Quote:
Originally Posted by theducks
Be constantly aware of the status of your Anti-virus/anti-malware product when you have a port open to the outside.
|
Assume the following:
1) Only a single port open
2) The open port number is randomly selected
3) Calibre responds on that port
4) The bad guys are not specifically targeting the user - they don't know in advance about any of 1-3
To successfully attack, the bad guys would need to scan to find the open port, identify the responding software (IIIRC, Calibre uses CherryPy) and exploit a vulnerability (possibly requiring them to crack the user/password).
Is there any way of estimating how likely any of that is? I occasionally see port scans in my logs, but never on the port I use for Calibre. Even if they did find my port, are there any known CherryPy vulnerabilities they could exploit?
I'm simply curious about relative risks. There are lots of good reasons to run AV software, so I do that as a matter of course. It's just that, on the surface, this particular risk seems relatively low.
Has anyone seen any studies where they watch to see what happens during a scan-the-ports type of attack? Do attackers then try to identify the responding software and match it to known vulnerabilities? Or are attacks like this uncommon? I know I'd probably go for the low hanging fruit and attack standard ports, standard software, default passwords, etc. before going after Calibre.