Ive been recently trying to lock down my network at home and suspect that someone has hacked my linksys router because port 3128 seems to be open through the router and I have no knowledge setting or allowing anything like squid-http up. I try to run things as lean as possible for security. I checked my Mac OS while I was trying to figure things out and got the following. Note, I dont run any service (webserver, smtp server, DNS) or anything on my mac other than do my iOS work.
Along those lines, I did an nmap localhost on my mac os and got the following on two different runs (minutes apart):
Starting Nmap 6.25 ( http://nmap.org ) at 2014-12-14 20:23 MST Nmap scan report for localhost (127.0.0.1) Host is up (0.00032s latency). Not shown: 997 closed ports PORT STATE SERVICE 631/tcp open ipp 5859/tcp filtered wherehoo 9009/tcp filtered pichat
Then a couple minutes later:
PORT STATE SERVICE 7/tcp filtered echo 25/tcp open smtp 340/tcp filtered unknown 389/tcp filtered ldap 587/tcp open submission 631/tcp open ipp 900/tcp filtered omginitialrefs 1065/tcp filtered syscomlan 1087/tcp filtered cplscrambler-in 1096/tcp filtered cnrprotocol 1185/tcp filtered catchpole 3128/tcp filtered squid-http 4000/tcp filtered remoteanything 5910/tcp filtered cm 6001/tcp filtered X11:1 6009/tcp filtered X11:9 6123/tcp filtered backup-express 7402/tcp filtered rtps-dd-mt 8200/tcp filtered trivnet1 8500/tcp filtered fmtp 9099/tcp filtered unknown 9103/tcp filtered jetdirect 9200/tcp filtered wap-wsp 32773/tcp filtered sometimes-rpc9 50001/tcp filtered unknown
Then again a minute or so later, I only got
631/tcp open ipp
I realize IPP is the printer, but many of the others I dont know nor am I running as far as I know.
Im not a security expert, but Im having to drop back and figure out security much more lately because hacking has gotten so sophisticated and out of control. I know some things but not enough to keep up with all the hacks. This looks highly suspicious to me across the board.
Can anyone tell me which ones of these are legit and which arent or what to suggest next? Im thinking I might need to reload the entire OS but I would hate to take the few days to do so if its not necessary and I might be re-hacked again.