T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit_net.sh:67- Finding
Listener Detection and Risk Classification Can Understate Network Exposure
- Content
View full analysis
/dev/null 2>&1; then PORTS=$(ss -tulpen 2>/dev/null | grep -E 'LISTEN' | tr '\n' '|') elif command -v netstat >/dev/null 2>&1; then PORTS=$(netstat -tulpen 2>/dev/null | grep -E 'LISTEN' | tr '\n' '|') else PORTS=$( ( [ -r /proc/net/tcp ] && echo "fallback /proc/net/tcp"; ) 2>/dev/null) fi if echo "$PORTS" | grep -qE '0\.0\.0\.0|:::' ; then RISK="MEDIUM" fi ``` ### Technical Analysis The script filters both `ss` and `netstat` output exclusively for the text `LISTEN`. TCP servers normally use the `LISTEN` state, but UDP sockets are commonly reported as `UNCONN` or without a TCP-style listening state. Consequently, exposed UDP services can be omitted from `PORTS`. The fallback does not parse `/proc/net/tcp`, and it does not inspect `/proc/net/tcp6`, `/proc/net/udp`, or `/proc/net/udp6`. It merely reports that `/proc/net/tcp` is readable. This fails to enumerate actual bind addresses and ports when `ss` and `netstat` are unavailable. Risk classification only distinguishes wildcard-bound sockets as `MEDIUM`. It does not implement the documented `HIGH` classification for sensitive services such as SSH, ADB, or databases exposed on every interface. It also does not consider authentication, firewall state, proxy combinations, or hotspot exposure as described by the skill documentation. ### Attack Path 1. A service is configured to listen over UDP, or a sensitive TCP service is bound to `0.0.0.0` or `::`. 2. The user runs the audit to determine whether the device is safely configured. 3. A UDP service is removed by the `grep -E 'LISTEN'` filter, or a sensitive TCP service is classified only as `MEDIUM`. 4. If neither `ss` nor `netstat` is available, ...[truncated 783 chars]- Remediation
View remediation