1

Ive been recently trying to lock down my network at home and suspect that someone has hacked my linksys router because port 3128 seems to be open through the router and I have no knowledge setting or allowing anything like squid-http up. I try to run things as lean as possible for security. I checked my Mac OS while I was trying to figure things out and got the following. Note, I dont run any service (webserver, smtp server, DNS) or anything on my mac other than do my iOS work.

Along those lines, I did an nmap localhost on my mac os and got the following on two different runs (minutes apart):

Starting Nmap 6.25 ( http://nmap.org ) at 2014-12-14 20:23 MST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00032s latency).
Not shown: 997 closed ports
PORT     STATE    SERVICE
631/tcp  open     ipp
5859/tcp filtered wherehoo
9009/tcp filtered pichat

Then a couple minutes later:

PORT      STATE    SERVICE
7/tcp     filtered echo
25/tcp    open     smtp
340/tcp   filtered unknown
389/tcp   filtered ldap
587/tcp   open     submission
631/tcp   open     ipp
900/tcp   filtered omginitialrefs
1065/tcp  filtered syscomlan
1087/tcp  filtered cplscrambler-in
1096/tcp  filtered cnrprotocol
1185/tcp  filtered catchpole
3128/tcp  filtered squid-http
4000/tcp  filtered remoteanything
5910/tcp  filtered cm
6001/tcp  filtered X11:1
6009/tcp  filtered X11:9
6123/tcp  filtered backup-express
7402/tcp  filtered rtps-dd-mt
8200/tcp  filtered trivnet1
8500/tcp  filtered fmtp
9099/tcp  filtered unknown
9103/tcp  filtered jetdirect
9200/tcp  filtered wap-wsp
32773/tcp filtered sometimes-rpc9
50001/tcp filtered unknown

Then again a minute or so later, I only got

631/tcp open ipp

I realize IPP is the printer, but many of the others I dont know nor am I running as far as I know.

Im not a security expert, but Im having to drop back and figure out security much more lately because hacking has gotten so sophisticated and out of control. I know some things but not enough to keep up with all the hacks. This looks highly suspicious to me across the board.

Can anyone tell me which ones of these are legit and which arent or what to suggest next? Im thinking I might need to reload the entire OS but I would hate to take the few days to do so if its not necessary and I might be re-hacked again.

  • 1
    When you set localhost as an nmap target, it is scanning your loopback address. By definition, these connections do not leave your computer. This is likely not how you want to start checking to see if you have been 'hacked'. If you want to see the ports that are open to the rest of the network, use your local network IP instead (e.g. nmap 192.168.1.100, or nmap 192.168.1.100 -p0- if you want to be thorough). – cremefraiche Dec 15 '14 at 5:14
  • Thank you for the information. I forgot about that. I did some reading and ran netstat -an | grep LISTEN and found port tcp4 .38568 *. listening. Its not open from outside my machine, but does respond if I locally telnet 192.168.1.x 38568, GET /index.html HTTP/1.0 saying: {eCC?ʞ-??q[???;~FGX?[PeZ!N?a??U??V??L?=J?ș?oT?b렑?'?-z I know Im not running any type of web server either. – Tim Dec 15 '14 at 7:35
  • Can you post the exact results of netstat -an | grep 38568 – cremefraiche Dec 15 '14 at 8:38
  • Did you try using lsof -i | grep LISTEN to see which processes have listening sockets? You could also try Nmap's -sV flag to see if it's a recognized service. – bonsaiviking Dec 15 '14 at 14:55
2

If you never set up squid-http, run the following command to see if it is actually the process using the port:
ps -auxf | grep squid.

If squid is running, then run: killall squid and take the steps to remove it from your computer.
Either way, you should close open ports on your router unless they are open for a reason.
Also block all inbound and outbound traffic on p38568 on your computer immediately. If nothing normal breaks, investigate it further, and keep monitoring your connections to see if it or any other odd port pops up.

I would be able to tell more with the result of: netstat -a | grep 38568

  • netstat -a | grep 38658: tcp4 0 0 .38568 *. LISTEN and the next line: udp4 0 0 .38568 *. – Tim Dec 15 '14 at 17:27
  • Sorry forgot to say, no squid process exists running ps augx – Tim Dec 15 '14 at 18:25
  • Using g is no longer necessary as it does the same thing as a. Make sure the documentation your are reading is up to date. That being said, I would focus on understanding how to set up iptables or UFW to take some of the guesswork out of this. Still not able to help you further without seeing the full output of netstating the process listening on 38568. – cremefraiche Dec 15 '14 at 23:25
  • 1
    After finding how do this on mac (lsof -i -P) I found Skype was the process listening on *.38658 Thank you all for your help. I learned a lot today. – Tim Dec 16 '14 at 0:57
2

You should read up on what filtered means. It does not mean that those ports are open, but rather that Nmap didn't receive a response from them. On a localhost scan, this is very unlikely, but could happen if you are scanning "too fast" I suppose.

For checking open ports on your own system, your first tool should be netstat. This will show you (among other things) all listening ports. Nmap by default only scans the 1000 most-common ports, so it misses about 64000 other possibilities. Unfortunately, OS X's netstat does not show the process that is actually listening. You can get this information from lsof, though, so try sudo lsof -i | grep LISTEN.

EDIT: Following feedback below, I should point out that a service which is listening only on localhost does not represent a threat from an external attacker. You can determine this by looking at the output of netstat -an: if the port is listed with a Local Address of *:38568 (or whatever port number) then the service will accept connections from outside your own machine. If the Local Address is 127.0.0.1:38568 or ::1:38568 then it is accessible only from the loopback adapter (i.e. not from the network).

  • -1 for not mentioning that that he is scanning an interface that does not communicate with other computers. – cremefraiche Dec 15 '14 at 5:17
  • @cremefraiche Without output from netstat there's no way to know whether the service is listening strictly on localhost or is also listening on other interfaces. I chose the answer that would represent the next step in diagnosing a potential problem. – bonsaiviking Dec 15 '14 at 15:04
1

I am creating another answer because my other is accurate in securing open connections, but I have discovered a more pressing problem with your question.

You are mixing up two different scans.

You include the whole scan in the first image. This is you scanning your loopback address (127.0.0.1), which as I commented earlier, does not connect to other computers as it is entirely on its own interface. It is used for processes to talk to each other internally.

The second scan, you do not include the beginning of the scan. Reading the question the first time, I did not catch this. It appears your second scan was either from another computer, or from your own computer with your local network IP.

These two scans will never look similar.

The third scan is clearly again your loopback address, and it appears you have closed two programs since the last localhost scan.

Conclusion: If you compare scans from different interfaces, you're going to have a bad time.

  • Bonus Tip: If you are not running a web server, and you do not know why you have an SMTP server running on an unfiltered port, run killall smptd. This is a huge target for attackers. – cremefraiche Dec 15 '14 at 13:28
0

Are you scanning you box from itself? If so you will not get an accurate picture of what is open sometimes,especially with Nmap as @bonsaiviking mentioned.So Make sure you scan fom another host on the same subnet.

Below is a tinky TCP service you don't need. Go to /etc/inetd.conf and comment them out. Look for any others as well.

7/tcp filtered echo 

Also most of the ports listed here arn't officialy registered so the listing is only what nmap thinks they "may" be. Look in /etc/services to find put what apple thinks they are. Some of them may be netinfo etc.

On port 25 It says that a smtp mail server is running. It is unusual in a desktop computer. But it might happened while installing some other application. If you want to know what program exactly runs on a port u may use this command

fuser -v 25/tcp

U can replace the port number with e required port you wanted to scan.Most of the programs are not actually required by us. You can kill them or uninstall the corresponding program if u want. Use this Link to find out how to kill a program by port in mac os. Nothing to worry so far as this is normal in mac os machines.

  • Your first paragraph is inaccurate. Running nmap localhost will always get different results than running nmap <your local IP>, but you will always get the same results if you use the local IP (ex. 192.168.x.x), whether from your own computer or another. – cremefraiche Dec 15 '14 at 13:33
  • Im running on a Mac, I cannot find /etc/inetd.conf. Im not very familiar with Mac Admin as much as Linux. fuser has only 3 options on mac, I tried all 3 with tcp/38568, each one said 'does not exist' – Tim Dec 15 '14 at 17:37
  • If it cannot find any services running on that port, then assume that the port is currently closed and no worries for u. U can use any command line editors to view the inetd.conf file similar to linux. – Anandu M Das Dec 16 '14 at 6:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.