Another good one:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&edition=us&threadm=bnp31b%242uqs%241%40FreeBSD.csie.NCTU.edu.tw&rnum=4&p
rev=/groups%3Fq%3D127.0.0.1%2Bspoofed%2Baddress%26btnG%3DGoogle%2BSearch%26hl%3Den%26lr%3D%26ie%3DUTF-8%26oe%3DUTF-8%26edition%3Dus
Quoted below:
I am posting this in the hopes of dulling the 5-6 messages I get every
day that are reporting port scans to their network all of which have a
source IP of 127.0.0.1 and source port 80.
It is likely Blaster (check your favourite AV site for a writeup, I
won't summarize here).
The reason that people are seeing this has to do with some very bad
advice
that was given early in the blaster outbreak. The advice basically was
that to protect the Internet from the DoS attack that was to hit
windowsupdate.com, all DNS servers should return 127.0.0.1 for queries
to
windowsupdate.com. Essentially these suggestions were suggesting that
hosts should commit suicide to protect the Internet.
The problem is that the DoS routine spoofs the source address, so when
windowsupdate.com resolves to 127.0.0.1 the following happens.
Infected host picks address as source address and sends Syn packet to
127.0.0.1 port 80. (Sends it to itself) (This never makes it on the
wire,
you will not see this part)
TCP/IP stack receives packet, responds with reset (if there is nothing
listening on that port), sending the reset to the host with the spoofed
source address (this is what people are seeing and mistaking for
portscans)
Result: It looks like a host is port scanning ephemeral posts using
packets with source address:port of 127.0.0.1:80
Solution: track back the packets by MAC address to find hte infected
machine. Turn of NS resolution of windowsupdate.com to 127.0.0.1.
Hope that helps
http://www.primeinc.com
**********************************************************************
This email and any files transmitted with it are confidential
and intended solely for the use of the individual or entity to
whom they are addressed. If you have received this email
in error please reply to the sender of the message.
The views expressed in this correspondence may not
reflect the views of Prime, Inc.
This footnote also confirms that this email message has
been scanned for the presence of computer viruses.
**********************************************************************
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV AT amadeus.us.checkpoint DOT com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner AT ts.checkpoint DOT com
=================================================
|
