Practical Internet of Things Security - Second Edition

Ports, protocols, and services

Many of the IoT-based botnets we have seen in the past few years use telnet to spread. These botnets often attempt a dictionary attack against the telnet service, opened on either TCP port 23 or port 2323. Disabling the telnet service and closing these ports will mitigate a substantial attack vector and force botnets and other attackers to attempt access via other means. A list of additional ports to lock down is provided here. In some cases, such as HTTP, it is not practical to close the ports so monitor for signs of malicious activity:

Port	Use	Malware type	Reference
21	Dictionary attacks on FTP service	Various
23	Dictionary attacks on telnet service	Mirai, others	https://isc.sans.edu/forums/diary/What+is+happening+on+2323TCP/21563/ ...