MediumExposed servicesBLWK-NET-002

A port commonly used by ngrok's local API is listening

What this means

Port 4040 is listening on ‹listen address› — most often ngrok's local web-inspector/API port, present while an ngrok tunnel is active. It's also Apache Spark's default UI port and is used by a few other dev tools, so this isn't conclusive on its own: if you're not running ngrok, check what it is. A loopback-only 4040 (the usual case for both ngrok and Spark) is excluded — this fires only when it's exposed on the network.

How to fix it

Check ps aux | grep ngrok and systemctl list-units | grep -i ngrok to find what started it.

Check it yourself

Run a scan and look for BLWK-NET-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads listening_ports and reports this check when:

port == 4040 and loopback_only == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1090

Related checks

• A VNC/remote-desktop port is listening · BLWK-NET-001
• A database or development service is open to the network · BLWK-NET-003
• No host firewall is filtering incoming connections · BLWK-NET-004