1

What can someone do if i write a program to open a TCP port and run, lets say an echo server? Can some one access data on my system? or any other risk of opening port?

1
  • This seems like a reasonable basic question, and I was a bit appalled to see it down voted and at -1 when there 9 up votes on the answer. If you find the answer useful, maybe don't kick the asker in the shins?
    – Glenn
    Jun 30 '12 at 21:49
9

It depends on how well the program is written and under what credentials your server program runs as. For instance say you allocate a fixed-length buffer to read from the socket, and then you read in more than the allocated size, it might be possible to craft a server requests that overruns the buffer on the stack and overwrites the return address. At that point the hacker could re-point the return address to be on the (overrun) buffer, which could contain actual code. Then, if your server program runs as root/administrator you're letting the code being executed in that context.

1
  • Note, while this is actually possible it's also getting more unlikely as OSes/Apps use the NX bit, and measures are taken to avoid buffer overflow problems. Also, most Linux distros have known priv elevation exploits, so even a user process might lead to rooting.
    – Chris S
    May 16 '12 at 12:39
0

If your program is vulnerable, a hacker could possibly execute code on your system with privileges of your program. Or perhaps he could arrange a DoS attack (your program would consume all CPU or memory or disk space and everything would stop working and collapse :-) ).

In the past one also could find a bug in the OS TCP/IP stack and exploit it. So even if your program was perfect, there was a chance of getting into troubles with an open port. However I haven't heard of such bugs for a while now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.