1080

Port 1080/tcp is the conventional SOCKS proxy port, registered with IANA as socks with the description "Socks" on both TCP and UDP, contact Ying-Da Lee (NEC), and a blank reference field. SOCKS is a circuit-level proxy protocol that sits between the application and transport layers, forwarding TCP connections (and, in SOCKS5, UDP) through a proxy server. The protocol was originally designed by David Koblas and presented at the 1992 USENIX Security Symposium; SOCKS4/4a were extended by Ying-Da Lee, and SOCKS5 — adding authentication (GSSAPI, username/password), IPv6, and UDP association — is standardized in RFC 1928 (March 1996), which itself notes that the service is conventionally located on TCP port 1080. Legitimate uses are everywhere: SSH dynamic forwarding (ssh -D), Tor's local SOCKS interface, and enterprise proxies. Security-wise, the problem is open or misconfigured SOCKS proxies: an unauthenticated SOCKS listener on 1080 is a ready-made tool for traffic anonymization, spam relay, credential stuffing, and malware C2 pivoting, and MITRE ATT&CK Proxy (T1090) documents adversaries embedding SOCKS proxies in tooling (SombRAT, ZxShell, and others). The historical WinGate open-proxy abuse is the canonical example, and buffer-overflow flaws in NEC's SOCKS5 implementation have allowed remote code execution. Compromised network gear has also been mass-converted into proxy infrastructure: following MikroTik's CVE-2018-14847, Qihoo 360 Netlab reported in September 2018 that hundreds of thousands of routers had a SOCKS proxy maliciously enabled. For an analyst, an open 1080 accepting unauthenticated connections is an open-proxy liability, and an internal host that suddenly starts speaking SOCKS may be acting as a pivot or relay node; test for authentication and restrict SOCKS to localhost where it is used only for SSH or Tor tunneling.

IANA assignment

socks — "Socks"; reference (blank — no RFC cited in IANA registry); contact Ying-Da Lee (NEC); registered for 1080/tcp and 1080/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry (confirmed verbatim from live CSV this session)

Range class

registered (1024–49151)

Prevalence

in Nmap's top-ports lists (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

3128 (Squid HTTP proxy), 8080 (HTTP proxy/alt), 9050 (Tor SOCKS), 9150 (Tor Browser SOCKS)

Primary use

SOCKS proxy (SOCKS4/4a/5)

Other/unofficial uses

SSH dynamic forwarding (ssh -D), Tor local SOCKS, enterprise proxies [Well-established]

Security implications

open/misconfigured SOCKS proxies abused for anonymization, spam, credential stuffing, C2 pivoting (MITRE T1090); historical WinGate abuse; NEC SOCKS5 RCE flaws; MikroTik CVE-2018-14847 mass proxy enablement (Netlab, Sept 2018)

Typically seen on

proxy servers, Tor clients, compromised hosts used as proxies, network gear

Analyst note

An open 1080 accepting unauthenticated connections is an open-proxy liability; an internal host suddenly running SOCKS may be a pivot/relay. Test for auth and restrict SOCKS to localhost where used only for SSH/Tor.

Port 1080/udp is registered with IANA as socks with the description "Socks," assignee and contact "Ying Da Lee," and blank reference, registration-date, and modification-date fields — dual-registered alongside 1080/tcp for the same SOCKS proxy service. SOCKS is a circuit-level proxy protocol; the version that matters for UDP is SOCKS5, defined in RFC 1928 (M. Leech et al., March 1996), which added the UDP ASSOCIATE command, IPv6 support, and pluggable authentication (username/password per RFC 1929, GSSAPI per RFC 1961). The subtlety for an analyst is that the UDP relay does not actually flow over 1080/udp in normal SOCKS5 operation: a client first opens the TCP control channel on 1080/tcp, issues UDP ASSOCIATE, and the server returns a dynamically allocated relay port (Cisco's Secure Web Appliance, for example, uses the 16000–16100 range) over which datagrams are then proxied. The 1080/udp registration mirrors the TCP assignment as standard IANA practice; some implementations do listen on it for the initial association. SOCKS5 carries no built-in encryption, so an exposed, unauthenticated, or misconfigured SOCKS service is the core risk — it lets any external client relay arbitrary TCP/UDP traffic and borrow the host's IP for spam, scanning, or origin obfuscation. Port 1080 is continuously scanned (SANS ISC logs persistent inbound probes; Nmap's socks-open-proxy and socks-methods scripts fingerprint open relays), and it has a long malware lineage — Bugbear.B (2003), Bagle.AF and Win32.Deadhat.A (2004) all abused or scanned port 1080 — so a responsive 1080 today warrants checking for an open-proxy misconfiguration or compromise.

IANA assignment

socks — "Socks"; reference (blank — no RFC cited in IANA registry); assignee/contact Ying Da Lee; dual-registered 1080/tcp + 1080/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (the IANA Service Name and Transport Protocol Port Number Registry, row 1804)

Range class

registered (1024–49151) [Confirmed] — 1080 falls in the IANA registered range

Related ports

1080/tcp (the SOCKS control channel); contrast HTTP proxy 3128/8080 and Tor SOCKS 9050

Primary use

SOCKS proxy service; UDP forwarding pathway of SOCKS5 (UDP ASSOCIATE)

Protocol standard

SOCKS5 (RFC 1928, 1996) introduced UDP support; SOCKS4/4a were TCP-only; auth via RFC 1929 (user/pass) and RFC 1961 (GSSAPI)

Common software

SOCKS5-capable servers/clients — Dante, Shadowsocks, 3proxy, SSH dynamic forwarding (-D), Tor (default 9050, configurable), proxychains, redsocks, chisel

Security implications

SOCKS5 has no built-in encryption; an unauthenticated/misconfigured open SOCKS relay lets any client proxy arbitrary TCP/UDP (spam, abuse, origin hiding, on-path interception); actively scanned via Shodan/Censys/Nmap socks-open-proxy + socks-methods

Exposure/scanning

continuous internet-wide scanning; SANS ISC records persistent inbound attempts (individual sources logging hundreds of daily hits)

Malware associations

historical — Bugbear.B worm (2003, opened 1080 for C2), Bagle.AF (2004, SMTP relay), Win32.Deadhat.A (2004, scanned for it); modern malware favors dynamic/high ports but open SOCKS proxies remain a target

Typically seen on

proxy servers, VPN/tunnel endpoints, SSH dynamic-forward hosts; an unexpected open 1080 may indicate an open-proxy misconfiguration or compromise

UDP specifics

actual datagram relay uses a dynamically assigned port (e.g. 16000–16100 on Cisco SWA), not 1080/udp itself; 1080/udp registration mirrors TCP; some implementations listen on it for the initial association [Likely] — Cisco SWA SOCKS doc, Wikipedia SOCKS

Analyst note

1080/udp is the registered SOCKS port, but real UDP relay typically uses a dynamic high port negotiated over 1080/tcp; treat an exposed unauthenticated SOCKS service as the primary concern.