This is why I set most services to listen only on localhost. When I need to expose them externally, I put them behind nginx with http basic auth. It's not top security by any means, but it does the job and provides enough security to stop stuff like this. It's like the old saying about outrunning a bear: you don't have to be the fastest guy, you just have to be faster than the slowest guy.