🚀 go-pugleaf

Simon Waters <Simon@wretched.demon.co.uk> writes:

> I seem to have a ppp connection hang after probes from Korean IP
> addresses to port 111. No other packets were logged - doesn't mean there
> weren't any!

If your firewall was up to scratch, you'd *know* there weren't any because
you'd be denying & logging everything by default.

> Several dozen log entries turn up as follows....
> 
> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
> (#7)        
> 
> I have tightened the ipchains rules, and zapped portmapper from the box
> (I'm fairly sure nothing needed it *8)

It should never have been installed in the first place. (Korea, that is,
as well as portmapper.)

> Anyone know what aspect of this scan/attack causes the hang?

Nothing normally does. What you don't say is how much activity there is
after it's `hung'. You also don't say whether you're getting any malformed
packets, fragmentation problems, or what.

> I see no evidence that the box was compromised, so I assume

Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
connections with e.g. iptraf to see what's going where? Checked your
outgoing firewall logs?

> that the scan is just causing the interface to hang before anything
> nastier. Stopping and starting the ppp interface restores connectivity.

Consider what would happen if your box was port-scanning a large (/16)
network block over your modem and then you bounced ppp0; I'd expect an
overclogged connection that would appear like it's hung, and then maybe the
process/es responsible would die after the interface was downed.

In short, you're home but not even vigorously towelling off yet.

~Tim
-- 
All I see, All I know                       | piglet@stirfried.vegetable.org.uk
Is touching the sacred earth                | http://piglet.is.dreaming.org
And warming the hallowed ground             |

Tim Haynes wrote:
> 
> Simon Waters <Simon@wretched.demon.co.uk> writes:
> 
> > I seem to have a ppp connection hang after probes from Korean IP
> > addresses to port 111. No other packets were logged - doesn't mean there
> > weren't any!
> 
> If your firewall was up to scratch, you'd *know* there weren't any because
> you'd be denying & logging everything by default.

We aren't logging the accepted ones.

> It should never have been installed in the first place. (Korea, that is,
> as well as portmapper.)

Agree about portmapper - I've never been to Korea so couldn't comment.

> > Anyone know what aspect of this scan/attack causes the hang?
> 
> Nothing normally does. What you don't say is how much activity there is
> after it's `hung'. You also don't say whether you're getting any malformed
> packets, fragmentation problems, or what.

Nothing is complaining. None of the other firewall rules logging diddly,
although presumably I should kick it harder as they must be doing some
sort of scan to find the filtered 111. 
 
> > I see no evidence that the box was compromised, so I assume
> 
> Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
> /dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
> connections with e.g. iptraf to see what's going where? Checked your
> outgoing firewall logs?

All those are as expected - no I hadn't run chkrootkit.
 
> Consider what would happen if your box was port-scanning a large (/16)
> network block over your modem and then you bounced ppp0; I'd expect an
> overclogged connection that would appear like it's hung, and then maybe the
> process/es responsible would die after the interface was downed.

Appreciated - there was no evidence of any traffic on the interface when
it appears hung. So if there is the kernel is lying to me and it hadn't
rebooted so I think it is probably trustworthy.
 
> In short, you're home but not even vigorously towelling off yet.

Appreciated. It'll get reinstalled shortly.

But I still want to track down what caused the hang.

Should have said Kernel 2.2.17, portmap appears to have been receiving
TCP packets but not UDP on Port 111, stray attacks against port 111 like
this seen before, all from Korea. portmap-4.0-17 

-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org

On 25 Apr 2001 15:23:01 +0100, Tim Haynes
<piglet@stirfried.vegetable.org.uk> wrote:
>Simon Waters <Simon@wretched.demon.co.uk> writes:

<snip>

>> Several dozen log entries turn up as follows....
>> 
>> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
>> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
>> (#7)        
>> 
>> I have tightened the ipchains rules, and zapped portmapper from the box
>> (I'm fairly sure nothing needed it *8)
>
>It should never have been installed in the first place. (Korea, that is,
>as well as portmapper.)

.kr != Korea

And the portmapper... yes, shouldn't be ran by default.

>> Anyone know what aspect of this scan/attack causes the hang?
>
>Nothing normally does. What you don't say is how much activity there is
>after it's `hung'. You also don't say whether you're getting any malformed
>packets, fragmentation problems, or what.

Yes, first time I've heard anyone complain about this - what do your
PPP logs say ( /var/log/debug ? )

>> I see no evidence that the box was compromised, so I assume
>
>Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
>/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
>connections with e.g. iptraf to see what's going where? Checked your
>outgoing firewall logs?

"iptraf" ?

>> that the scan is just causing the interface to hang before anything
>> nastier. Stopping and starting the ppp interface restores connectivity.
>
>Consider what would happen if your box was port-scanning a large (/16)
>network block over your modem and then you bounced ppp0; I'd expect an
>overclogged connection that would appear like it's hung, and then maybe the
>process/es responsible would die after the interface was downed.

Er... this connections were all inbound weren't they?  What logical
step did I miss?

>In short, you're home but not even vigorously towelling off yet.

Now there's a phrase to remember :)

-- 
"Analogies generally suck."
David Taylor

Nick Drage wrote:
> 
> .kr != Korea

Urm kr = People Republic of Korea, unless something changed. Anyway the
addresses I see this from are a Korean school and a Korean ISP dial up.

> And the portmapper... yes, shouldn't be ran by default.

Agreed.
 
> >> Anyone know what aspect of this scan/attack causes the hang?
> 
> Yes, first time I've heard anyone complain about this - what do your
> PPP logs say ( /var/log/debug ? )

I don't run PPP debug. Absolutely nothing logged apart from the IPChain
denies on 111.
 
> Er... this connections were all inbound weren't they?  What logical
> step did I miss?

He was just implying that if the box was hacked and being used to attack
others (There isn't much of value to anyone else on it - even the
software is all freely available) then it might appear to hang the
Internet connection. But there isn't even a hint of anything being
compromised.
 
-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org

nickd@nospam.demon.co.uk (Nick Drage) writes:

> >> Apr 25 11:55:54 linux1 kernel: Packet log: input DENY ppp0 PROTO=17
> >> 211.39.194.151:742 a.b.c.d:111 L=84 S=0x00 I=65452 F=0x0000 T=44
> >> (#7)        
> >> 
> >> I have tightened the ipchains rules, and zapped portmapper from the
> >> box (I'm fairly sure nothing needed it *8)
> >
> >It should never have been installed in the first place. (Korea, that is,
> >as well as portmapper.)
> 
> .kr != Korea

You sure? (Not that it has much relevance anyway, but also consider:

  | person:      Seung-Min Lee
  | address:     Korea Network Information Center (KRNIC)
  | address:     **************** Important Notice **********************
  | address:     KRNIC is the National Internet Registry
  | address:     If you want to find detail assignment information
  | address:     about above IP address, please use "http://whois.nic.or.kr"
  | address:     *****************************************************
  | address:     Narajongkeum B/D 14F, 1328-3, Seocho-dong, Seocho-Ku
  | address:     Seoul, 137-070, Republic of Korea
  | country:     KR
  | phone:       +82-2-2186-4500
  | fax-no:      +82-2-2186-4496
  | e-mail:      hostmaster@nic.or.kr
  | nic-hdl:     SL119-AP
  | mnt-by:      MNT-KRNIC-AP
  | changed:     hostmaster@nic.or.kr 20000927
  | source:      APNIC
)

> >Nothing normally does. What you don't say is how much activity there is
> >after it's `hung'. You also don't say whether you're getting any
> >malformed packets, fragmentation problems, or what.
> 
> Yes, first time I've heard anyone complain about this - what do your
> PPP logs say ( /var/log/debug ? )

I'm thinking it would also be a good idea to run pppd in maximum debug mode
- `kdebug 25' (or 81?) and get the contents of every packet. I wonder if
the modem is so misconfigured as to be mishandling an `ATH' coming down?

> >Have you run chkrootkit? Had a look in /etc/{inittab,inetd.conf} and
> >/dev/.lib and /var/named? Run an rpm -Vva? Monitored your network
> >connections with e.g. iptraf to see what's going where? Checked your
> >outgoing firewall logs?
> 
> "iptraf" ?

Nope, just iptraf will do nicely. <http://rpmfind.net/> is your fwend(TM).

> >Consider what would happen if your box was port-scanning a large (/16)
> >network block over your modem and then you bounced ppp0; I'd expect an
> >overclogged connection that would appear like it's hung, and then maybe
> >the process/es responsible would die after the interface was downed.
> 
> Er... this connections were all inbound weren't they? What logical step
> did I miss?

If you've been cracked, thre's a large chance you're scanning /16 blocks of
network at random for similar things - 1i0n and ramen (and adore?) all do
this. If you're getting a largre amount of packets and you suddenly become
`destination-unreachable', might not the process also go away if it's
remote?

> >In short, you're home but not even vigorously towelling off yet.
> 
> Now there's a phrase to remember :)

Based on an orignial by D Adams :8)

~Tim
-- 
   12:39:34 up 5 days,  2:05, 15 users,  load average: 0.09, 0.23, 0.31
piglet@stirfried.vegetable.org.uk  |Rushing onwards, tracing the chains,
http://piglet.is.dreaming.org      |Chasing the days, chasing the days.

Simon Waters <Simon@wretched.demon.co.uk> writes:

[snip]
> He was just implying that if the box was hacked and being used to attack
> others (There isn't much of value to anyone else on it - even the
> software is all freely available) then it might appear to hang the
> Internet connection. But there isn't even a hint of anything being
> compromised.

Read up on some of the assorted rootkits around & abouts. When you find the
entries in inetd.conf and inittab that's bad enough, but when you find the
kernel module adjusting your very syscalls so that ls, ps and everything
won't return any evidence of the compromised files/ports... without needing
to replace those binaries... that's truly sickening.
IOW, you have to mount the HD from another trusted medium (eg live CD, or a
fresh install) before you can *check* it, let alone proclaim it clean. That
and let the thing run with a network sniffer on the same hub as well.

Paranoid, who me? ;(

~Tim
-- 
Another day,                                | piglet@stirfried.vegetable.org.uk
Another kernel recompile                    | http://piglet.is.dreaming.org

Tim Haynes <piglet@stirfried.vegetable.org.uk> writes:

[snip]
> Paranoid, who me? ;(

That is, if you got the other post with letters A, T and H in it in close
succession, you should be equally paranoid. ;8)

~Tim
-- 
Move a mountain / Fill the ground           | piglet@stirfried.vegetable.org.uk
Take death on wheels / Re-create the land   | http://piglet.is.dreaming.org

On Sat, 28 Apr 2001 12:42:40 +0100, Simon Waters
<Simon@wretched.demon.co.uk> wrote:

>Nick Drage wrote:
>> 
>> .kr != Korea
>
>Urm kr = People Republic of Korea, unless something changed. Anyway the
>addresses I see this from are a Korean school and a Korean ISP dial up.

Nabbing the first list of country codes I Google:
http://www.thrall.org/domains.htm

KP = Korea (North)
KR = Korea (South)

So KR is South Korea, not "Korea" AFAIK.  Then again, considering my
grasp of current affairs, they could have re-joined recently and I
wouldn't have noticed.

<snip>

>> >> Anyone know what aspect of this scan/attack causes the hang?
>> 
>> Yes, first time I've heard anyone complain about this - what do your
>> PPP logs say ( /var/log/debug ? )
>
>I don't run PPP debug. Absolutely nothing logged apart from the IPChain
>denies on 111.

Considering the problem is PPP related I'd certainly recommend
temporaily running it.  How depends on how you connect, and I've only
used my special PPP setup so I'm not the best person to advise.

>> Er... this connections were all inbound weren't they?  What logical
>> step did I miss?
>
>He was just implying that if the box was hacked and being used to attack
>others (There isn't much of value to anyone else on it - even the
>software is all freely available) then it might appear to hang the
>Internet connection. But there isn't even a hint of anything being
>compromised.

Curiouser and curiouser, more details appreciated.

-- 
"Analogies generally suck."
David Taylor

On 28 Apr 2001 12:46:29 +0100, Tim Haynes
<piglet@stirfried.vegetable.org.uk> wrote:

>nickd@nospam.demon.co.uk (Nick Drage) writes:
<snip>

>> >Nothing normally does. What you don't say is how much activity there is
>> >after it's `hung'. You also don't say whether you're getting any
>> >malformed packets, fragmentation problems, or what.
>> 
>> Yes, first time I've heard anyone complain about this - what do your
>> PPP logs say ( /var/log/debug ? )
>
>I'm thinking it would also be a good idea to run pppd in maximum debug mode
>- `kdebug 25' (or 81?) and get the contents of every packet. I wonder if
>the modem is so misconfigured as to be mishandling an `ATH' coming down?

Yikes, that's very misconfigured isn't it ;)  From what I've heard
about this problem I think it's due to the modem firmware not dealing
with ATH properly, rather than being a configuration issue.  Don't
know a great deal about this though, so willing to be educated.

<snip>

>> "iptraf" ?
>
>Nope, just iptraf will do nicely. <http://rpmfind.net/> is your fwend(TM).

Bah, rpms?  Google is my friend:
http://cebu.mozcom.com/riker/iptraf/

>> >Consider what would happen if your box was port-scanning a large (/16)
>> >network block over your modem and then you bounced ppp0; I'd expect an
>> >overclogged connection that would appear like it's hung, and then maybe
>> >the process/es responsible would die after the interface was downed.
>> 
>> Er... this connections were all inbound weren't they? What logical step
>> did I miss?
>
>If you've been cracked, thre's a large chance you're scanning /16 blocks of
>network at random for similar things - 1i0n and ramen (and adore?) all do
>this. If you're getting a largre amount of packets and you suddenly become
>`destination-unreachable', might not the process also go away if it's
>remote?

Good point, but I'm not sure a great deal of destination unreachables
should tear down a PPP connection?  As the ICMP will be over IP, which
is over PPP, so PPP has no "knowledge", for want of a better word, of
what an ICMP packet is.

>> >In short, you're home but not even vigorously towelling off yet.
>> 
>> Now there's a phrase to remember :)
>
>Based on an orignial by D Adams :8)

Heh, I've got a downloaded copy of The Book of Liff somewhere ( and
the original in the parents' attic I think ), must re-read sooner
rather than later :)

-- 
"Analogies generally suck."
David Taylor

Nick Drage wrote:
> 
> Nabbing the first list of country codes I Google:
> http://www.thrall.org/domains.htm
> 
> KP = Korea (North)
> KR = Korea (South)
> 
> So KR is South Korea, not "Korea" AFAIK.  Then again, considering my
> grasp of current affairs, they could have re-joined recently and I
> wouldn't have noticed.

They (N & S) have managed their first civilised meetings, and I think
they are even likely to agree an end to the war if they haven't already,
which hasn't been raging for years.

KP is the Democratic Peoples Republic of Korea (IIRC), the ISO standard
used for domain names (Except UK) is usually politically sensitive (At
least for when it was written) and they are clearly both the real Korea.

Anyway the attacks all come from the South, however I don't think this
necessarily indicated that the North is more enlightened.

-- 
Want to learn about Linux? Get it installed?
Devon and Cornwall LUG Event for UK Linux Day 
Exeter University - Sunday April 29th 2001 10:00 to 17:00
www.linuxday.org.uk or join D&C LUG www.lug.termisoc.org