Re: pc compromesso [caso chiuso su ML debian-security]
Il 17/03/2014 00:04, ybed0@hushmail.com ha scritto:
Ho loggato il trafico con wireshark,
http://stashbox.org/1440698/wireshark
e contemporaneamente l'uscita di lsof
http://stashbox.org/1440699/lsof
e l'uscita di netstat -anp
http://stashbox.org/1440700/netstat
Non ho programmi in esecuzione. Cosa potrebbe essere?
Scusami tanto ....., ma a che pro mandare stesse email
quì e in inglese sulla ml debian-security ????
Per le prossime volte, cerca di chiedere ad una sola ML.
Se non trovi risposte allora chiedi ad un'altra ML.
Riguardo il tuo problema (che dovrebbe essere: ho installato
Debian, sono andato su Internet BAM! macchina compromessa),
per esperienza posso dirti che:
*AA*<<"la maggior causa di una compromissione di un sistema
è da ricercare su ciò che sta tra la tastiera e lo schermo.>>
Riporto quanto ti hanno risposto sull'altra ML, giusto
per rendere partecipe chi in questa ML ti ha risposto.
On Mon, Mar 17, 2014 at 7:10 AM, ybed0 wrote:
I had nothing running (eg browsers or other clients). What could it be?
Looking at the wireshark Statistics -> Protocol Hierarchy tool, it
appears that random machines on the Internet are attempting to connect
to TCP and UDP ports 54424 and 59520. Linux on your computer is
responding to these packets saying that the ports are closed. The data
in the UDP packets is one of these lengths: 20 30 67 101 103. The
longer packets are more interesting. The have some strings like ping1
and find_node1. A web search for them turns up this page where some
folks are discussing a similar issue. It appears that this is to do
with the Kademlia distributed hash table. If the IP you are now using
has ever used any of the peer-to-peer networks listed in the
implementations section of the Wikipedia page about Kademlia, you will
probably see these connections/packets. I guess they will gradually
reduce over time as your IP address gets dropped by clients.
http://es.comp.hackers.narkive.com/jcAAu5K5/puerto-13406
https://en.wikipedia.org/wiki/Kademlia
https://en.wikipedia.org/wiki/Kademlia#Implementations
-- bye, pabs http://wiki.debian.org/PaulWise
A questo messaggio te hai risposto:
I do not know how to thank you!
I am trying snort wireshark etc. to solve,
and did not even know the existence of these tools LOL
Maybe I overdid it with the paranoia.
I apologize for disturbing the list.
So you say that I do not have to worry too much, I'll try.
Again, thank you
Caso risolto e "tutti vissero felici e contenti" .....
ma poi .. hai capito allora quale era la causa ??
(IMHO *AA*)
Buon pranzo
Dario
Reply to: