Re: Weird observation

Article View: chi.internet

Article #326

#326

From: Mark Anderson
Date: Mon, 20 Feb 2012 23:46

17 lines
2181 bytes

In article mea@nospambradnylion.com says...
> Anyway, something very weird has been happening.  An Android HTC device 
> has been transmitting one of those WHO has this IP? ARP messages.  

Oops.  I screwed up the ARP message.  It was:

Who has (My Centos gateway IP)?  Tell (DoD Network IP)

in quick succession resembling a buffer overflow exploit.

My gateway IP is given out via DHCP and is an esoteric number (i.e. not 
.1 or .254) so if the device knows the gateway, how can't it not know 
its given IP?  This resulted in a dump of all my private network names 
which is kind of a security issue.  I wonder if this is some warez app 
for Android.

Interesting anyway.  I thought I'd share.

Technical Details

Message-ID: <MPG.29aca558dd0378d49897ee@news.speakeasy.net>

Path:

arc1-ca.pugleaf.net!wr5ni49194pbc.0!nntp.google.com!news2.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.megapath.net!news.megapath.net.POSTED!not-for-mail

References: <MPG.29ac9b419cda81719897ed@news.speakeasy.net>

Show Full Headers

Complete Article Headers

X-Google-Thread: 10d5fa,952a21450c2c3f39
X-Google-NewGroupId: yes
X-Google-Attributes: gid837b0c45a0,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Received: by 10.68.226.10 with SMTP id ro10mr15995099pbc.6.1329781579920;
        Mon, 20 Feb 2012 15:46:19 -0800 (PST)
Path: arc1-ca.pugleaf.net!wr5ni49194pbc.0!nntp.google.com!news2.google.com!news1.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.megapath.net!news.megapath.net.POSTED!not-for-mail
NNTP-Posting-Date: Mon, 20 Feb 2012 17:46:19 -0600
From: Mark Anderson <mea@nospambradnylion.com>
Newsgroups: chi.internet
Subject: Re: Weird observation
Date: Mon, 20 Feb 2012 18:46:21 -0500
Message-ID: <MPG.29aca558dd0378d49897ee@news.speakeasy.net>
References: <MPG.29ac9b419cda81719897ed@news.speakeasy.net>
MIME-Version: 1.0
User-Agent: MicroPlanet-Gravity/3.0.4
Lines: 17
X-Usenet-Provider: http://www.giganews.com
NNTP-Posting-Host: 66.92.134.90
X-Trace: sv3-3MZ/KqTLuiS+MIi1cd3fLUyjPKafcvWjfb9jb3FGHzDDdJup11KN61mhLBhFhWiTyn7Z3cXLttNCX7w!Wk5djUORRn2SvMbPDm/Y/Vxt2EOecqPdiU/X+FwzLyaY4VN0Al2lRM2TgMiYChx0zDzBQj96OHAf!cfTUY2HMgKHL3fmJ2JwCq/u+tFNo
X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly
X-Postfilter: 1.3.40
X-Original-Bytes: 1731
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit

Reply to Parent Message