Announcement

Collapse
No announcement yet.

Please Help! I think I'm being watched!

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Please Help! I think I'm being watched!

    I know, I know.

    I really am not one of those conspiracy theorists. I believe that there was only one gunman, I don't think the Government is hiding anything at Roswell, and I know for a fact that the TV isn't watching me.

    I am, however, suspicious of my cable modem. Some of you may have read my problems with the @Home network last week. Well, I got the problem fixed for now but since I have been back in service my cable modem is acting strange. It shows almost constant activity. I can shut down EVERY non-essential program and run it bare bones but the light keeps flickering (the one that shows when you are downloading or uploading something). I am running Zone Alarm but even when I hit the internet "Lock" that supposedly shuts down all internet activity the modem continues to flicker. When I completely shut down my computer the light stops, so I thinks something strange is happening.

    Another thing is that my Zone alarm has shown way more activity in the alerts column since I have been back on. Over a single night I got 500 alerts (that's the limit). I cleared them and it was up over 200 alerts 2 hours later. Most of them show to be harmless with a few that show up red. 90% come from computers with the same first 2 sets of numbers in the IP. (24.15.xx.xxx) Strangely enough that matches the first sets of numbers in my IP. So I know that they are @Home IP's.

    A port scan (with Zone running) shows that I am in stealth mode and no open ports. When I turn off Zone I show all ports closed except 113 which show open (normal from what I hear).


    So, what do you think? Am I a paranoid schizophrenic? How do you find out if there is some kind of back door thing happening on your machine? Please help me.

    I'll just be sitting here in my tin foil helmet waiting for a reply.

    (The artist formerly known as Kindness!)

  • #2
    install the trojan defence suite, just to be sure



    mfg
    wulfman
    "Perhaps they communicate by changing colour? Like those sea creatures .."
    "Lobsters?"
    "Really? I didn't know they did that."
    "Oh yes, red means help!"

    Comment


    • #3
      Kindness;

      I know what you mean. I'm on Rogers@Home and while my lights haven't gone crazy, my firewall (latest Zone Alarm) has been getting hammered over the past 2-3 days. Im up to 330 hits now, and the day is far from over. Wonder if the new code red virus is mangling the Rogers servers. Hell, if my phone worked, I'd call them and ask them.

      Bart
      Bart

      Comment


      • #4
        Rock, I am on AT&T @Home. I had thought of CodeRed as well, but the hits aren't the main thrust of my concern. I know that Zone is on the job so I feel relatively secure. The activity that appears to be going through my modem is what is worrying me. It makes me think that somehow I have something happening behind the scenes but I don't know what it could be. It is like something is being upladed/downloaded from/to my computer at all times.

        I have updated all of my virus stuff, installed the trojan defense thing, updated Zone and everything else I can think of. The modem is still flickering.

        (The artist formerly known as Kindness!)

        Comment


        • #5
          Taken directly from the local RR/Cox cable newsgroup:

          Reading A.F.R and A.O-S.R I see why our modem lights are blinking, and not just by Code Red!. ARP requests.. BY THE TON! Thats why everyones lights are blinking.

          ARP request for 24.166.159.233 (46 bytes) from 0002fc82c870 to ffffffffffff

          etcetcetc.. Not just by this one IP.. by tons of IPs. According to
          A.F.R/A.O-S.R this barrage of ARP requests is from a 'messed up' upgrade that RR did. Everyone across the country is seeing it.
          "I called tech support, and it appears that RR did an upgrade of its servers and that upgrade is causing the servers to communicate constantly with the modems"

          "RR routers are sending ARPs in a constant stream. Most are repititous and many are to their own routers. It seems that they have problems with their routers finding each other, as these seem to repeat every few seconds."

          "Actually, I have logs coming off a Linksys router, and they don't show this activity (which is one reason I called tech support). The
          communication is with only the cable modem, according to the tech, and is not getting passed on to the PCs or router on the other side."

          "The Linksys doesn't log ARP braodcasts. Most firewalls don't either, but I log both broadcast and multicast ARPs at mine, which is Linux running ipchains. If you have a means of running tcpdump at the router, you'll see the inordinate amount of ARP traffic RR is broadcasting."

          Comment


          • #6
            Would that be affecting me since I am on AT&T?

            (The artist formerly known as Kindness!)

            Comment


            • #7
              I don't know. Are the hits to your HTTP port (80)? If so it's probably just the normal Code Red stuff. ARP hits shouldn't even show up on your firewall from what I read unless you specificaly tell it to. Also note that Code Red sends more to the IP range it's located in which means that once it infects other users of your ISP it tends to stay there flooding the ISP's users from within it's own network.

              [edit]
              Update: It seems the new version of Code Red IS causing the ARP flooding according to our local RR rep.
              [/edit]
              Last edited by Jon P. Inghram; 6 August 2001, 15:45.

              Comment


              • #8
                If you feel comfortable doing this.....download some sort of sniffer software(Network Associates SnifferPro) and sniff the line. Look at the packets and you will know what it is if you can read sniffer traces. If not, email me the trace and I'll look at it tell you what it is.

                Dave
                Ladies and gentlemen, take my advice, pull down your pants and slide on the ice.

                Comment


                • #9
                  Here is the eval copy for SnifferPro...

                  Get the data that matters most for user experience monitoring with NETSCOUT. Our packet-derived insights help assure strong user experience, security, and availability.


                  Dave
                  Ladies and gentlemen, take my advice, pull down your pants and slide on the ice.

                  Comment


                  • #10
                    I found a sniffer program. (I couldn't find the download for the one you reccomended H.). When I ran it with no programs running it didn't seem to pick up anything. The modem light is still flickering, so I don't know what to make of it. I will keep playing with it.
                    Last edited by Pneumatic; 6 August 2001, 17:07.

                    (The artist formerly known as Kindness!)

                    Comment


                    • #11
                      Why not just use Sygate's newest firewall? It has built in packet logging.


                      I have noticed the high rate of activity as well. Over 1000 hits this weekend alone.

                      Rags

                      Comment


                      • #12
                        I honestly havn't looked at my http server log, however a friend of mine in Australia has turned off logging on his linux server - ADSL connection (no web server), after his log file grew to 400kb + in 10 hours or so. All port 80

                        So Code Red is affecting something.

                        Dan
                        Juu nin to iro


                        English doesn't borrow from other languages. It follows them down dark alleys, knocks them over, and goes through their pockets for loose grammar.

                        Comment


                        • #13
                          Originally posted by Sasq
                          I honestly havn't looked at my http server log, however a friend of mine in Australia has turned off logging on his linux server - ADSL connection (no web server), after his log file grew to 400kb + in 10 hours or so. All port 80

                          So Code Red is affecting something.

                          Dan
                          Whoa - just had a look at one of my websever's logs and there was nearly 400 hits within one second from CodeRed... and that's to my site which isn't really that much advertised... (www.steve-cooper.co.uk). It seems my server gave up logging after that!

                          Comment


                          • #14
                            I have comcast@home and mine has been blinking constantly for the last few days as well.

                            Paul
                            "Never interfere with the enemy when he is in the process of destroying himself"

                            Comment


                            • #15
                              My modem lights blink all the time... especially when I am surfing the net.

                              Oh and my lights go out when I turn my modem off too.
                              AMD Phenom 9650, 8GB, 4x1TB, 2x22 DVD-RW, 2x9600GT, 23.6' ASUS, Vista Ultimate
                              AMD X2 7750, 4GB, 1x1TB 2x500, 1x22 DVD-RW, 1x8500GT, 22" Acer, OS X 10.5.8
                              Acer 6930G, T6400, 4GB, 500GB, 16", Vista Premium
                              Lenovo Ideapad S10e, 2GB, 500GB, 10", OS X 10.5.8

                              Comment

                              Working...
                              X