Re: Is my 520 being hacked?

He already told you "in order to maximize the chances that a customer will
actually be able to reach it with one of our client programs
"

ie. most firewalls allow outbound traffic on port 80.

Charles


On Tue, Apr 2, 2013 at 2:00 PM, Mark S Waterbury <
mark.s.waterbury@xxxxxxxxxxxxx> wrote:

Hi, James:

So, you have a TCP/IP sockets application listening on port 80, but it
is not an HTTP server?

Why choose port 80 for this? =-O

Why not just choose some other port number outside the range of
"well-known ports"? (Since this is your code that accesses this?)

Just my two cents ...

Mark S. Waterbury

> On 4/2/2013 1:36 PM, James H. H. Lampert wrote:

Yesterday, somebody mentioned that if a box runs a POP3 server, it's
going to attract random spammer traffic.

I can also say that likewise if you have port 80 open, even if it
doesn't actually serve web pages (e.g., it runs a web service instead),
it's going to attract robotic web traffic. Our authorization code server
runs on port 80, in order to maximize the chances that a customer will
actually be able to reach it with one of our client programs, but only
understands authorization code requests. It does, however, log every
single request it receives, whether it understands it or not, and I
don't think I've ever inspected one of its logs without seeing at least
one request looking for a web page. Ususally, in fact, there are more of
those than there are legitimate authorization code requests.

--
JHHL

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.