Re: [Full-Disclosure] Transamericana.org

From: Michael Rutledge (michael4447_at_gmail.com)
Date: 01/29/05

  • Next message: Michael Rutledge: "Re: [Full-Disclosure] Transamericana.org" 
    Date: Sat, 29 Jan 2005 08:53:31 -0600
To: Antonio Henrique Oliveira <tat@postmark.net>

    This may be a stretch (a large stretch), but someone could have
    planted something on your Windows box that is using pings as a covert
    channel (given that person has also taken control of the webserver
    that hosts transamericana.org and can watch the connection logs). Do
    you have a capture of the pings for someone to do a frequency analysis
    on?

    Also, you may want to post a list of your currently running processes
    in hopes someone may spot something that looks wrong.

    -Michael

    On Sat, 29 Jan 2005 12:03:39 +0000, Antonio Henrique Oliveira
    <tat@postmark.net> wrote:
    > Gregh wrote:
    > > ----- Original Message -----
    > > From: "Antonio Henrique Oliveira" <tat@postmark.net>
    > > To: <full-disclosure@lists.netsys.com>
    > > Sent: Saturday, January 29, 2005 9:46 PM
    > > Subject: [Full-Disclosure] Transamericana.org
    > >
    > >
    > >
    > >>Dear all,
    > >>
    > >>Please excuse me if this is a bit off-topic, but since this is the only
    > >>IT related mailing list I subscribe (apart from Secunia's) I decided to
    > >>post here.
    > >>
    > >>From sometime ago (I cannot determine exactly when this started to
    > >>happen), my workstation (WinXP SP2 PT, fully patched) has been sending
    > >>out ping requests to www.transamericana.org when I login to the machine
    > >>(right at the beginning of the login process, and only at that time).
    > >>
    > >
    > >
    > > Perchance is your DNS hosted there? Eg, your ISP's DNS servers?
    > >
    > > Greg.
    > No. The Linux box runs bind for the internal (and external) networks and
    > does direct queries to the root servers, not using our ISP's DNS. The
    > internal network is configured with DHCP and the DNS server for all
    > hosts is set to the linux box internal address. Also, my workstation
    > (and there are 5 more) is the only one doing this.
    >
    > Regards,
    > --
    > Anto'nio Henrique A. Proenca de Oliveira
    >
    > "Although we can never go back, like an old sweet song with a strong
    > refrain, memories remain" - (Someone)
    >
    > Please avoid sending me Word or PowerPoint attachments.
    > See http://www.fsf.org/philosophy/no-word-attachments.html
    > $Id: .signature,v 1.3 2004/07/14 08:08:10 tat Exp tat $
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Michael Rutledge: "Re: [Full-Disclosure] Transamericana.org"

    Relevant Pages

    • Re: OT: Networkisti
      ... not find host" just before those pings. ... I've done some tracerts which ... Both of them seem to be in Denmark. ... Bulldog's own DNS servers and it's hugely better. ...
      (uk.rec.motorcycles)
    • Re: [OT] resolv.conf and dhclient
      ... :> There's a 'require' in there; it doesn't seem like much of a stretch to ... It should also be able to figure out which wired LAN the machine is ... and assign the appropriate DNS servers. ... (Goodness knows why I originally dismissed ...
      (freebsd-stable)