Common attacks and weaknesses
- Stream keys sent in clear text.
Live video ingest (OBS, streaming platforms).
The device streams video frames over port 1935, continuously, as they are captured. It travels in clear text: anyone on the path can read it.
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| macromedia-fcs | 1935 | TCP, UDP | Macromedia Flash Communications Server MX | - | - |
// source: IANA service name and port number registry
Linux
sudo ss -ltnup 'sport = :1935' # process listening on 1935
sudo lsof -nP -i :1935macOS
sudo lsof -nP -i :1935
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 1935 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 1935 netstat -ano | findstr :1935
From another machine
nmap -p 1935 -sV <host> sudo nmap -sU -p 1935 <host> nc -zv <host> 1935
Block it in the firewall
sudo ufw deny 1935/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 1935" -Direction Inbound -LocalPort 1935 -Protocol TCP -Action Block # Windows
Live video ingest (OBS, streaming platforms).
Port 1935 is registered for TCP and UDP. In practice the service mostly uses TCP.
It is rated 3/10 (moderate) when exposed to the Internet. Stream keys sent in clear text. Use RTMPS (TLS).
On Linux run "ss -ltnup 'sport = :1935'", on macOS "lsof -nP -i :1935", and on Windows "netstat -ano | findstr :1935" to see the local process. From another machine, "nmap -p 1935 <host>" shows whether it is reachable.