2

I have Bitdefender Total Security 2014.

Recently I have been getting the message/alert "Port scan detected and blocked". I did not care about it much until I getting more especially in a specific timee. I was shocked when I saw the External IP of the attacker is from the same country where I am; so it's not a robot or virus, it's a hacker and I am his target. Can the hacker break my security and access my computer if he found an opened port?

How to block port scanning by hackers? I have heard of NMap but I am not network specialist.

If my anti-virus and firewall are not the best, what do you recommend for me? All internet is saying Bitdefender is one of the best (if not the best!). But I have asked a specialist and he said "COMODO".

What configurations should I set on my router to help regarding this problem? Should I allow the following settings or not?
IGMP Snooping
IGMP Snooping
QoS

I have disabled UPnP
Wifi password encrypted "WPA2-PSK"
I have enabled: ICMP Flooding, SYN Flooding and ARP Attack but I think my internet connection getting slower!
http://prntscr.com/5fabgc

  • 1
    Not a permanent solution, nor an answer to your question, but call your ISP and ask them to change your IP address, and see if the attack goes away. – IQAndreas Dec 9 '14 at 1:10
  • 2
    A few important questions: 1. Are you behind a router, or is your computer directly connected to a modem? If you are behind a router, have you verified that your router's firewall is enabled? 2. Are you using WiFi? If so, is it protected with WPA2 and a strong passphrase? – tlng05 Dec 9 '14 at 2:28
  • 2
    We do not give recommendations for products. Nmap will not prevent scanning, it is itself a scanner. Just because the IP is from your country doesn't mean it is not a robot or virus. – schroeder Dec 9 '14 at 18:08
  • @IQAndreas, I can change my IP by restarting the modem/router but I still get a Port Scanning. – Omar Nofl Dec 10 '14 at 15:53
  • @IQAndreas, I have enabled the firewall, DosAttack but doesn't help, I think it made my internet connection slower! – Omar Nofl Dec 10 '14 at 15:57
4

This likely isn't as bad as it sounds. If you have your computer plugged directly in to the modem, random port scanning of IP addresses on the internet is extremely common. On my web server, I get about 30 to 100 invalid login attempts a day trying to get on my system.

Hackers look for low hanging fruit, so they will scan large swaths of the Internet looking for vulnerable systems. Just because you are seeing activity like this does not mean you are being targeted.

It does, however, illustrate the importance of protecting yourself from intrusions. I would recommend getting a router with a firewall and set that up to prevent attackers from being able to directly attempt to access your computer. This strategy is called defense in depth (now rather than simply exploiting your computer, they must first exploit the router and then try to exploit your computer and that gives you time to detect your router is compromised) and it will help protect you from attacks and prevent the port scans from reaching your computer (as they will instead be hitting the router's WAN port firewall instead.)

  • According to the OP the computer is behind a router, so random port-scanning bots should not be getting through. – tlng05 Dec 11 '14 at 18:27
  • 2
    @user54791 that's assuming that the router is actually a NAT router and not just a basic network router. Depending on the type of router, it may just be putting them on the same network as his cable modem and his cable modem may just be handing direct IPs to each computer on the network. – AJ Henderson Dec 11 '14 at 18:30
3

Just to add my two cents' worth...

Years since this question was first posted, I've had this problem with BitDefender starting this week (now running BitDefender Internet Security 2016). Today I had port scans from IP's (apparently) located in the UK (same as me), Spain, and Iran.

I could not understand why, when behind a router with the firewall enabled, that a port scan could even reach my machine. This led me to search online, and this post is very highly-ranked now in Google.

On checking every router setting, I found that it had port forwarding enabled for port 8888, forwarding traffic on that port straight to my machine.

It turns out this was from years ago, when I wanted to host gaming sessions. I had forgotten all about it, but clearly the script kiddies have earmarked it as a potential. Therefore if you're getting this warning, its another avenue to check and disable on the router.

0

Possibly anecdotal, but I have a cable modem which is nothing more than a bridge, basically: it translates from ethernet to DOCSIS, and hands an IP to whatever is on its ethernet port.

The amount of scanning, probing, and highly questionable traffic is pretty staggering: because of the way the modem works (and I am clearly not the only person to have this model of modem), many computers are sending SMB discovery (and various other) requests to a /22 the ISP uses for part of their residential network.

As others have pointed out, at this point, if you are on the internet, you are being scanned. By whom, and why, is kind of academic - and generally, difficult to figure out. You say you 'know' you are being 'attacked' by a person (based on the network source), but an equally reasonable explanation is that another person on your network was probed like you were, but didn't have anything to protect them. They then got infected/compromised, and an attacker in an entirely different country is causing them to scan you.

What to do about it might depend on how much effort you want to put in: most consumer-grade access points these days seem to come with some firewalling capabilities, so you could use that, or you could setup a node to do firewalling for you (for example, a Raspberry Pi 3 running hostapd and some firewall software, or a dedicated box with PfSense or something like it).

But basically, something will get hit with these probes, it is mostly a matter of how that something responds.

-1

You can't block the act of port scanning. Anyone can just pick random IP addresses and scan them looking for open ports. The best thing you can do is tune your Firewall/router to CLOSE/Disable any incoming and outgoing ports that are not being used. If there is no reason you need to remotely connect to your computer, then you should disable all incoming ports.

As far as the notification, I would probably disable it. As long as your firewall is set to block incoming ports, you're fine.

  • You mean to drop all incoming connections, not ports, right? – schroeder Dec 9 '14 at 18:09
  • Thanks for your response but does all routers support port/connections blocking? – Omar Nofl Dec 10 '14 at 16:21
-2

I was wondering whether Windows Updates could be the reason. We have people working in shared locations and I see these:

Firewall Blocked Scan Port Source IP: FE80:0000:0000:0000:F812:4A2D:648A:0E45

Firewall Blocked Scan Port Source IP: 172.16.101.168

Firewall Blocked Scan Port Source IP: 172.16.100.173

Firewall Blocked Scan Port Source IP: 172.16.100.190

Looking at WUDO post, it could be that Win10 update is configured to try to reduce the bandwidth on a few machines.

There is sadly enough not enough information in the BITDEFENDER report to easily flag the alert as a false positive.

  • 1
    The link doesn't talk about port scans, though. It appears to be a completely different issue. WUDO seeks out a single port. – schroeder Jul 17 at 10:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.