Niebezpieczne porty
Niebezpieczne porty które należy zablokować na zaporze
| Port | Protokół | Przyczyna zamknięcia |
| 25 | smtp | Simple Mail Transfer Protocol – to zdecydowanie chcemy zablokować. Nawet TPSA zdecydowała się na ten ruch. Inaczej nasz IP może łatwo trafić na RBL’e. Otwieramy ten port tylko dla serwerów poczty. |
| 135 | epmap | DCE endpoint resolution – port numer 1 w ilości ataków przez różnego rodzaju wirusy i robale |
| 137 | netbios-ns | NETBIOS Name Service |
| 138 | netbios-dgm | NETBIOS Datagram Service |
| 139 | netbios-ssn | NETBIOS Session Service |
| 420 | Smpte | SMPTE, W32.Kibuv.Worm, [trojan] Incognito, [trojan] Breach |
| 445 | microsoft-ds | Microsoft-DS (SMB) – Raczej blokujemy |
| 887 | iclcnet_svinfo | W32.Huayu |
| 1080 | Socks | SOCKS (Proxy) |
| 1088 | cplscrambler-al | Trojan.Webus.D/E/H |
| 1409 | here-lm | Here License Manager (Serwer Licencji) |
| 1433 | ms-sql-s | Microsoft-SQL-Server |
| 1434 | ms-sql-m | Microsoft-SQL-Monitor |
| 1639 | cert-initiator | W32.Bofra, W32.Mydoom |
| 1971 | netop-school | Bifrose Backdoore |
| 2080 | autodesk-nlm | Autodesk NLM (FLEXlm – Serwer Licencji) |
| 2345 | Dbm | DBM |
| 3127 | ctx-bridge | Novarg(Mydoom), W32/MyDoom, W32.Novarg.A backdoor, W32.Mockbot, W32.Solame, W32.HLLW.Deadhat |
| 3306 | Mysql | MySQL |
| 3410 | networklenss | W32.Mockbot, Backdoor.Optixpro – remote access trojan. |
| 3436 | GuardControl Exchange | Backdoor.Netjoe – remote access trojan. |
| 3437 | autocueds | Backdoor.Netjoe – remote access troja |
| 3515 | must-backplane | W32.Spybot |
| 4191 | Unassigned | Sdbot, Backdoor.Sdbot.AH, Reserved(TCP), Dual Stack MIPv6 NAT Traversal(UDP) |
| 4646 | unassigned | Nemog |
| 4751 | Spocp | W32.Beagle, Beagle.U, Mitglieder |
| 5000 | commplex-main | Mnóstwo syfu |
| 5300 | hacl-hb | HA cluster heartbeat – wycinamy heartbeat’y szkoda pasma |
| 5424 | beyond-remote | Beyond Remote, W32.Mydoom |
| 5425 | br-channel | Beyond Remote Command Channel – Takie VNC wywalamy I tak nie będzie działać bez 5424 |
| 5554 | sgi-esphttp | SGI ESP http, W32.Sasser, W32.Dabber |
| 5665 | unassigned | MOHAA Reverend, W32.Kipis |
| 6129 | unassigned | W32.Mockbot, DameWare |
| 6564 | unassigned | Sdbot – a.k.a IRC-Sdbot, Backdoor.IRC.SdBot, w32/Akbot |
| 6565 | unassigned | Nemog backdoor, W32.Mydoom.Q@mm. |
| 6631 | unassigned | Backdoor.Sdbot.AG |
| 6664 | irc (unoficial) | W32.Zotob, Futro |
| 6665 | Ircu | IRCU, Całe mnóstwo Trojanów backdorów itp. |
| 7955 | unassigned | W32.kibuv.b trojan, W32.Kibuv |
| 8181 | unassigned | W32.Erkez, Zafi.D Backdoor ale uwaga Cisco PIX Device Manager i Y-cam Wireless IP Camera |
| 8967 | unassigned | Dabber Worm backdoor |
| 9136 | unassigned | Sdbot |
| 9604 | unassigned | W32.Kibuv.Worm |
| 9898 | monkeycom | W32.Dabber, Backdoor.CrashCool |
| 9996 | palace-5 | W32.Sasser.Worm, W32.dabber.a trojan |
| 9999 | distinct | Backdoor.Lateda.B, The Prayer 1 trojan, BlitzNet, Oracle, Spadeace, Beasty |
| 10100 | itap-ddtp | backdoor.ranky.o, Control Total, GiFt trojan, Scalper, Trojan.Dasda, Ranky, ale UWAGA!!! VERITAS ITAP DDTP |
| 10888 | unassigned | Trojan.Webus.C |
| 11768 | unassigned | Dipnet (a.k.a. Oddbob) trojan. |
| 12321 | warehouse-sss | Protoss trojan, Roxe, ale też Warehouse Monitoring Syst SSS |
| 15118 | v2g-secc | DIPNET trojan backdoor |
| 16661 | unassigned | Backdoor.Haxdoor |
| 19381 | unassigned | W32.Watsoon |
| 24681 | unassigned | Backdoor.Lowtaper |
| 29147 | unassigned | Backdoor.Sdbot.AI |
| 31337 | unassigned | Długa lista http://www.speedguide.net/port.php?port=31337 |
| 32440 | unassigned | Backdoor.Alets.B trojan |
| 36183 | unassigned | Backdoor.Lifefournow trojan |
| 40403 | unassigned | W32.Randex, ale też jakies gry Brothers in Arms Online |
| 44444 | unassigned | Prosiak trojan |
| 44445 | unassigned | W32.Kibuv |
| 55000 | unassigned | Backdoor.Roxe |
Dodaj komentarz





