2/11 Any idea why my debian laptop would have this traffic. I'm on a
wireless network in my house. connected to the internet via
comcast. My laptop's iptables firewall is blocking all
inbound ports
14:18:55.194060 10.0.0.101.2622 > http://fatboy.paqnet.com.www
\_ spyware, most likely
\_ spyware on my laptop? shit.
\_ crap. okay where do I start looking into this?
\_ Spyware on debian? I doubt it. But I'd start by looking
at full tcpdump output. You can see what http requests
are being sent and that will probably give you a better idea
what is going on.
\_ I use Opera 7.54 and there are a couple security
updates that I missed. Perhaps I visited a malicious
website. I want to figure out what is really going on.
\_ If you are this paranoid and don't know how to see
the contents of the packets and what program has the
socket open, well, you sir, are a moron.
\_ the socket was changing with each run.
Thanks for the insult. That really helps.
\_ Don't mind him. He probably had no idea
himself. Not everyone can deal well with
their shortcomings.
\_ Your computer is trying to connect to paqnet for something, but
it could just as easily be some kind of automatic update feature
as spyware. More likely the former, I think. paqnet is some kind
of distrubution site for various kinds of software. See:
http://www.paqnet.cz
Did you install power quality monitoring software on your
laptop???
\_ No I haven't installed that sort of software. it also looks
like http://paqnet.com is an ISP. they've probably got bad users.
\_ Port 2622 is registered for MetricaDBC. I don't know
what that is, but maybe you do. Did you install anything
like that?
\_ Nope. It looks like the some of the http://paqnet.com users
are off-roaders. I wonder if they are good guys.
Maybe they would send me parts of http logfiles.
\_ Hmm, doesn't look so good to me. I don't know
of any rootkits that use 2622 to communicate,
but you might want to start considering that
could have been hacked.
\_ 2622 is the source port. Has little or nothing to
do with what might be making this connection. You
may want to run netstat -pa to see if you can track
down the process making such connections. They're
probably brief, though, so you won't get much. How
often are these connections happening? --scotsman
\_ I saw about 3 of them in 10 minutes or so,
but stupid me, I shut down my laptop to
make an image of the disk, but when I turned
back on, I don't see any more of the traffic.
\_ Someone may have rootkitted you and run a
proxy daemon, but not put it into startup
files. Look for core files. Look for things
like oddly recent timestamps on ls, netstat,
ps, etc.
\_ Thanks. I've left my laptop on for a couple
days, and now after visiting http://cnn.com this
afternoon, I'm seeing similar traffic
again! Perhaps it is an Opera bug. At
least now I can start figuring it out.
Thanks for all your help. |
http://csua.com/feed/