Ports, protocols, and services

Many of the IoT-based botnets we have seen in the past few years use telnet to spread. These botnets often attempt a dictionary attack against the telnet service, opened on either TCP port 23 or port 2323. Disabling the telnet service and closing these ports will mitigate a substantial attack vector and force botnets and other attackers to attempt access via other means. A list of additional ports to lock down is provided here. In some cases, such as HTTP, it is not practical to close the ports so monitor for signs of malicious activity:

Port  Use Malware type Reference
21 Dictionary attacks on FTP service Various
23 Dictionary attacks on telnet service Mirai, others https://isc.sans.edu/forums/diary/What+is+happening+on+2323TCP/21563/ ...

Get Practical Internet of Things Security - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.