Incidents
Source port 445,80 Sep 05 2007 10:47AM
Wong Yu Liang (wong yuliang vads com) (1 replies)
Re: Source port 445,80 Sep 05 2007 09:36PM
Valdis Kletnieks vt edu (1 replies)
RE: Source port 445,80 Sep 06 2007 04:17AM
Wong Yu Liang (wong yuliang vads com) (2 replies)
Re: Source port 445,80 Sep 07 2007 07:24AM
scott (redhowlingwolves bellsouth net)
Re: Source port 445,80 Sep 06 2007 04:55PM
Valdis Kletnieks vt edu (1 replies)
On Thu, 06 Sep 2007 12:17:47 +0800, Wong Yu Liang said:
> Thanks valdis=20
> I suspected so. Possibly a worm propagation and the ips detected the
> *return* traffic. But yet the alerts from my ips is very strange. Some
> alerts
>
> 172.16.1.254:80 -> 172.17.17.103:1434 MSSQL buffer overflow detected
> 172.16.1.254:80 -> 172.17.17.16:1434 MSSQL buffer overflow detected
> And the list goes on to different destination IP addres

OK, that's a *different* well-known pattern - as mssql in fact lives on 1434.

What the attacker is doing is using a hand-set source port of 80, to get through
those older firewalls that don't do stateful connection tracking.

Newer firewalls will watch the traffic, and if they see a TCP SYN packet going
*out* to a given port/IP pair, will automagically whitelist the return path,
so the SYN/ACK packet makes it back, but traffic from *other* sites still
won't be able to enter inbound.

Older non-stateful firewalls would simply be configured with two rules:
allow outbound to port 80
allow inbound from port 80
so you could talk to webservers. So some hacking tools abuse the existence
of such rules to improve their chances of getting in through the firewall...

Incidentally, this sort of thing is hard to troubleshoot when both addresses
are in the 172.16/12 address block, that's an RFC1918 reserved space. So
either the source is inside your own network, or you need to go look at whatever
is doing your NAT at the border and get it to cough up the *real* IP address
of the source....

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFG4DEUcC3lWbTT17ARAhwDAKCxU6sU6WSeZe63G3z2E5c5YS0nXgCgz+vz
ntDyE/3VYEzLdFVweaihI9E=
=SLSQ
-----END PGP SIGNATURE-----

[ reply ]
RE: Source port 445,80 Sep 07 2007 01:05AM
Wong Yu Liang (wong yuliang vads com) (1 replies)
Re: Source port 445,80 Sep 07 2007 04:15AM
Valdis Kletnieks vt edu


 

Privacy Statement
Copyright 2010, SecurityFocus