Kerio/scotty/wp/ms/subseven???

I'm putting this in the Newbie section because I am :)

I just reinstalled Windows (XP Pro)... did all the service packs/updates before connecting to the Internet... Scotty installed, MS anti-spyware, Kerio PF, Tauscan, S&D.... disabled Netbios... all that stuff.

And this may be a retarded question, but why do I have this in my logs? Can't copy&paste from Kerio, but I have everything from BackdoorSubSeven DefCon 8.21 to Phasezero... every backdoor that's ever been invented, it's in those logs. POR QUE? Why? Waarom? Warum? Pourquoi? Trojan-this, trojan-that... all of them... class:succesul-user... QUE?

Using kerio ? Sounds like a bug. Is your kerio up-to-date ? Type (in a DOS shell) 'netstat -a' and see if any unusual ports are up/listening/established. If nothing but the usual is up (ie; the loopbacks and www connections) then it is deffinatly a bug. If you see something like port 27374 (default sub7 port) or 31337 (default back orafice port) open, then it is time to get worried. For now, I'd just recommend updating kerio, or gettin another firewall.

inbound traffic? are you on a fixed IP (or atleast a semi fixed)
I am assuming that Kerio blocked the traffic
How persistant are the incidents, are these hammering at the door, or just passing bell ringers.. what I am asking is there a pattern ie port 1234, 129, 11234 14789 33000 etc and repeating from the one IP.. some one hammering at the door.. the one to look i nto..
or a scann from one ip, then another IP from random domains,but similar ports.. the passing doorbell ringer, worm activity.. some worms do scan various ports and a few firewalls will report them as the various trojans ..

Neg is it possable to export the Log to a txt file, or just brows to the Prog file dir and open in notebook..

**** wher have I got a machine with Kerio on it,..

Cheers

Don't know how to export the logs, but here's a screen shot...

Neg: im getting the exact same thing at least its dropping the traffic even stranger im behind a hardware firewall/router

I'm behind what you could call a firewall, too, I guess (Linksys wireless) ;)

What really bothers me is that this box is fresh... installed XP Pro on it, installed all service packs from CD, Kerio, WinPatrol, MS Anti-spyware, Spybot's Tea-timer - all from CD. I connect to the Internet and this stuff starts happening. It looks like it's isolated though (only happened once last night)...

Sounds like one of 2 things were happening, either there were a lot of scans going on last night that make sense since both of you were seeing issues.

I would really hate to think that a firewall/IDS like Kerio would come up with false positives but its a possibility.

It looks like the "Script Kiddies" were out in full force last night as my logs also had a number of these type scans. Sounds like a kid found a prog and was hitting on different ip ranges.

Neg:

ROFLMAO.......www.whitehats.com.....

Your box is just fine..... Something, possibly Kerio, is downloading the defs and info for all the different signatures up there on whitehats......

Go kiss Mel for me and quit worrying..... ;)

Internal loop backs???

Jinxy:

Trust me.... The IDS sigs/info, (note that the end of every line in the jpg ends in IDSXX where XX is an incrementing number), from whitehats contain the Snort sig _and_ the packet dump to demonstrate.... The sig or the packet dump will almost always kick off an IDS alert in IDS's, (kerio?), that don't apply specific rules to the depth and offsets in the packets received.....

That is exactly what is happening here and why I suspect it is kerio that is d/ling the information....

Tiger > That crossed my mind, and is probably what happened. The thing that threw me off is that there are a bunch of real attempts in between those downloaded definitions (the part I took a screen shot of is the only one that doesn't have others in between) - there's an "unsuccessful miscellaneous PCAnyWhere login", for example - and a bunch of NetBios-attempts. Those too have a reference URL at whitehats.com, making it look like Kerio's IDS is saying "Hey, someone tried something - here's the URL if you want more info" - and that's what it looked like to me for those "downloaded definitions". They could at least put that info somewhere else - it's in the "High priority intrusions" log :s

Neg:

They would be in the "High Priority" if the "intrusion" attempt were not specifically delineated.... This is why Snort is the best out there as an IDS...


For example.... let's say that the word "Neg" is considered part of an attack sequence,,,,

An _improperly_ designed IDS will alert on the word "Neg" in any packet, anywhere in the packet....
But, in reality, the word "Neg" in the attack sequence _only_ occurs between the 65th and 85th bytes in the packet.... Then a Snort rule will delineate that.... The other rules that look only for content as opposed to it's proper position within a packet will alert where Snort would pass it....

This is what you are experiencing.... No offense, an inferior"IDS", (Kerio is a firewall that like to tell you how well it is doing...), is warning you about things it shouldn't....

Now, do as I asked please.... Go kiss Mel.... twice now.... and quit worrying.... You did everything right.... except not kissing her first time around and forgetting about it.... ;)

Now, I don't pay very many visits to whitehats.com, but have you tried any firewall/intrusion tests from that site? Do they even offer such services? I'm pretty sure you would have known that, but I thought I might as well ask... I'll have to check my firewall logs once I get to my computer... As of now, I'm watching Jason X on Sci Fi :D :D

First of all, you're using KPF 2 if I'm not mistaken. Dump it and get KPF 4. It's less whiny and has a better IDS.

Cheers,
cgkanchi

I'm using 4.1 ;)

I guess no-one can see my posts....

That being the case..... Can I kiss Mel..... While you reformat and reinstall.... :D

No. Heh.

Tiger, I asked you a question in an AP assignment... :)

Duck: Your right.... My addled brain forgot about it... I apologize....

I don't know about a particular site.... I learned about how Snort actually works by buying the book Snort 2.1, though there is a Snort 2.2 books and be aware that Snort 2.3 was recently released... It's a great book that gets into the engine itself and the way rules are written and interpreted by Snort itself.... Quite fascinating.....

Quote:

---

No. Heh.

---

I had to try..... Just don't tell my sweetie.... There's a small chance she might not understand.... Ok... It's more than a small chance..... But only a little bit more than that.... He says.... hopefully.... ;)

Ah, thank you tiger, I guess i'm just going to have to download snort and use it myself, maybe the experience of using it will help me understand it better... I'll have to look into those books as well. There wouldn't happen to be a pdf version somewhere would there??

Anyway, thanks again tiger.