Printable View
Ok folks, I need some education on this one.
My SonicWALL log shows that a sub seven trojan attack was dropped. Can't say I've run into a sub seven attack before, but at least it didn't succeed. What do I need to know about this? Does this mean someone has targeted us, or rather is it the result of typical random scanning? Should I do anything other than just note its occurance?
Typical random scanning. Someone is looking for a infected computer with subseven.
As long as you don't have sub7, and the firewall blocks it, no big deal. :D
btw, it's a trojan, not a exploit.
I said trojan, not exploit. :)
Thanks for the answer, just wanted to check since that was new on me.
Was it an actual attack or was it a scan..... I have $5 says it was a scan for it. The problem with all these systems is that thet "sensationalize" the issue. For example some guys scans your subnet for subseven on whatever the default port for that is..... All he's doing is sending a SYN to see if he gets a SYN/ACK back.... No SYN/ACK he moves on..... Now... Note.... It's a scan for a response on port x.... that's all. But your sonicwall has taken a scan, and because it is on a specific port, (SubSeven's default), it categorizes it as an attack.... Frankly that's BS.... It would be a tad more useful if it reacted when it saw the final ACK, then you could say an attack is taking place..... but then again, if that happened Sonicwall would sorta be telling you it sucked...... ;)
Exactly the issue, and that's indeed all it's telling me, so it's anybody's guess. My hunch, however, since it was dropped, is that surely is was a SYN and not a SYN/ACK. In any case, just wanted to be on the safe side.Quote:
But your sonicwall has taken a scan, and because it is on a specific port, (SubSeven's default), it categorizes it as an attack
So, new terminology time, what exactly does "SYN" and "ACK" stand for anyway?
SYN: Synchronize
SYN/ACK: Synchronize Acknowledged
ACK: Acknowledged, (let's talk)
It's kinda like military radio procedure..... Except different.... ;)
Sorry bud, I didn't mean it as a correction. I was just making sure you knew what sub7 was. It would have to be on your system for the scan to be worth anything, but you already knew that. An remote exploit wouldn't need any type of server, in that case you would sorta have something to worry about.
The SYN, ACK and SYN/ACK form the three-way habdshake that computers use to identify and connect to each other. It is used in SYNflooding (or is it DOSing) by sending high number of SYN requests to the target computer, which answers back with the SYN/ACK and waits some time for the SYN/ACK that's never coming. Due to the high numbers of requests the queue gets longer and eventually takes up the whole bandwidth.
Anybody correct me if I'm wrong.
A SYN flood is a type of DOS attack.
DoS is just any attack that deny's use of a service or machine. My GF used a hammer to DoS my network after she discovered many gigs of pr0n.
Now i'll challenge any firewall to defende against that. :DQuote:
GF used a hammer to DoS my network after she discovered many gigs of pr0n.
A firewall made by Phillips 66 and Zippo might be able to stop her ;) Then again, that kind of wall MIGHT damage your computer. MAYBE. I don't know about that one... Someone is going to have to check it out for us ;)
My girl knows better than to even touch my keyboard. Did you see the sopranos last sunday? Thats what would of happen if she took a hammer to my new sh*t , unless she had the money to fork up new hardware. Then again I do not have store gigs porn on a HD. But I will admit I do have celebrity nudes on my comp, for wallpaper reasons ;) . I've had a girl take a bat to my car, but when the damage goes over $200 it's time to lay a smack down.Quote:
Originally posted here by D0pp139an93r
A SYN flood is a type of DOS attack.
DoS is just any attack that deny's use of a service or machine. My GF used a hammer to DoS my network after she discovered many gigs of pr0n.
Basically Angellic, it is a skiddy looking to see if your system is already compromised so he can come in and play. You have nothing to fear against a lazy bastard like that. I used to get those all the time and as long as your fire wall stops it you are fine (which you did). Sub-7 is dieing anyways.
Oh and and Rust, bat to the car eh? I'm kinda curious to know what caused that attack. And as for that hammer, you should have been patched with Microsoft's nosey girlfriend vulnerability. That or cut back on the "Me" time.
Not meaning to sound rude but what position do you hold in you're company ? alot of these posts about attacks from you are internet noise and asking what SYN/ACK is any admin would have learned at least the basics of tcp/ip before being let loose in a real world scenario so my question to you is how did you get a job as an admin ?
:)
There is a bit more to it.
With a DoS attack, the source IP address is usually spoofed, so the the SYN packet generates a SYN/ACK response that hangs (usually from a server that recieves the SYN packet)...there is no legit IP address to respond to...system resources are being wasted, that could be used for legit connection requests. Get enough of these...no more availability.
Remind me never to get fresh with your GF D0pp139an93r lol
Gee, you'd think, wouldn't you? You'd be shocked then what all they HAVEN'T taught us. It's scary, but thankfully I'm learning a lot on my own, with much thanks due to AO. I'm a fresh MIS major (got my degree 2 weekends ago after five long years!) and I've only been net admin since the beginning of this year, and up until recently it was an internship. I was just extremely fortunate that they decided to keep me on after my internship was up, and now I'm picking up on this pretty fast, much of it because I'm posting every single issue I run into on AO for discussion. I guess having a stellar academic record and eager willingness to learn what I don't know is what's saved my hide job-wise.Quote:
any admin would have learned at least the basics of tcp/ip before being let loose in a real world scenario so my question to you is how did you get a job as an admin ?
We did cover TCP/IP basics, but they didn't cover SYN/ACK attacks. Actually, they didn't cover ANY attacks or security issues whatsoever. They just NOW started security courses, which does me a lot of good now that I'm graduated! Of course, it is an Arkansas college, and we're the poorest state in the nation for a reason.
Instead, we covered stupid stuff such as spending an entire semester on COBOL programming!!!
Aaaah, just had to get that out of my system. So as far as security goes, I'm am being completely self-taught.
I remeber now some months ago AngleKnight when you posted about your job, and I said "they really have thrown you to the wovles". How many comps did they put under you and are they all in the same vicinity? Yep, they don't teach anything really usefull & you don't really learn about real security till the master level, so I've heard.Quote:
Originally posted here by AngelicKnight
Gee, you'd think, wouldn't you? You'd be shocked then what all they HAVEN'T taught us. It's scary, but thankfully I'm learning a lot on my own, with much thanks due to AO. I'm a fresh MIS major (got my degree 2 weekends ago after five long years!) and I've only been net admin since the beginning of this year, and up until recently it was an internship. I was just extremely fortunate that they decided to keep me on after my internship was up, and now I'm picking up on this pretty fast, much of it because I'm posting every single issue I run into on AO for discussion. I guess having a stellar academic record and eager willingness to learn what I don't know is what's saved my hide job-wise.
We did cover TCP/IP basics, but they didn't cover SYN/ACK attacks. Actually, they didn't cover ANY attacks or security issues whatsoever. They just NOW started security courses, which does me a lot of good now that I'm graduated! Of course, it is an Arkansas college, and we're the poorest state in the nation for a reason.
Instead, we covered stupid stuff such as spending an entire semester on COBOL programming!!!
Aaaah, just had to get that out of my system. So as far as security goes, I'm am being completely self-taught.
You remember correctly. Thankfully I have a bit of a better grip on things since that post. On the one hand this crash-course method of learning is pretty stressful, but on the other it's also very useful. It forces you to think and learn fast since you're starting off with a considerable handicap, and I hope in the end I'll be better off.
I have somewhere in the vicinity of 20+ computers under me, all in the same building, and from time to time I have remote offices to deal with as well. Our LAN is managed by about nine servers that serve different purposes, from terminal servers to backup servers, and we have a Windows 2000 network.
Well I'm sure you wil pick up fast; I mean you gotta just play as it comes. Keep posting your questions here and you will keep getting help. And if you want to learn more about a subject then by all means ask and we will teach or refer you to some fine text. And also, I'm up for hearing about the IT world too; let me know how it goes up there and maybe you can teach me some stuff!
You have yourself a deal sir!
Angelic: I'll give you a start..... ;)
I'm writing a tutorial entitled "TCP Flags: Their use and abuse" that I hope you will find interesting. With luck I'll have it done by tonight, if not then by tomorrow.
Ooh yeah, that's exactly what I need! I'll definately be watching for that one.
AngelicKnight,
You might check out Inside the Security Mind; Making the Tough Decisions by Kevin Day.
It's a relatively new book (2003), and the author's approach to security is very different from most books I've read on the topic. It teaches readers how to "think security" rather than smothering them with elaborate detail - it kind of simplifies the subject without "dumbing it down." Besides, you've always got AO for the specifics...
I found it to be practical and easy to read, and it made an excellent source for my research class last semester (topic: Internet Security... I got an A!)
Anyway, reading this post just reminded me of it - might be helpful for a novice network admin that's been "thrown to the wolves"...
-Wiski C.
I believe the exact opposite is true. If you look out across any given city there are thousands of small business' all hooked up to the internet. Perhaps as much as 10 percent of them will have an admin and 50 percent won't have any knowledgable computer user on staff. When stuff breaks they call a computer geek who is there 30 minutes and out. I'm not being rude either, but I enjoy the questions posted by Angelic, even when rudimentary.Quote:
alot of these posts about attacks from you are internet noise and asking what SYN/ACK is any admin would have learned at least the basics of tcp/ip before being let loose in a real world scenario so my question to you is how did you get a job as an admin ?
That rings true, this company did not have an admin at all until recently. The President was the only one knowledgable in IT and doubled as the main IT guy (now there's a wearing of multiple hats!). When he finally reached the point he couldn't juggle it all, he decided to hire someone. Enter me. :) He still does a lot of work himself even now, so I either admin on my own or I'm doing work supporting him.