Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 35 guests online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow Apple Airport Basestation Extreme Port Scan Always Shows 7070 554 21
EH-Net
May 21, 2013, 05:39:53 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
  Print  
Author Topic: Apple Airport Basestation Extreme Port Scan Always Shows 7070 554 21  (Read 7131 times)
0 Members and 1 Guest are viewing this topic.
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« on: January 26, 2011, 06:09:44 PM »

This is a problem I've had for years and never found a solution. I have an AEBS and whenever I do a portscan outside of my network it ALWAYS shows ports 7070 554 and 21 open, even when the host doesnt have those ports open. When I replace my AEBS with a regular Linksys router, these ports dont show up in my nmap scans. It's very strange.

I've only found a few posts talking about it but never any solutions. http://discussions.apple.com/message.jspa?messageID=7252565

Anyone else use an AEBS and experience the same behavior? I've tried wiping the device and starting fresh, I'm also running the latest firmware. When looking at a packet capture, you actually see the TCP handshake complete. Any other folks have this problem? Did you fix it?
Logged

Andrew Waite
Hero Member
*****
Offline Offline

Posts: 928



View Profile WWW
« Reply #1 on: January 27, 2011, 03:34:35 AM »

I don't use AEBS, but I have seen similar problems when scanning through other devices. Unfortunately only options I've found are:
  • Accept that the ports are a false positive (& possibly ignore an actual positive)
  • Replace the hardware, as you've tried
  • Shift scanning source to outside of the device causing issues (not always an option)

If anyone has a better solution, I'd also welcome the advice.
Logged

cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #2 on: May 26, 2011, 09:01:46 PM »

BTW - I still havent found a solution for this problem and have read in multiple places that it is an issue for others.

My workaround has been to put the AEBS in bridge mode and use another device for my FW/NAT. It's an extra hop in my network but at least I get accurate results until they fix it!
Logged

hell_razor
Jr. Member
**
Offline Offline

Posts: 90


View Profile
« Reply #3 on: May 27, 2011, 01:19:07 PM »

Hack naked! - PaulDotCom

Seriously.

It is likely that the device is proxying on one or all of these ports for some reason.  To verify, capture traffic before and after device and see what it looks like.  Also, set your http proxy and/or SOCKS proxy settings to your device IP address and see if it translates.  Just guessing here, no direct experience with that device.
Logged

A+, Network+, Server+, CISSP, GSEC, GCIH, GPEN, GCIA, GISP, GCFW
Pages: [1]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.086 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.