Ping attacks...
Results 1 to 9 of 9

Thread: Ping attacks...

  1. #1
    Junior Member
    Join Date
    May 2004
    Posts
    2

    Ping attacks...

    Sorry if a similar topic has been posted before but I searched the archives and found nothing to answer my query/problem.

    Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.

    - Thanks alot -

  2. #2
    HeadShot Master N1nja Cybr1d's Avatar
    Join Date
    Jul 2003
    Location
    Boston, MA
    Posts
    1,836
    they could be just zombies scanning a network.

  3. #3
    King Arana: Super Moderator
    Join Date
    Oct 2002
    Posts
    4,055
    Well, for one:

    1. What OS are you running?
    2. What kind of connection do you have?

    And do you have netBIOS file sharing turned on? Lemme know the detail's of these and I'll help ya out.
    Space For Rent.. =]

  4. #4
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.
    A few things. How often are the pings attacks and do they happen in some sort of pattern (in groups or every so many per minute)? Evidentally, they aren't detrimental enough to prevent you from surfing the internet so the impact is minimal. As for NetBIOS there are a variety of worms and other beasties out there that will mimic or cause this. I wouldn't worry about it since your firewall seems to be stopping this.

    As for masking your IP, it's not really a "doable" thing. Having a firewall and hardening your OS would be better things to look at. The NSA and SANS Reading Room have some guides on how to harden/lock down your system. You should also look in the Security Tutorials section here as there are some good tips and guides on similar topics.
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  5. #5
    Junior Member
    Join Date
    May 2004
    Posts
    2
    When I checked the log I also saw an attack called "Cloaking" could you explain this to me. The attacking IP was traced to amsterdam on every attack and their doesnt seem to be much correlation between the attack times however they are very frequent (20-30 per minute) I'll check out those security links. Thanks

  6. #6
    Just a Virtualized Geek MrLinus's Avatar
    Join Date
    Sep 2001
    Location
    Redondo Beach, CA
    Posts
    7,324
    When I checked the log I also saw an attack called "Cloaking" could you explain this to me.
    Are you sure this is an attack? Because when I did a quick search on PC-cillin and "cloaking" I got this:

    The Personal Firewall also offers a variety of functions that protects your system from hackers such as the cloaking option that prevents your computer from being found when connected to the internet. The Firewall also has three different levels of blocking from low to high because some programs require that certain ports on your computer are open.
    What this leads me to believe is that you can turn off the ping feature (so your machine doesn't respond to ICMP requests and appears as "alive"). The only thing I can think of is that your machine is responding to the pings but getting no response back, which would mean either the attackers have ping turned off and/or are spoofing the source (hence, it's not in Amsterdam but perhaps really somewhere else).
    Goodbye, Mittens (1992-2008). My pillow will be cold without your purring beside my head
    Extra! Extra! Get your FREE copy of Insight Newsletter||MsMittens' HomePage

  7. #7
    Senior Member
    Join Date
    Mar 2004
    Posts
    113
    Hi,

    I don't have much idea but this is what I found about cloaking:

    When a search engine spider or human visitor requests a specific Web page, cloaking programs compare the IP address of the requesting party to a database of known IP addresses from specific search engine spiders. If the IP address matches one on the list, it serves a particular page that was specifically written for the search engines to the spider. This page is normally optimized to rank well for that particular search engine, in order to achieve high visibility.

    On the other hand, if that IP address does not match one in the database's list, the requesting entity is "assumed" to be a human visitor and is served the actual "real" page or is simply re-directed to another page appropriate for human visitors (!).

    More info on: http://www.rankforsales.com/always-avoid-cloaking.html

    How ver I still don't understand How is cloaking affecting him ?

    MRG

  8. #8
    Super Moderator: GMT Zone nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,192
    If it is any comfort, up until around 18 months ago I would have the warnings turned on............I had to turn them off!

    For example I had 1,207 hits on my last session...............it is normal, just look at the logs and see if you are getting hit from exactly the same IP address multiple times..........then you might consider using their ISP abuse reporting system.

    Otherwise don't worry, it seems normal these days, just be sure to keep your software up to date and scan regularly for nasties.

    Good luck
    If you cannot do someone any good: don't do them any harm....
    As long as you did this to one of these, the least of my little ones............you did it unto Me.
    What profiteth a man if he gains the entire World at the expense of his immortal soul?

  9. #9
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,403

    Re: Ping attacks...

    Originally posted here by Dealt
    Basically, recently I have been recieving notices from my firewall (PC-cillin) of Ping attacks and Netbios browsing warnings almost continuously whilst I am connected. I was wondering two things really, what is the impact of ping attacks on my connection and secondly what means of protection can I use.. like to mask my IP or other.
    It's a side effect of all the viruses running rampant on the Internet.
    As for protecting yourself against it, you're allready doing it by running a firewall.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •