Sometimes I wish I wasn’t curious about things…. The other night I was working on something on the testbox in the back room and saw the switch lights flickering fairly actively between the server and the internet gateway. At first I thought maybe it was some mail coming in, but it was awfully persistent. So, I started nosing around. I saw that sshd was showing up in the process list and on checking /var/log/messages…. found hundreds of ongoing attempts to break in through the ssh server. (sigh….) Now, there was a time when I’ve kind of snickered when I’ve seen these futile attempts, because I have a VERY short list of allowed ssh users. (AllowUsers username can be set in /etc/ssh/sshd_config) But, this was fairly persistent and there was more variety to the usernames than I’m used to seeing.
Tag: IP
-
VMware Server
OK – just fresh off solving the reason I couldn’t get vmplayer to start on my 1Ghz AMD 64 1GB of memory machine…. I started looking at vmserver. (RC1). Now, vmplayer is a free download (so is vmware server). I’m really liking what I see from vmware server and am pretty sure I’m going to stick with it over the player. There are quite a few interesting features and I’ll try to give a skim over them. For starters, there is a management console that gives you the ability to connect to a vmware server on a different host (with credentials as a user on that system), or the localhost. On the localmachine it shows what virtual machines you have configured and gives you the chance to create another one, open an existing one not in the list, or tweak host settings.
-
I’ve NEVER liked UPNP…. now I have another reason….
I remember the first Windows XP vulnerability was a Upnp vulnerability. I have made one of my first visits on any new XP system a visit to grc.com to disable it on an XP workstation. But, it’s the great thing – makes life so much easier for setting up network devices. “You just don’t like it cause it puts you out of business….” It looks like Upnp is a really “malicious hacker friendly” kind of thing, especially when it’s installed and running on a gateway router… let’s say you have a hardware firewall with Upnp. Normally, you plug in an IP camera and maybe the IP camera uses Upnp to open a port so it’s accessible from the outside world. Nice, simple right? Well… what if you download a “browsing experience enhancement toolbar” that opens up another port on the firewall so you can act as a mail relay?
-
RealVNC 4.1.1 and prior exploits on the loose
As reported over the last several days, there is a critical problem with RealVNC 4.1.1, there is NOW an exploit in the wild for RealVNC 4.1.1, that SANS is looking for more information on. There are updates from RealVNC for all affected product lines. Other VNC implementations have not been reported to be affected. Only (as far as I know), RealVNC 4.1.1 on Windows (prior versions may be, but the initial report didn’t indicate 4.1.0 to be vulnerable.) Don’t take the last sentence to give an excuse NOT to check, check if you have updates for your vnc product.
-
Another trackback spam storm overnight….
All of the the swarms of trackback spam seemed to last an hour give or take a few minutes, so it does look kind of like “rent-a-bot” activity, lots of different IP addresses, trackback spam sites seem to have a common theme – the last batch was insurance type sites…. a sampling of about three or four found that they were all cloaked redirects for the same site/page …. http://www.finance-portal-online.com/insurance.php ALL are registered with moniker.com and all the insurance related domains being spammed (that I checked) redirect to the finance-portal-online.com site above which is registered to a “Bill Bilton” whose email is given as bill at top-support.net ….
-
Google Sitemaps continue to improve
I’ve noticed that the information in Google Sitemaps continues to improve. For instance in the list of search terms and the average top position which is something that previously was quite tedious to figure out (search and then click until you find your page referenced…) It also gives content analysis of your site, and analysis of incoming links to your site (what words are there.) The average search term rank though is probably the most valuable addition I see. They’ve also….
-
What a week….
I think it’s time to pass along a long story of what’s gone on over the last week or so here and some of the reasons there hasn’t been anything posted. Generally, I would say that work has been busy, but something happened last week that went a bit beyond the day to day and there might be some items worth considering. The short story is my internet access was suspended and I’ve been only connected to the internet for 30 minutes or so at a time to retrieve mail and spent dozens of hours reviewing system logs…. but the long story is needed to sort out what has happened. I’m not going to break this up into multiple posts, but I may pull out some details for seperate posts at some point.
-
Network security – what does arp spoofing mean for wireless?
So, if you haven’t already had enough cause to tighten your wireless security…. we’ve been talking about arp poisoning (spoofing) and the basic conclusion is that IF an attacking machine is on the same subnet as your machine (same IP address range), they can “own” all traffic from you machine to the gateway. It doesn’t matter if you’re using wireless or wired for your machine. As a demonstration I connected my laptop to my wireless access point…..
-
Network Security – Defenses against arp spoofing
So, we’ve spent a couple articles talking about arp spoofing. It sounds really bad, it’s a frighteningly easy way to do a “mitm” or man in the middle attack and anyone using arp spoofing could capture ALL network traffic including passwords. There’s got to be an easy fix right? Um…. well. This is not something you’re going to want to read, but there aren’t a lot of good options. It’s possible to setup a static arp table. With a static arp table, a machine ( switch/router ) has a list of known good MAC addresses and which IP addresses they should match.
-
Network Security – Arp spoofing
So…. what is arp spoofing (poisoning)…. and what are it’s implications? ARP spoofing involves tricking a machine into thinking that you’re machine is, yet another. Let’s put this in IP address terms. Let’s say that 192.168.0.1 is the default gatway on the network and 192.168.0.150 is our target. We are given another network address – say 192.168.0.250…. Arp spoofing would tell 192.168.0.150 that OUR network adapter is the place to send information destined for 192.168.0.1, (and we could also tell 192.168.0.1 that WE are the rightful recipient of data sent to 192.168.0.150). These is done by offering up our MAC address as the legitimate desitination to each machine through a crafted ARP response.