Port 782 — The abandoned Mac OS X port that malware found

Port 782 has no official assignment from IANA. But that doesn't mean it hasn't been used.

What Range This Port Belongs To

Port 782 falls within the well-known ports range (0-1023), which is managed by the Internet Assigned Numbers Authority. These ports are supposed to be assigned to specific services by IANA. Port 782 never received that assignment.

But the well-known range still matters. Many operating systems restrict ports 0-1023 to privileged processes—you need administrative rights to bind a service to these ports. This was meant as a security measure. If only root can listen on port 782, the theory goes, users can trust that whatever's running there is legitimate.

That theory doesn't always hold.

What Actually Used Port 782

Apple's NetInfo (1990s–2007)

Apple used ports 600-1023 for Mac OS X RPC-based services, including NetInfo.¹ NetInfo was a directory service inherited from NeXT—a hierarchical database that stored user accounts, email configurations, network filesystems, printer settings, and other administrative data.²

NetInfo never had port 782 officially assigned. Apple just used it. That was common in the era before centralized port registration mattered as much as it does now.

In Mac OS X 10.5 (Leopard), released in 2007, Apple removed NetInfo entirely.³ Not deprecated—deleted. The database, the utilities, the manager application—all gone, replaced by Open Directory and LDAP.⁴

Port 782, along with the other NetInfo RPC ports, was abandoned.

Trojan Activity (Historically Observed)

After Apple stopped using port 782, security researchers observed trojan and virus activity on this port.⁵ The specific malware families aren't well-documented in public sources, but the pattern is common: trojans co-opt known or semi-known ports for command-and-control communication, hoping to blend in with legitimate traffic.

An unassigned well-known port that was previously used by a major operating system? That's an attractive target. It looks legitimate enough to slip past casual inspection, but it's no longer actively monitored by the vendor.

Why Unassigned Ports Matter

The Internet has 65,535 ports per protocol (TCP and UDP). IANA has officially assigned fewer than 2,000 of them in the well-known range. The rest—like port 782—exist in a state of ambiguity.

Unassigned doesn't mean unused. It means anyone can use it for anything. Apple used it for NetInfo. Malware used it for trojans. Your custom application could use it tomorrow. There's no registry, no conflict resolution, no guarantee that what you expect to find on port 782 is what's actually there.

This is why port scanning exists. This is why firewalls matter. And this is why binding to an unassigned well-known port is risky—you have no idea who else decided to use the same port, or why.

How to Check What's Listening on Port 782

On Linux or macOS:

sudo lsof -i :782

On Windows:

netstat -ano | findstr :782

If something's listening, you'll see the process ID. You can then investigate what that process is and whether it belongs there.

If nothing's listening, the port is closed. That's the most common state for port 782 in 2026—an artifact of computing history, waiting for the next thing to use it.