🚀 go-pugleaf

In article mea@nospambradnylion.com says...
> Anyway, something very weird has been happening.  An Android HTC device 
> has been transmitting one of those WHO has this IP? ARP messages.  

Oops.  I screwed up the ARP message.  It was:

Who has (My Centos gateway IP)?  Tell (DoD Network IP)

in quick succession resembling a buffer overflow exploit.

My gateway IP is given out via DHCP and is an esoteric number (i.e. not 
.1 or .254) so if the device knows the gateway, how can't it not know 
its given IP?  This resulted in a dump of all my private network names 
which is kind of a security issue.  I wonder if this is some warez app 
for Android.

Interesting anyway.  I thought I'd share.

Mark Anderson <mea@nospambradnylion.com> wrote:

> in quick succession resembling a buffer overflow exploit.

Probably not.

You left out more info than you gave, for one, how did you determine it was
a HTC doing this? Looked up the mac address?

You also said in the other post DoD on 22, was it 224 by any chance?
Although 22.0.0.0/8 still seems to be assigned to something called Defense
Information Systems Agency, the 224.x stuff shows up on many things for the
multicasting crap.

It's not clear how you have the monitoring setup, but there are just a lot
of "chatty" things out there that use their own methods. Try doing a ping on
a broadcast address (192.168.1.255 usually) and see the results.

Some crap like the Boxee Box had flawed discovery modes, in one firmware
they had it simply pinging all the addresses (192.168.1.1 to 254) in
sequence, over and over again, anything that answered it would try to
connect to some port to see if it supported DLNA (video server services).
This pissed off a shitload of people with certain HP printers because if
they were in sleep mode, it would wake them up.

It's probably some neighbors phone periodically looking for wifi networks,
trying to connect, fails and goes on it's merry way to somewhere else.

-bruce
bje@ripco.com

In article bje@ripco.com says...
> > in quick succession resembling a buffer overflow exploit.
> 
> Probably not.
> 
> You left out more info than you gave, for one, how did you determine it was
> a HTC doing this? Looked up the mac address?

Yes.  Wireshark does a pretty good job doing reverse mapping identifying 
the manufacturers through those 3 octets in the MAC address.  They don't 
get them all however but those devices usually give themselves away by 
their behaviour.

> You also said in the other post DoD on 22, was it 224 by any chance?
> Although 22.0.0.0/8 still seems to be assigned to something called Defense
> Information Systems Agency, the 224.x stuff shows up on many things for the
> multicasting crap.

Maybe I didn't make myself clear.  The HTC device is pumping out an ARP 
request wanting my gateway to send its MAC address to the address in the 
22.0.0.0/8 range which I thought had something to do with the defense 
department.  These requests come in very quick succession and are not 
normal behaviour of any Android or any device I have ever seen.  Looking 
at the logs there are about 40 all at once with a couple of legit ARP 
requests thrown in the mix from the same device.  I suppose they could 
have used any external IP address to confuse the gateway since both its 
NICs in the 192.168.x.x/24 private ip space.  I suspect that whoever 
wrote the Android app that is doing this put the DoD IP address in as a 
joke.  The gateway should simply drop those requests into the bit bucket 
as fast as they come in.


The 224.x is the address my gateway uses to broadcast all my private DNS 
records one record at a time onto the wireless subnet for anyone 
listening to see.  This is not normal and totally unnecessary.  Apple 
phones do this a lot.  They dump owner info via MDNS so when someone 
uses an Iphone or an Apple laptop most of the time I see both the first 
and last name of the person using that device.  I'm not sure Apple users 
realize this.  PCs are the worst I've seen generating network garbage 
but I only see mobile devices like phones and laptops.  

Granted hiding my private namespace is security through obscurity (i.e. 
no one knows that xxx.yyy.com gets the user to the computer I'm typing 
this message on right now.  Broadcasting the names of all my hosts to 
any yahoo listening on that open subnet is not a good thing because the 
people listening are probably true attackers -- especially if they did 
something to generate that dump.  I could eliminate my private namespace 
records from the subnet's DNS server but that's not a solution either.  
Trusted users need to be able to resolve those names.

BTW: Blackberries are the most efficient.  They set up a VPN with home 
base then it's wham bam thank you maam, they do their business and then 
they're done -- no fooling around.  They generate zero network garbage 
which might be why enterprises like them.

> It's not clear how you have the monitoring setup, but there are just a lot
> of "chatty" things out there that use their own methods. Try doing a ping on
> a broadcast address (192.168.1.255 usually) and see the results.

I use nmap but am not really interested in probing for open ports in 
these devices.  The few times I've tried they were pretty locked down.  
Anyone who enters my wireless subnet can't get by being seen by my all 
knowing gateway which all traffic must traverse.  It is funny how some 
devices get on my net and try to take over and do things their way like 
assigning their own IP and using their own DNS server.  They eventually 
give up and succumb to the BORG because ultimately, they really really 
really have to check up their facebook status.

> It's probably some neighbors phone periodically looking for wifi 
networks,
> trying to connect, fails and goes on it's merry way to somewhere else.

It's a business across the street that caters to drunks who get my free 
signal so I sometimes get lots of traffic.  I don't mind sharing my net 
connection since the phones don't really do that much.  I don't want 
people doing stuff to get me in trouble -- like downloading music or 
movies or god forbid child porn that would get tracked to me.  I try and 
keep all traffic logged in case something bad happens.  And I'd know if 
someone's doing something funny reading through the logs.  I do scan 
them for any interesting behaviours.  So far it has all been innocuous 
-- email and lots and lots of facebook.  Sometimes I find interesting 
sites on the web by looking at the host part of their http requests 
seeing the various sites people surf.

My main purpose for this setup is to research the methods these various 
devices use.

On 2012-02-22, Mark Anderson <mea@nospambradnylion.com> wrote:
>
> It's a business across the street that caters to drunks who get my free 
> signal so I sometimes get lots of traffic.  I don't mind sharing my net 
> connection since the phones don't really do that much.  I don't want 
> people doing stuff to get me in trouble -- like downloading music or 
> movies or god forbid child porn that would get tracked to me.  I try and 
> keep all traffic logged in case something bad happens.  And I'd know if 
> someone's doing something funny reading through the logs.  I do scan 
> them for any interesting behaviours.  So far it has all been innocuous 
> -- email and lots and lots of facebook.  Sometimes I find interesting 
> sites on the web by looking at the host part of their http requests 
> seeing the various sites people surf.

I suppose your average drunk on an iPhone won't have Tor enabled, but good 
luck figuring out much of anything if one does hit your network. You won't 
have a clue if they're just on Facebook, or buying a kilo on Silk Road.

-- 

Kristian M Zoerhoff

In article zoerhoff@sdf.org says...
> I suppose your average drunk on an iPhone won't have Tor enabled, but good 
> luck figuring out much of anything if one does hit your network. You won't 
> have a clue if they're just on Facebook, or buying a kilo on Silk Road.

Theoretically, if Tor works the way I think it works, my external IP 
will only be known to the exit node so any investigator tracing back to 
the source will have lots of other nodes to deal with before getting to 
me.  Also they could simply buy their kilo using some kind of encrypted 
chat and I wouldn't know.  I can't see any encrypted traffic (not that I 
look at or care about the contents of any traffic).   Although I did 
once catch someone surfing the porn sites.   That was interesting 
because there were a lot I hadn't heard of.