Printable View
My SonicWALL's showing some strange activity that's started repeating daily since around last week. Every day, I get a series of alerts within the same time frame. I have port scans coming in from 64.94.110.12, which takes you to the Verisign website if you enter it into your web browser. During that same time frame, I'm receiving fraudulent Microsoft Certificates from the same IP that are being blocked by the firewall.
So what's up with this?
Block the IP. And the reason you get the Verizon website (I believe) is because that's the person's provider/ISP. Also, what port is being probed?
An infected CRL server? Is the port scan from this server at regular times each day? Sounds like it might be a worm. Might want to remove their IP as they could be innocent of the activity and might want to notify Verisign of this (as a courtesy)
Is this related to your query in this thread AngelicKnight?
If so,and the port numbers're the same..hmm..interesting..I wonder why Verisign would portscan you..and why only those ports?If Versign were 0wn3d(worst case scenario),wouldnt the attacker be scanning you all over rather than just those particular ports?And I'm not too aware of any vulnerability for those ports either so it makes me think that Verisign's behind it and the intent isnt malicious
EDIT:Oops,forgot to post the damned thread lol,here it is:http://www.antionline.com/showthread...696#post753696
Yep Renegade, it is directly related to the other thread I started. It's been a week or so since that thread was active, so I couldn't find the dang thing to continue with it and had to start a new one.
Ports scanned are: 1183, 1184, 1185, 1186, 1187, 1105, 1104, 1106, 1107 and 1108.
Angelic, your router/fw is disabled for icmp redirect and source-route frames, right? maybe its an ip spoof attack
your not using a P2P software such as LimeWire are you? I noticed weird patterns when I started block IPs on Ports and then realized these hits were individuals sharing files via P2P.
caco -- I have yet to find any such settings, so they shouldn't be active.
CT -- No P2P stuff.
If Im correct, attacker is using verisign ip address (that is suppose to be thrustfull) and redirecting your response to "his" computer.
Usually all fw have protection against this kind of attack. But im not sure about Sonic.
IP spoofing?I dont think so cacosapo,it'd again mean that Verisign had been 0wn3d of sorts or was subject to a dDos attack of some kind,which brings us back to the simple point of...if someone were to mess with a reputed company like Verisign just to attack AngelicKnight(no offense meant here mate),he'd be mighty stupid..daring,,and just plain DUMB..why not just attack a smaller network and use it instead?which makes me think that the scan's being conducted by Verisign
Well, it's not an attack against me, it's an attack againts the company, which is among the top financial advising companies of this region of the country, making them a good target.
But if it's not IP spoofing, why in the world would Verisign 1) scan my ports repeatedly and 2) send fraudulent M$ Certificates?
I would suggest that you might be being used in some kind of reflected attack on Verisign. That's why the address is Verisign's. If I sent you a SYN with the IP address of the source spoofed to Verisign's where do you think your SYN/ACK is going? Verisign of course. Couple this with the faked certificates, (part of Verisign's business is certificates), you might be in the middle of something a little larger.
Can you get an ethereal dump of the sequence of events in question. Then you can make a better determination of what might be going on.
I can give you a reason why get verisign: every one trust it. Why someone will think that verisign is attacking him?
If Verisign is (or was) under attack, everybody should notice too. Due to we just see one case, it appears more to ip spoof that a massive attack to verisign. An easier to do so.
But, just to follow your argument, why do you think that is a Ddos attack and verisign is owned?
/Edit
Ive read TS post and agree (in part) that may be a reflection attack. But what about fake certificates? Im not sure that someone can send fake ones thru reflection (they can?)
Thats why I'd like to see the Ethereal dump...... The portscan is probably only being reported on the strength of the SYN packets. I want to see if there is anything else of interest crossing the wire. Maybe someone thinks they can make an entire attack on something at Verisign by bouncing off Angelic.
Till we know what other traffic is passing by we are just "shooting in the dark".
The attack you described cacosapo, would mean that if Verisign was being used by someone else,they'd do it by two options:
1.Gain control over their server and use it to attack AngelicKnight's server
2.Subject Verisign to a massive Ddos and use ip spoofing to attack AngelicKnight's server
Both of the options seem remote to me,AngelicKnight,any luck contacting Verisign?
Here's a link,could it be this?http://www.dslreports.com/faq/7998
Ok, time to be n00bish, ethereal dumps are new on me, so how do I go about doing that?
*off I go to Google...*
Angelic:
In a nutshell
1. D/L and install WinPCap 3.01(?) (googleable)
2. D/L and install Ethereal latest version, (Googleable)
3. Unbind all protocols from the NIC
4. Install small _hub_ between border router and firewall
5. Connect NIC to hub
6. Start Ethereal
7. Start Ethereal packet capture.
8. where it asks for the filter type "host 64.94.110.12" without the quotes.
If you have more than one NIC in the box make sure you select the appropriate one - run a test with no filter first. if it captures traffic you are in. Stop the capture and repeat steps 7 and 8.
Then go to bed or whatever you do while waiting for this event to occur.
When you are sure you have captured the events do this:-
1. Stop the capture
2. File - print
3. Select "output file" and name the file c:\temp\ethereal.txt
4. Select "all packets"
5. Select "All dissections expanded"
6. Print
7. open c:\temp\ethereal.txt and find/replace the first three octets of your IP block
8. Save file
9. post it here
Ah crap, I don't have an extra hub to use for that. What else can I do?
Does sonicwall allow you to put a computer outside itself, Like a linksys DMZ? That would work....
A switch with port spanning would work.....
Outside that.... erm.... I dunno.... You need to see the traffic as it approaches the firewall to know what is really going on out there.
I dunno, I'll look into that Tig.
Ok, that was with our DSL line. Today, I found a possible IP spoof from 10.10.10.1 in the log, except it says this IP was from the LAN. How could this be?
These look alot like source ports to me. Imagine the following scenario:Quote:
Originally posted here by AngelicKnight
Ports scanned are: 1183, 1184, 1185, 1186, 1187, 1105, 1104, 1106, 1107 and 1108.
You have say 10 users that go to an SSL site. This SSL site has a server certificate signed by verisign. Every user verifies this certificate. If this happens fast enough and if your portscan threshold is too low the firewall will think it's a portscan.
Why do you think they're fraudulent and why is your firewall blocking certificates?Quote:
During that same time frame, I'm receiving fraudulent Microsoft Certificates from the same IP that are being blocked by the firewall.
If we build on the scenario above could it be one of those PC's tries to verify a verisign signed certificate. The response gets blocked by your firewall. Client tries this a couple of times (hence the ascending portnumbers). Firewall thinks it's a portscan.
I don't know how they are determined as fraudulent, they are just described as such by the SonicWALL log. Thanks SirDice.
http://www.dslreports.com/faq/7998Q: Why is my computer trying to contact crl.verisign.net? (#7998)
A: "CRL" is a "Certificate Revocation List", and it's a list of SSL web security certificates that should no longer be trusted. These could have expired, been stolen, or otherwise removed from service, and it's part of a security infrastructure supported by Verisign. Your system is merely trying to get the latest list of revoked certificates so it won't accept them as "valid" any longer. The activity is innocuous and won't hurt anything. You trust Verisign for a lot more than this every day.
It is dumb, however, that visiting crl.verisign.net brings up a list of files whose purpose is not obvious: it raises many more questions than it answers. Many of us believe they ought to put up an "index.html" page that describes why the server there.
Sure its just not your network trying to do this?The possible ip spoof bit seems interesting hmm...
It could be, but I have no idea how to find out. Also, the link for the FAQ came up as invalid. Thanks.
It's supposed to do that. A CRL is usually checked by a program not a person. Then a list is alot simpler to process.Quote:
Originally posted here by therenegade
It is dumb, however, that visiting crl.verisign.net brings up a list of files whose purpose is not obvious: it raises many more questions than it answers. Many of us believe they ought to put up an "index.html" page that describes why the server there.
Verisign says that it's just us trying to check on our invalid certificates with their CRL list (or something like that anyway), so the port scans are normal.