Re: [44net] 44Net Digest, Vol 3, Issue 34 - 44net

12 Feb 2014

44net-request(a)hamradio.ucsd.edu wrote:
...
  Subject:
 Re: [44net] 44Net Digest, Vol 3, Issue 33
 From:
 Steve Wright &lt;stevewrightnz(a)gmail.com&gt;
 Date:
 02/11/2014 11:41 PM

 To:
 44net(a)hamradio.ucsd.edu

  >
 >
 >  Any connects from ports
 >below 1024 are highly suspect for being reflection attacks so above I
 >block them all.  Another good trick is to block all outgoing connects to port
80 - this
 makes it quite inconvenient for a virus to download its payload.   In fact,
 block all outgoing connects, and allow only what YOU want to do. Well, I do have
that on the webserver at work.  What those injection-attacks on
PHP programs often do is include something that is fetched from a remote webserver.
As the webserver cannot make outgoing connects, this always fails.

However, for a typical hamradio computer that serves both as a server and a client,
blocking outgoing port 80 is a bit unpractical.

The attack is still/again going on, this time with source port 119:

21:49:23.716879 216.18.208.109 -> 44.137.41.97 TCP 52 nntp > http [SYN] Seq=0
Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:24.514385 216.18.208.109 -> 44.137.41.101 TCP 52 nntp > http [SYN] Seq=0
Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:24.819003 216.18.208.109 -> 44.137.41.97 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:25.914034 216.18.208.109 -> 44.137.41.97 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:25.927587 216.18.208.109 -> 44.137.41.101 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:27.009032 216.18.208.109 -> 44.137.41.97 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:27.349359 216.18.208.109 -> 44.137.41.101 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1
21:49:28.106015 216.18.208.109 -> 44.137.41.97 TCP 52 [TCP Port numbers reused] nntp
> http [SYN] Seq=0 Win=8192 Len=0 MSS=1460 WS=256 SACK_PERM=1

Rob