🚀 go-pugleaf

On Mon, 27 May 2002 06:50:40 +0800, Graham Daniell wrote:
> I have a RH 6.2 Linux server (torvalds) which provides internet
> connection for my home network of several Win9x PC's and one RH72
> PC.
> 
> For some time I have been getting attacked by this IP number:
> 
> May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
> 195.119.1.180
> May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
> 195.119.1.180
> May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
> 195.119.1.180
> May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
> 195.119.1.180
> 
> Last night's message log showed this:
> 
> May 26 20:49:41 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> May 26 20:49:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
> May 26 20:55:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
> May 26 20:56:00 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded
> 
> It looks to me like someone managed to install a route between my
> internal network and an unknown address (probably 195.119.1.180?)
> 
> Should I be worried?  (I already am :-(  )
> 
> Should I not use my internal network till I reformat and relaod my
> RH62 server?

Telnet and ftp are insecure.

login id and password is passed as clear text and can
be snatched with a packet sniffer off both ends of the connection.


That ip resolves to open.proxy.austnet.org

When you decide your box has been cracked,
unplug your system from the internet, Your machine is a menace to
society and you until it's cleaned it up. 

Here is why you need a FORMAT and clean install when your box IS cracked.
   http://www.linuxdoc.org/LDP/LG/issue36/kuethe.html
4'th paragraph.

Think about that paragraph.
You cannot use ANY of your pc's utilities to see if your box is cracked
and find what addtional files are installed.

http://www.chkrootkit.org   has a program for checking for rootkit installs
on the cracked box. That will tell you about known root kits if you have one.
The cracker may not have installed a rootkit.


What you can do is have a dual boot system. You install a second copy of
your OS and label it Auditor. You never, EVER mount it from the internet OS.

Anytime you THINK you've been cracked, you can boot into Auditor, mount the
internet os partition and start checking the internet OS partitions for new
files and whatnot.


Any time you KNOW your're box is cracked, you should:
o       Pull the box off the network. You do not want the police taking
        you and your equipment to jail because a cracker used it
        to crack a bank or military site. If the cracker removes their
        backtracks to their box, you get to do the jail time.

o       Put the hardrive(s) into a standalone machine,
	mount the disk(s) readonly,
	save any data, user files, ...,

o       Save a full copy of the disk(s) for your forensic attempt,
	save the disk(s) for FBI forensics if it's a Big, BIG dollar loss.

o       Re-FORMAT disk drives and do a fresh install from known clean
        source to remove any possible back doors and/or password sniffers
        the cracker installed.

o       Restore your saved files, verify that the restored files
	do not have the suid bit set  "find / -perm +6000 -ls".

o       Have everyone on the box's network change passwords and
	tell them that the cracker may have been running a
	password sniffer so they will not use the passwords ever again.
	Any other boxes logged into from the cracked box should
	have their passwords changed.


Install a modern firewall. Example: iptables is better than ipchains.
If you have a spare linux computer, you can use it to port scan
your box with nmap from http://www.insecure.org/nmap/ 

Get all the vendor updates to your distro.

You might want to read Armoring Linux
	http://www.linuxdoc.org/HOWTO/Security-Quickstart-HOWTO/index.html
        http://www.enteract.com/~lspitz/linux.html
http://www.ibiblio.org/pub/Linux/docs/HOWTO/Security-Quickstart-Redhat-HOWTO
http://www.ibiblio.org/pub/Linux/docs/linux-doc-project/solrhe/Secur
ing-Optimizing-Linux-RH-Edition-v1.3.txt

	http://www.linuxsecurity.com/docs/colsfaq.html
        http://www.securityportal.com/lskb/articles/
        http://www.securityportal.com/lasg/
keep an eye on
        http://www.cert.org/advisories/


For cheap install cd's 
http://cart.cheapbytes.com/cgi-bin/cart 
top left under Products.
For people accross the pond,
        http://www.linuxemporium.co.uk
        http://www.linux123.co.uk/
and for down under fokes
        http://www.cetustech.com.au/


Never login as root unless you have to.
Always login from the console, no su, telnet, ssh,..
That way a keystroke logger in your user account cannot
catch your root login password.

You can audit your system if you are using the  rpm   package manager with
  rpm -Va | grep '..5' > /tmp/verify.log
Runs for a while; more than 5 minutes.

/tmp/verify.log  will contain changes which you have made using
configuration tools

Hope crackers do not put in a rootkit which makes the rpm check obsolete.
I think this has happened, though not sure. On one of my boxes
it cored after about 2 minutes, log looked like it ran but never completes
the audit.

rpm -Va | grep '..5' will give you a warm feeling about what changed.
That warm feeling might turn into the warm feeling you get when
you do not get to the bathroom in time.  :(

The cracker could install trojaned files some where else and modify
PATH to use them instead of the files you just checked.
You could look at the report and see 
	S.5....T c /root/.bash_profile
	S.5....T c /root/.bashrc
You see that and say, "Ok, I did change those. No problem."
BZZZZzzit. WRONG answer, Cracker changed your PATH and you are
running his code.

It also does not show additional files. I have created a site file in
/etc/profile.d which puts my site/bin into PATH. 

Cracker can add his own cracked.sh file to change/add to PATH and
create aliases to substitute a stock command for his code.

Graham Daniell wrote:
> 
> I have a RH 6.2 Linux server (torvalds) which provides internet
> connection for my home network of several Win9x PC's and one RH72
> PC.
> 
> For some time I have been getting attacked by this IP number:
> 
> May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
> 195.119.1.180
> May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
> 195.119.1.180
> May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
> 195.119.1.180
> May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
> 195.119.1.180

Seems that your server is refusing connections ok.  This in itself is
not a major problem ... what is of concern, is that you have a telnet
daemon listening on the net for connections in the first place.  This
leads me to the conclusion that you are probably not running a firewall
of any description, and that the crackers may find other entry points
like ftp, smtp etc. ... this needs to be addressed quickly and properly.

> Last night's message log showed this:
> 
> May 26 20:49:41 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> May 26 20:49:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
> May 26 20:55:49 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
> May 26 20:56:00 torvalds network: Bringing up route unknown
> succeeded
> May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded
> 
> It looks to me like someone managed to install a route between my
> internal network and an unknown address (probably 195.119.1.180?)

Hard to say again, this could indicate a misconfigured daemon???

Have a look in your /etc/passwd and /etc/shadow files for "new" user
accounts or even system accounts with root privileges.

check the creation dates for programs like netstat ps top find ls and
see if they differ wildly from other system binaries.

If the box is cracked, then you can expect the crackers programs to be
re-started at boot time, so you should also look in your
/etc/rc.d/rc.local & /etc/rc.d/init.d files for unusual configurations. 
Again, recent creation dates are a clue.

A simple and easy checker is to download chkrootkit from
http://www.chkrootkit.org build it and run it.  It's not perfect, but it
will find evidence of a compromise if there has been one. 

> Should I be worried?  (I already am :-(  )

Worried is good ... it will keep you on your toes.
 
> Should I not use my internal network till I reformat and relaod my
> RH62 server?

Gather evidence of a compromise first.

-- 
Regards
Luke
------
Q:  What does FAQ stand for?
A:  We are Frequently Asked this Question, and we have no idea.
------
C.O.L.S FAQ - http://www.linuxsecurity.com/docs/colsfaq.html
------

In aus.computers.linux Bit Twister <BitTwister@localhost.localdomain> wrote:
: On Mon, 27 May 2002 06:50:40 +0800, Graham Daniell wrote:
:> I have a RH 6.2 Linux server (torvalds) which provides internet
:> connection for my home network of several Win9x PC's and one RH72
:> PC.
:> 
:> For some time I have been getting attacked by this IP number:
:> 
:> May 26 12:04:35 torvalds in.telnetd[915]: refused connect from
:> 195.119.1.180
:> May 26 12:19:35 torvalds in.telnetd[921]: refused connect from
:> 195.119.1.180
:> May 26 18:08:44 torvalds in.telnetd[1069]: refused connect from
:> 195.119.1.180
:> May 26 18:51:07 torvalds in.telnetd[1087]: refused connect from
:> 195.119.1.180
:> 
:> Last night's message log showed this:
:> 
:> May 26 20:49:41 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:49:49 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:49:50 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:55:49 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:55:49 torvalds network: Bringing up route eth0 succeeded
:> May 26 20:56:00 torvalds network: Bringing up route unknown
:> succeeded
:> May 26 20:56:00 torvalds network: Bringing up route eth0 succeeded
:> 
:> It looks to me like someone managed to install a route between my
:> internal network and an unknown address (probably 195.119.1.180?)
:> 
:> Should I be worried?  (I already am :-(  )
:> 
:> Should I not use my internal network till I reformat and relaod my
:> RH62 server?

: Telnet and ftp are insecure.

: login id and password is passed as clear text and can
: be snatched with a packet sniffer off both ends of the connection.


: That ip resolves to open.proxy.austnet.org

All reasonably sane advice below this point, however its worth injecting a little
perspecitve.

`open.proxy.austnet.org` is polling your machine to check if you have telnet and
SOCKS proxies open. If you do, it will k-line you from the IRC server you're using
(do you frequent Austnet?) and tell you to fix it.

Its a bit of cruel-to-be-kind from the IRC server admins.

Its all well and good to have logging, but understanding what it is that you log
is somewhat useful too.

HTH,
D.
-- 
" I don't get mad.... I get stabby. "
- William "Fat Tony" Williams.

In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
Graham Daniell <gdaniell@wt.com.au> wrote:
>
>May 26 20:49:41 torvalds network: Bringing up route unknown
>succeeded
>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded

>It looks to me like someone managed to install a route between my
>internal network and an unknown address (probably 195.119.1.180?)

Doesn't make sense to me.  eth0 isn't a route, it's a network
interface...

Go to your distribution CD, or a mirror like www.planetmirror.com.au
and get a known good copy of lsof.  

Run lsof -i and see what's listening on your system, identify each
program.

Run netstat and netstat -rn and make sure all is as it should be.

If the versions of ps and netstat disagree with the clean copy of
lsof, you're owned.  reformat and reinstall.

If you can't work out what's listening, you're owned.  reformat and
reinstall.

Zebee

< Zebee Johnstone
>In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
>Graham Daniell <gdaniell@wt.com.au> wrote:
>>
>>May 26 20:49:41 torvalds network: Bringing up route unknown
>>succeeded
>>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
>
>>It looks to me like someone managed to install a route between my
>>internal network and an unknown address (probably 195.119.1.180?)
>
>Doesn't make sense to me.  eth0 isn't a route, it's a network
>interface...

Please try the following commands. 

nslookup unknown
nslookup eth0
nslookup eth1
nslookup 195.119.1.180          # at _your_ box
nslookup open.proxy.austnet.org
nslookup localhost

egrep -in '(unknown|eth(0|1))' /etc/hosts* /etc/named*

cat /etc/host.conf /etc/resolv.conf

su
egrep -in '(route|unknown|eth(0|1))' ~/.*history
echo $HOSTALIASES $LOCALDOMAIN

Which IRC client are you using on Windoze9x or Linux? Obsolete `mIRC` 
have a vulnerability (search bugtraq). 

8< (Summary: lsof -i, netstat -rn, ps)

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

< Zebee Johnstone
>In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
>Graham Daniell <gdaniell@wt.com.au> wrote:
>>
>>May 26 20:49:41 torvalds network: Bringing up route unknown
>>succeeded
>>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
>
>>It looks to me like someone managed to install a route between my
>>internal network and an unknown address (probably 195.119.1.180?)
>
>Doesn't make sense to me.  eth0 isn't a route, it's a network
>interface...

Please try the following commands. 

nslookup unknown
nslookup eth0
nslookup eth1
nslookup 195.119.1.180          # at _your_ box
nslookup open.proxy.austnet.org
nslookup localhost

egrep -in '(unknown|eth(0|1))' /etc/hosts* /etc/named*

cat /etc/host.conf /etc/resolv.conf

su
egrep -in '(route|unknown|eth(0|1))' ~/.*history
echo $HOSTALIASES $LOCALDOMAIN

Which IRC client are you using on Windoze9x or Linux? Obsolete `mIRC` 
have a vulnerability (search bugtraq). 

8< (Summary: lsof -i, netstat -rn, ps)

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

]connection for my home network of several Win9x PC's and one RH72

>>>May 26 20:49:41 torvalds network: Bringing up route unknown
>>>succeeded
>>>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded

>Please try the following commands. 

/sbin/route
/sbin/ifconfig
cat /proc/net/route
cat /proc/net/rt_cache

And I'm not sure this is related or not... 

            L0pht Security Advisory		
Vulnerable: Microsoft Windows95a (w/winsock2), Windows95b
            Windows98, Windows98se and Sun Microsystems...
  Severity: Attackers can remotely add default route entries
            on the victims host.

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

Zebee Johnstone wrote:
> 
> In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
> Graham Daniell <gdaniell@wt.com.au> wrote:
> >
> >May 26 20:49:41 torvalds network: Bringing up route unknown
> >succeeded
> >May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> 
> >It looks to me like someone managed to install a route between my
> >internal network and an unknown address (probably 195.119.1.180?)
> 
> Doesn't make sense to me.  eth0 isn't a route, it's a network
> interface...
> 
> Go to your distribution CD, or a mirror like www.planetmirror.com.au
> and get a known good copy of lsof.
> 
> Run lsof -i and see what's listening on your system, identify each
> program.
> 
> Run netstat and netstat -rn and make sure all is as it should be.
> 
> If the versions of ps and netstat disagree with the clean copy of
> lsof, you're owned.  reformat and reinstall.
> 
> If you can't work out what's listening, you're owned.  reformat and
> reinstall.
> 
> Zebee

Hi,

Can you explain in more detail what you mean by the following?

> If the versions of ps and netstat disagree with the clean copy of
> lsof, you're owned. 

Do you mean if lsof shows different programs listening?

Regards,
GD

RainbowHat wrote:
> 
> < Zebee Johnstone
> >In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
> >Graham Daniell <gdaniell@wt.com.au> wrote:
> >>
> >>May 26 20:49:41 torvalds network: Bringing up route unknown
> >>succeeded
> >>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> >
> >>It looks to me like someone managed to install a route between my
> >>internal network and an unknown address (probably 195.119.1.180?)
> >
> >Doesn't make sense to me.  eth0 isn't a route, it's a network
> >interface...
> 
> Please try the following commands.
> 

> nslookup unknown
Output:
[root@torvalds /root]# nslookup unknown
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find unknown: Non-existent host/domain
(bilby is my ISP's box (proxy?))


> nslookup eth0
[root@torvalds /root]# nslookup eth0
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find eth0: Non-existent host/domain


> nslookup eth1
[root@torvalds /root]# nslookup eth1
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find eth1: Non-existent host/domain


> nslookup 195.119.1.180          # at _your_ box
[root@torvalds /root]# nslookup 195.119.1.180
Server:  bilby.wn.com.au
Address:  203.10.1.17
Name:    open.proxy.austnet.org
Address:  195.119.1.180



> nslookup open.proxy.austnet.org
[root@torvalds /root]# nslookup open.proxy.austnet.org
Server:  bilby.wn.com.au
Address:  203.10.1.17
Name:    open.proxy.austnet.org
Address:  195.119.1.180



> nslookup localhost
[root@torvalds /root]# nslookup localhost
Server:  bilby.wn.com.au
Address:  203.10.1.17
*** bilby.wn.com.au can't find localhost: Non-existent host/domain


 
> egrep -in '(unknown|eth(0|1))' /etc/hosts* /etc/named*
[root@torvalds /root]# egrep -in '(unknown|eth(0|1))' /etc/hosts*
/etc/named*
[root@torvalds /root]#


 
> cat /etc/host.conf /etc/resolv.conf
[root@torvalds /root]# cat /etc/host.conf /etc/resolv.conf
order hosts,bind
multi on
search localdomain
nameserver 203.10.1.17
nameserver 203.10.1.9
[root@torvalds /root]#


 
> su
> egrep -in '(route|unknown|eth(0|1))' ~/.*history
[root@torvalds /root]# egrep -in '(route|unknown|eth(0|1))' ~/.*history
978:cat secure* | grep route
988:cat messages* | grep route
989:cat messages* | grep route | less
[root@torvalds /root]#

(the above entries are mine, searching for these strings in my logs)



> echo $HOSTALIASES $LOCALDOMAIN
[root@torvalds /root]# echo $HOSTALIASES $LOCALDOMAIN

[root@torvalds /root]#

(any significance in the <blank line> in the above?)


> 
> Which IRC client are you using on Windoze9x or Linux? Obsolete `mIRC`
> have a vulnerability (search bugtraq).
My son is using mIRC, v 6.01
(appears to be the latest ver?)



> 
> 8< (Summary: lsof -i, netstat -rn, ps)

- pardon?  (what is the above?)



> 
> --
> Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
> ----+----1----+----2----+----3----+----4----+----5----+----6----+----7


Thank you for your reply, it has given me something to think about.  I
think I get the drift of what the above commands are doing, looking for
something amis, and the outputs above seem to look innocuous to me.  How
about to you?

Thanks,
Graham Daniell

And more ...


RainbowHat wrote:
> 
> ]connection for my home network of several Win9x PC's and one RH72
> 
> >>>May 26 20:49:41 torvalds network: Bringing up route unknown
> >>>succeeded
> >>>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
> 
> >Please try the following commands.
> 
> /sbin/route
[root@torvalds /root]# /sbin/route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use
Iface
tc2-ha.perth.we *               255.255.255.255 UH    0      0        0
ppp0
torvalds        *               255.255.255.255 UH    0      0        0
eth0
192.168.0.0     *               255.255.255.0   U     0      0        0
eth0
127.0.0.0       *               255.0.0.0       U     0      0        0
lo
default         tc2-ha.perth.we 0.0.0.0         UG    0      0        0
ppp0
[root@torvalds /root]#

(see 'default' above - does this look suspicious?)



> /sbin/ifconfig
[root@torvalds /root]# /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr 00:80:AD:1F:52:EB
          inet addr:192.168.0.5  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:48213 errors:0 dropped:0 overruns:0 frame:0
          TX packets:45273 errors:0 dropped:0 overruns:0 carrier:0
          collisions:11 txqueuelen:100
          Interrupt:12 Base address:0x240

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:3924  Metric:1
          RX packets:18 errors:0 dropped:0 overruns:0 frame:0
          TX packets:18 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0

ppp0      Link encap:Point-to-Point Protocol
          inet addr:202.72.132.108  P-t-P:203.10.1.3 
Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1514  Metric:1
          RX packets:21321 errors:105 dropped:0 overruns:0 frame:105
          TX packets:20933 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:10




> cat /proc/net/route
[root@torvalds /root]# cat /proc/net/route
Iface   Destination     Gateway         Flags   RefCnt  Use     Metric 
MaskMTU
ppp0    03010ACB        00000000        0005    0       0       0      
FFFFFFF
eth0    0500A8C0        00000000        0005    0       0       0      
FFFFFFF
eth0    0000A8C0        00000000        0001    0       0       0      
00FFFFF
lo      0000007F        00000000        0001    0       0       0      
000000F
ppp0    00000000        03010ACB        0003    0       0       0      
0000000
[root@torvalds /root]#




> cat /proc/net/rt_cache
(Very long output - too long (~100 lines) to enclose here (?))



> 
> And I'm not sure this is related or not...
> 
>             L0pht Security Advisory
> Vulnerable: Microsoft Windows95a (w/winsock2), Windows95b
>             Windows98, Windows98se and Sun Microsystems...
>   Severity: Attackers can remotely add default route entries
>             on the victims host.
> 
> --
> Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
> ----+----1----+----2----+----3----+----4----+----5----+----6----+----7


Regards,
Graham Daniell

[ My snipped parts which I guess no problem. ]

< Graham Daniell

>[root@torvalds /root]# nslookup unknown
>Server:  bilby.wn.com.au
>Address:  203.10.1.17
>*** bilby.wn.com.au can't find unknown: Non-existent host/domain
>(bilby is my ISP's box (proxy?))

I think it's not a proxy but a primary name server. You don't need root 
privilege above commands (include my snipped parts) and it's insecure. 
I worried about (DNS|hosts file) poisoning but it looks no poison. 

>> su
>[root@torvalds /root]# echo $HOSTALIASES $LOCALDOMAIN
>[root@torvalds /root]#
>(any significance in the <blank line> in the above?)

I worried intruder set something but blank line is no problem. 

>My son is using mIRC, v 6.01
>(appears to be the latest ver?)

Sorry, I'm not using Windoze and mIRC but I have read it before. 
Google keyword "mIRC", "vulnerability" and "bugtraq" will help you. 

http://www.google.com/   http://online.securityfocus.com/archive/1
http://www.mirc.co.uk/   http://www.mirc.com/
http://www.irchelp.org/irchelp/security/

>> 8< (Summary: lsof -i, netstat -rn, ps)
>- pardon?  (what is the above?)

I just sniped the paragraph and left the summary :) 

>Thank you for your reply, it has given me something to think about.  I
>think I get the drift of what the above commands are doing, looking for
>something amis, and the outputs above seem to look innocuous to me.  How
>about to you?

Welcome. Yes, above investigations looks innocuous for me. Perhaps 
someone suggested that IRC server checked proxy. When you or your son 
connect to IRC server, some server check auth (port 113) and port 
probe to your box. Most common ports are 23, 80, 1080, 3128, 8000 and 
8080.

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

[ My snipped parts which I guess no problem. ]

< Graham Daniell

>[root@torvalds /root]# /sbin/route
>Destination     Gateway         Genmask         Flags Metric Ref    Use
>Iface
>tc2-ha.perth.we *               255.255.255.255 UH    0      0        0
>ppp0
:
>default         tc2-ha.perth.we 0.0.0.0         UG    0      0        0
>ppp0
>(see 'default' above - does this look suspicious?)

>[root@torvalds /root]# /sbin/ifconfig
:
>ppp0      Link encap:Point-to-Point Protocol
>          inet addr:202.72.132.108  P-t-P:203.10.1.3 
>Mask:255.255.255.255
>          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1514  Metric:1
>          RX packets:21321 errors:105 dropped:0 overruns:0 frame:105
>          TX packets:20933 errors:0 dropped:0 overruns:0 carrier:0
>          collisions:0 txqueuelen:10

>[root@torvalds /root]# cat /proc/net/route
>Iface   Destination     Gateway         Flags   RefCnt  Use     Metric 
>MaskMTU
>ppp0    03010ACB        00000000        0005    0       0       0      
>FFFFFFF
:
>ppp0    00000000        03010ACB        0003    0       0       0      
>0000000

Hexadecimal 03010ACB is translate to 203.10.1.3 (3, 1, 10, 203). 

203.10.1.3 (WTECH-AU) Winthrop Technology; 
           PO Box 363; Nedlands; WA 6009; AU

202.72.132.108 (WESTNET) WestNet Pty Ltd; Perth, Western Australia; AU

NNTP-Posting-Host dsp-202-72-132-108.perth.westnet.com.au

If above 'tc2-ha.perth.we'(stnet.com.au?) and 203.10.1.3 is your 
provider, I think it's not suspicious. 

I forgot the URI <http://www.l0pht.com/advisories/rdp.txt>. 
>>             L0pht Security Advisory
>> Vulnerable: Microsoft Windows95a (w/winsock2), Windows95b
>>             Windows98, Windows98se and Sun Microsystems...
>>   Severity: Attackers can remotely add default route entries
>>             on the victims host.

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7