Re: Am I being hacked?

From: Copelandia Cyanescens (synesthesia_at_ix02x67invalid.net)
Date: 08/26/04 

Date: Thu, 26 Aug 2004 21:09:24 +0000

Brian wrote...

>> Some of the things you've related seem a little odd, but not so strange
>> they'd cause too much concern. The thing you should realize is that
>> these are not "connections". They're requests for connections, and your
>> machine probably telling the world no. There's really no harm in that,
>> although the ultra paranoid tend to want "stealth", or absolutely no
>> reply at all.
>>
> Thanks for clarifying. I did feel that I was being paranoid. However, it
> seems really strange that you have ports that test as 'stealthed' yet
> incoming TCP packets are 'Allowed' on those ports.

The term "stealth" is misleading. There's really nothing stealthy about
sticking your fingers in your ears and refusing to reply replying, and
while you may be stealthed when it comes to one type of activity, it's
obvious that you can't be stealthed to all activity or nothing would
work. You *must* respond so some things, or your connection is broken.

The online services that claim to test your firewall can be misleading
because of this. I don't know in particular which types of "ping" or
connection attempts something like GRC tests but I'd wager they're not
using ICMP timestamp request packets, for example. It's possible your
firewall might pass those, but block normal ICMP echo requests.

Also, ICMP packets aren't generally attached to a given port number. If
your firewall is truly reporting ICMP packets going out from port 'X'
then something is probably wrong with the firewall (one of the odd
things I was talking about). It may be reporting the ICMP type code, or
it may be reporting the *original* datagram, the incoming request, which
could have been tied to a port if it were something like a SYN request
or UDP "ping". Which your machine would naturally respond to with the
standard "I'm not listening". ;)

Bottom line is, I really don't think there's anything to be worried
about. Even if someone *is* probing you, they're not getting through.
And unless the level of that probe reaches a point where it's hampering
your ability to connect and becoming a denial of service attack, there's
probably nothing you can do about it anyway. Such is the nature of the
internet. If you want to really spook yourself, install something like
Snort and turn on all it's rules. Or simply do raw packet captures with
Ethereal/Packetyzer or such. You'd be amazed at what your firewall
*isn't* telling you, and even these types of utilities don't see every
bit of traffic that might cross your machine. ;) 

-- 
Our country, right or wrong. When right, to be kept right; 
when wrong, to be put right. 
                          -- Carl Schurz, January 17, 1872

Relevant Pages

  • Re: Kerio 2.1.5 Vulnerability
    ... >>person is able to get packets to any port past the firewall if they wish. ... >>I researched this and posted in varous Kerio forums, ... > Description: Other ICMP ...
    (comp.security.firewalls)
  • Re: merits of Reject vs. Drop
    ... ICMP DOS: ... The first thing that comes to mind is the possibility of a DOS attack on ... your firewall if an attacker can produce a large number of ICMP responses ... > I'm interested in comments on the merits of Rejecting packets vs. ...
    (comp.os.linux.security)
  • Re: 5 "Advanced" networking questions
    ... ICMP messages you appear to be interested in blocking. ... You appeared to want to turn your FreeBSD box into what's ... normally called a "stealth" system: ... were trying to *write* a firewall, or at least find a set ...
    (freebsd-hackers)
  • Re: Port 113?
    ... specific rules have been added to specifically allow packets ... a firewall that is allowing packets to move in and out in ... some compelling reasons to use TCP RST and ICMP, ... my level of security. ...
    (comp.security.firewalls)
  • Re: New type of ICMP packets
    ... :It's a Sonicwall hardware firewall and I have written to them asking them about ... :the identification of these packets as ICMP and await their response. ... firewalls set up to reject those UDP packets. ...
    (comp.security.firewalls)