Open ports 111 and 911 on Siglent SDS1202X-E scope - Page 1
Forum section: electronics / testgear

author: Lacibácsi
author_rank: Contributor
timestamp: February 01, 2022, 05:17:35 pm
content: Hi all !Siglent SDS1202X-E scope with SW-version 1.3.26 attached to LAN.NMAP portscan in the range 1-10000 shows the obvious ports 5024 and 5025 (used for SCPI) are open plus two other ports 111 and 911.According to the web:Port 111 is normally used for the RPC portmapper service but can be misused for DDoS attacks.Port 911 is registered by the company X-Act for some cloud-service but was also used by trojans (for example Dark Shadow).I don't see the necessity for these two ports to be open.I understand that if port 911 was flagged once as a virus or backdoor for trojan does not necessarily means that it is actually used by intruders. However, it makes me concerned with the cleanness of the OS.What are your experiences with other Siglent products ? Do they also have those or other ports open ?Cheers

author: tautech
author_rank: Super Contributor
timestamp: February 01, 2022, 06:52:26 pm
content: Old discussion here:https://www.eevblog.com/forum/testgear/siglent-sds-1202x-e-network-security-issue/Official position:https://siglentna.com/internet-security-for-siglent-oscilloscopes-and-test-instruments/

author: Lacibácsi
author_rank: Contributor
timestamp: February 01, 2022, 08:30:26 pm
content: Quote from: PeDre on February 01, 2022, 06:30:39 pmThat could be a possible explanation. I will contact the manufacturer and ask for confirmation.

author: Lacibácsi
author_rank: Contributor
timestamp: February 01, 2022, 08:36:07 pm
content: Quote from: tautech on February 01, 2022, 06:52:26 pmThe first link points to other issues. (Note, the telnet port is no longer open.)The second to usual corporate BS about their commitment to security.

author: tv84
author_rank: Super Contributor
timestamp: February 01, 2022, 09:14:48 pm
content: Quote from: Lacibácsi on February 01, 2022, 08:36:07 pmYou come here concerned about ports being open... The manufacturer tells you to contact them if you have any security concerns with their product and you bash their intention as BS ?!?

author: 2N3055
author_rank: Super Contributor
timestamp: February 01, 2022, 10:00:37 pm
content: My advice: Before going going all ballistic on "huge security problems" first learn about how instrument control over TCP/IP works and what protocols are there.Another advice: NMAP just provides scan. Interpretation is left to the operator.Siglent have SAME or better commitment to security as any T&M company has. Oscilloscopes (or any piece of T&M equipment) are not secured, hardened devices to be put on the Internet.None of T&M protocols are secure... Devices also support easy enumeration by any host on LAN.I dare you to take ANY scope from any manufacturer and you will see same or more ports.Another fun fact: If youwant to connectto your scope forsome protocolyou will need aservice for that protocoland alistener listening on some port. Meaning if scopegives you a way of connecting to it, therewill beportsopen. I know, shocking.Therefore, for security reason I think we should disable all ports on all devices. Kind of defeats the point of having a device with Ethernet interface but hey... It would be secure.Most "security expert" "rules" are quite stupid generalizations. What is OK for a workstation is not ok for a server. Internal server is not the same as external web server. Etc. etc...Inside network T&M devices are fine. If they are security risk when and how they are connected to your network, fire the idiot that did your network.Simple as that.As example: Keysight MSOX3104T (look up the price while you're at it..) and only IPv4:Nmap scan report for xxx.xxx.xxx.xxxHost is up (0.00069s latency).Not shown: 993 closed tcp ports (reset)PORT STATE SERVICE VERSION21/tcp open ftp oftpd| ftp-anon: Anonymous FTP login allowed (FTP code 230)|_02-01-22 22:11 <DIR> webdata| ftp-syst:|_ SYST: Windows_CE version 6.0.|_ftp-bounce: server forbids bouncing to low ports <102580/tcp open http Microsoft Windows Embedded CE Web Server| http-ntlm-info:| Target_Name: k-mx3104t-71030| NetBIOS_Domain_Name: k-mx3104t-71030\x00|_ NetBIOS_Computer_Name: k-mx3104t-71030\x00|_http-title: MSO-X 3104T Oscilloscope|_http-favicon: Unknown favicon MD5: 5415808C5657E45613A4D0A6BD75D0CD| http-methods:|_ Supported Methods: GET HEAD|_http-server-header: Microsoft-WinCE/6.00111/tcp open rpcbind 2 (RPC #100000)| rpcinfo:| program version port/proto service| 395180 1 49152/tcp|_ 395183 1 49152/tcp443/tcp open tcpwrapped5850/tcp open unknown5900/tcp open vnc VNC (protocol 3.8 )| vnc-info:| Protocol version: 3.8| Security types:| None (1)|_ WARNING: Server does not require authentication49152/tcp open unknown 1 (RPC #395183)MAC Address: 00:30:D3:29:D0:E8 (Agilent Technologies)Device type: general purpose|media deviceRunning: Microsoft Windows Mobile 5.X|6.X, Microsoft embeddedOS CPE: cpe:/o:microsoft:windows_mobile:5 cpe:/o:microsoft:windows_mobile:6OS details: Microsoft Windows Mobile 5.0 - 6.1 or Zune audio player (firmware 2.2)Network Distance: 1 hopTCP Sequence Prediction: Difficulty=133 (Good luck!)IP ID Sequence Generation: IncrementalService Info: OSs: Unix, Windows CE 6.0; CPE: cpe:/o:microsoft:windows_ce

author: nctnico
author_rank: Super Contributor
timestamp: February 01, 2022, 10:44:21 pm
content: Quote from: 2N3055 on February 01, 2022, 10:00:37 pmAgreed. In a nutshell: Test equipment has no place on a network that goes beyond the room it is in. By design the widely used SCPI / VXI protocols have no security features in them at all. Anyone on the network can acces / control a piece of test equipment which is connected to the network. You don't need a backdoor or hack for that.

author: gslick
author_rank: Frequent Contributor
timestamp: February 02, 2022, 02:50:15 am
content: 911, What's Your Emergency?Help, my oscilloscope has been hacked!

author: Lacibácsi
author_rank: Contributor
timestamp: February 02, 2022, 08:06:35 am
content: Quote from: gslick on February 02, 2022, 02:50:15 amI understand that 911 is the emergency phone number in the US.However, 911 remembers me to the suicide attacks committed in 2001. That fits well to a trojan.Btw I didn't tell in my original post that the scope is hacked nor that there would be "huge security problems".