Open no listening port the product does not need

How to do it

Many mass takeovers of devices start with a service left on from development, such as telnet with a known login. Build release firmware without those services instead of only turning them off in settings. Let the device reach the cloud by connecting outward, so it needs no open port for remote access. A local API that the app uses must check the owner's key on every request. ETSI EN 303 645 provision 5.6-1 makes disabling unused interfaces mandatory, and 5.5-5 requires authentication for security changes over the network. The same idea for servers is close admin ports to the internet.

Examples

Python example

import socket

ALLOWED_TCP_PORTS = {443}

def open_tcp_ports(host: str, ports=range(1, 65536)) -> set[int]:
    found = set()
    for port in ports:
        with socket.socket() as probe:
            probe.settimeout(0.2)
            if probe.connect_ex((host, port)) == 0:
                found.add(port)
    return found

def test_only_listed_ports_open():
    assert open_tcp_ports("192.0.2.10") == ALLOWED_TCP_PORTS

Go example

var allowedTCPPorts = map[int]bool{443: true}

func UnexpectedPorts(host string) []int {
	var unexpected []int
	for port := 1; port <= 65535; port++ {
		conn, err := net.DialTimeout("tcp", net.JoinHostPort(host, strconv.Itoa(port)), 200*time.Millisecond)
		if err != nil {
			continue
		}
		conn.Close()
		if !allowedTCPPorts[port] {
			unexpected = append(unexpected, port)
		}
	}
	return unexpected
}

How to check

A release test scans every TCP and UDP port of a fresh device and of one after setup. The open ports equal the model's list, and each refuses a request without credentials.

Sources

• ETSI EN 303 645 V3.1.3, provisions 5.6-1 and 5.5-5
• NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline

Related rules

• INF-31 Close admin ports to the internet in Infrastructure and environments
• IOT-26 Announce as little as possible on the local network in Connected devices