Open ports 111 and 911 on Siglent SDS1202X-E scope

[Lacibácsi]

Hi all !

Siglent SDS1202X-E scope with SW-version 1.3.26 attached to LAN.

NMAP portscan in the range 1-10000 shows the obvious ports 5024 and 5025 (used for SCPI) are open plus two other ports 111 and 911.

According to  the web:

Port 111 is normally used for the RPC portmapper service but can be misused for DDoS attacks.
Port 911 is registered by the company X-Act for some cloud-service but was also used by trojans (for example Dark Shadow).

I don't see the necessity for these two ports to be open.
I understand that if port 911 was flagged once as a virus or backdoor for trojan does not necessarily means that it is actually used by intruders. However, it makes me concerned with the cleanness of the OS.

What are your experiences with other Siglent products ? Do they also have those or other ports open ?

Cheers

[tautech]

Old discussion here:
https://www.eevblog.com/forum/testgear/siglent-sds-1202x-e-network-security-issue/
Official position:
https://siglentna.com/internet-security-for-siglent-oscilloscopes-and-test-instruments/

[Lacibácsi]

The port 111 is used for finding the LXI devices in the network. You send a UDP broadcast request to the RPC port 111 and when you get a response you ask via TCP for the VXI port for further communication. I assume that port 911 is the VXI port.

That could be a possible explanation. I will contact the manufacturer and ask for confirmation.

[Lacibácsi]

Old discussion here:
https://www.eevblog.com/forum/testgear/siglent-sds-1202x-e-network-security-issue/
Official position:
https://siglentna.com/internet-security-for-siglent-oscilloscopes-and-test-instruments/

The first link points to other issues. (Note, the telnet port is no longer open.)

The second to usual corporate BS about their commitment to security.

[tv84]

The second to usual corporate BS about their commitment to security.

   You come here concerned about ports being open... The manufacturer tells you to contact them if you have any security concerns with their product and you bash their intention as BS ?!? 

[2N3055]

My advice: Before going going all ballistic on "huge security problems" first learn about how instrument control over TCP/IP works and what protocols are there.
Another advice: NMAP just provides scan. Interpretation is left to the operator.

Siglent have SAME or better commitment to security as any T&M company has.  Oscilloscopes (or any piece of T&M equipment) are not secured, hardened devices to be put on the Internet.
None of T&M protocols are secure... Devices also support easy enumeration by any host on LAN.
I dare you to take ANY scope from any manufacturer and you will see same or more ports.

Another fun fact: If you want to connect to your scope for some protocol you will need a service for that protocol and a listener listening on some port. Meaning if scope gives you a way of connecting to it, there will be ports open. I know, shocking.
Therefore, for security reason I think we should disable all ports on all devices. Kind of defeats the point of having a device with Ethernet interface but hey... It would be secure.

Most "security expert" "rules" are quite stupid generalizations. What is OK for a workstation is not ok for a server. Internal server is not the same as external web server.  Etc. etc...

Inside network T&M devices are fine. If they are security risk when and how they are connected to your network, fire the idiot that did your network.
Simple as that.


As example: Keysight MSOX3104T (look up the price while you're at it..) and only IPv4:


Nmap scan report for xxx.xxx.xxx.xxx
Host is up (0.00069s latency).
Not shown: 993 closed tcp ports (reset)
PORT      STATE SERVICE    VERSION
21/tcp    open  ftp        oftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_02-01-22  22:11       <DIR>          webdata
| ftp-syst:
|_  SYST: Windows_CE version 6.0.
|_ftp-bounce: server forbids bouncing to low ports <1025
80/tcp    open  http       Microsoft Windows Embedded CE Web Server
| http-ntlm-info:
|   Target_Name: k-mx3104t-71030
|   NetBIOS_Domain_Name: k-mx3104t-71030\x00
|_  NetBIOS_Computer_Name: k-mx3104t-71030\x00
|_http-title: MSO-X 3104T Oscilloscope
|_http-favicon: Unknown favicon MD5: 5415808C5657E45613A4D0A6BD75D0CD
| http-methods:
|_  Supported Methods: GET HEAD
|_http-server-header: Microsoft-WinCE/6.00
111/tcp   open  rpcbind    2 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   395180  1          49152/tcp   
|_  395183  1          49152/tcp   
443/tcp   open  tcpwrapped
5850/tcp  open  unknown
5900/tcp  open  vnc        VNC (protocol 3.8 )
| vnc-info:
|   Protocol version: 3.8
|   Security types:
|     None (1)
|_  WARNING: Server does not require authentication
49152/tcp open  unknown    1 (RPC #395183)

MAC Address: 00:30:D3:29:D0:E8 (Agilent Technologies)
Device type: general purpose|media device
Running: Microsoft Windows Mobile 5.X|6.X, Microsoft embedded
OS CPE: cpe:/o:microsoft:windows_mobile:5 cpe:/o:microsoft:windows_mobile:6
OS details: Microsoft Windows Mobile 5.0 - 6.1 or Zune audio player (firmware 2.2)
Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=133 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OSs: Unix, Windows CE 6.0; CPE: cpe:/o:microsoft:windows_ce

[nctnico]

My advice: Before going going all ballistic on "huge security problems" first learn about how instrument control over TCP/IP works and what protocols are there.
Another advice: NMAP just provides scan. Interpretation is left to the operator.

Siglent have SAME or better commitment to security as any T&M company has.  Oscilloscopes (or any piece of T&M equipment) are not secured, hardened devices to be put on the Internet.
None of T&M protocols are secure... Devices also support easy enumeration by any host on LAN.

Agreed. In a nutshell: Test equipment has no place on a network that goes beyond the room it is in. By design the widely used SCPI / VXI protocols have no security  features in them at all. Anyone on the network can acces / control a piece of test equipment which is connected to the network. You don't need a backdoor or hack for that.

[gslick]

911, What's Your Emergency?

Help, my oscilloscope has been hacked!

[Lacibácsi]

911, What's Your Emergency?

Help, my oscilloscope has been hacked!

I understand that 911 is the emergency phone number in the US.

However, 911 remembers me to the suicide attacks committed in 2001. That fits well to a trojan.

Btw I didn't tell in my original post that the scope is hacked nor that there would be "huge security problems".