Is Teredo in my router a back door?
I use the school computer, which I bought from school, administered by the IT-department. I opened a port to my computer when I stumbled upon this:
It points to my computer IP. (I have a static IP to my router.) The contract says the IT-department isn't allowed to enter our computers via a backdoor, but I already caught them with a hidden administrator account that they explained that was there just in case I lost my password. (But I suppose they could change it without that backdoor because the school uses domain user accounts.) It would be no problem for them to install anything on our computers without us necessarily noticing...
Could this be another back door, or what could it be used for? There isn't any other UPnP entries to another of the computers (wirelessly connected) here on the router.
You shouldn't be worried about it. It looks as if Teredo is a IPv6 tunneling technology. According to this Wikipedia article it allows for IPv6 connectivity by tunneling IPv6 packets through your router encapsulated in IPv4/UDP datagrams (so you can still talk IPv6 even though your router doesn't).
Thank you, but why isn't Teredo set up in our personal router for anyone else? I have a wirelessly connected laptop with Windows 7 Ultimate too...
All this is quite simple to work around, just turn Teredo off. From 'Accessories', run 'Command Prompt' with a right-click 'run as Administrator', then when you get the command prompt, type in:
netsh interface teredo set state disable
exitand close the CMD prompt window. You will need a reboot to effect the change completely.
If you find you now can't go to your favorite website, chat club, MMORPG, etc., then you know what Teredo was actually doing, but why it is on your Win7 or higher machine is not really a mystery - it is 'down talking' to IP4 systems using it (in theory -however, in reality, since this functionality is already built-in to Windows without Teredo, chances are, it's some junky crawler you picked up....ewww....iccck!)
If you need to turn Teredo back on for some legitimate reason, just enter:
netsh interface teredo set state enable
at that same CMD prompt. SIMPLE! (oh, and reboot...of COURSE).
Teredo can be used for malicious purposed. unfortunately without seeing a traffic capture of what is actually being send across the port it is difficult to determine what its purpose is. I recommended using wireshark to capture traffic destined for that port on the local machine. It is also possible that it simply is Teredo. I will be happy to assist you with traffic analysis if necessary. At the end of the day if your not using Teredo an you have no use for the port than simply close it up.
Thanks :) I don't know what uses Teredo, but anyway I can't turn it off. I can only turn off all of the UPnP. Skype uses one there too, unfortunately. But I'll capture some traffic and check what it is!
I used udp.port == xxxx and it says SRC and DST is just some letters and numbers, but if I click one it says in the IPv4: DST: 188.8.131.52, and after a lookup it says it's Microsoft in the US.
Alright, so the letters and numbers sound like an IPv6 address. Should look something like this 3ffe:1900:4545:3:200:f8ff:fe21:67cf. Did you by chance agree to be part of the Microsoft Customer Experience?
Sounds as if microsoft is collecting data:http://www.microsoft.com/products/ceip/EN-US/default.mspx
I ran across also this mysterious Toredo port which one day just popped up on my "vintage" XP box. After a bit of searching now I understand that Win7/8 creates these ports but how on earth did it open on my XP? Wellllll, one day I shared a drive on my Win7 laptop to my XP box which evidently opened up the Toredo port. Mystery solved :)
***Update: Well it turns out that when I have UPnP enabled on the XP box it installs Toredo from the Win7 shared drive network which has uTorrent installed on it. So basically the culprit is uTorrent which seems to be spreading Toredo thru local network connections/shares. I've read about uTorrent spreading all kinds of malicious apps. So beware sharing/conecting a machine on your local network and also UPnP enabled, it can spread Toredo!!!