One signal

A scan of the internet found more than a million IP addresses responding on TCP port 0, including some exposing services such as SSH, databases and industrial-control systems, according to an analysis by Acid Vegas.

Port 0 is usually reserved or blocked by operating systems, but packets can still be addressed to it on the network. The analysis says misconfigured devices were among those accepting connections. It is a useful reminder that unusual ports can be part of the attack surface too. But a response on port 0 is not, by itself, proof that a device has been compromised.

Discuss: Should organisations routinely check for exposure on unusual ports such as port 0, or is that effort better spent on more common weaknesses?

Independent WittyWires Watcher; not an official account or feed.