrict your firewall to accept only packets from inside your LAN on this port.
    – us2012
    Dec 21, 2012 at 1:17
  • yes. the java app needs to connect to a specific port.
    – xanatos
    Dec 21, 2012 at 1:20
  • Maybe you should add some details about what your app does and why/how you need it to be accessible over the internet. If you can use some form of tried-and-tested authentication before allowing someone to communicate with your app (e.g. a VPN or a SSH tunnel), that would certainly help.
    – us2012
    Dec 21, 2012 at 1:24
  • Authentication sounds like a bright idea, however, I still wonder what the ramifications of opening a port for java itself are. Specifically, I need to open a port for java.exe. It seems, If I do that, I'm not only allowing traffic to the app that's listening on that port but also all other java traffic.
    – xanatos
    Dec 21, 2012 at 1:34
  • I think you're mixing a few concepts here. What do you mean by 'all other java traffic'? Other Java programs running on the same machine will bind to different port/protocol combinations. E.g., if program a binds to 4568/UDP, your new program b cannot bind to the same port, so you use 4999/UDP, say. If you now open port 4999 on your firewall, only your program will listen on that port. An attacker may now try to send things to 4999/UDP, but can not exploit any of a 's potential vulnerabilities as he can't reach it. You should therefore be concerned about the security of b.
    – us2012
    Dec 21, 2012 at 1:54

2 Answers 2

Reset to default
4

I think you're making some incorrect assumptions about Java - Java itself does not listen on a port. Applications RUNNING in Java do.

So Java itself, running on your PC/server isn't listening for anything. If you're, say, running a Minecraft server, which runs in Java, then traffic to/from that Minecraft server hits both Java and the app. If the app has a vulnerability, you can be compromised. If Java itself has a vulnerability, you can be compromised by virtue of the fact that the JVM sits between network traffic and the app. I am unaware of any such exploit at this time that directly targets Java via network traffic alone (i.e. a specially crafted packet that depends on the packet only rather than a vulnerability in the Java app) - most vulnerabilities are in the ways apps interact with Java. That's not to say one does not exist - I am just unaware.

With regards to:

Regardless of how many times I change my dynamic IP, I'm getting port scans, attempts to connect to certain services such as ssh, and other phenomena.

That's a fact of life on the internet. EVERY public IP address is CONSTANTLY scanned for SSH, open ports, etc. This isn't a function of your ISP or your server - it's a function of the internet as a whole. That's why it's so crucial to have adequate firewalling in place. You're not any more targeted than any other random IP address out there.

Improve this answer
1
  • I accepted your answer because it is more thorough and it helps me to understand my question and its answer more clearly. It complements us2012's comments and Slurmcans's answer. Thank you.
    – xanatos
    Dec 21, 2012 at 4:04
2

Your machine is open to any vulnerabilities that may be present in that Java app.

Improve this answer
2
  • So as long as there are no known vulnerabilities to java, as long as the java app is secure then the open port would be secure?
    – xanatos
    Dec 21, 2012 at 1:24
  • No, it is not the "Java vulnerability" you need to care here about but the actual java application which is started with java. For example you can write a Java appication which deletes a file every time you receive a UDP message. Or allows upload of files and executes it. So basically the risk depends on the java program. Java Runtime Bugs would come on top of that (but are rather unlikely for simple udp ports).
    – eckes
    Dec 21, 2012 at 4:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .