Once is happenstance.....

...twice is coincidence and three times is an act of war Mr. Bond.

[Goldfinger, from the book of the same name by Ian Fleming]

Overview: This is my home network consisting of 2 win2k servers hard wired to the network, automatic updates configured and functioning. One Win2k workstation, hard wired, autoupdating that is functioning. Two WinXP SP2 wirelessly connected to a MAC filtered, WPAPSK encrypted wireless access point, autoupdating that is functioning. The WAP is a Netgear FWG114P configured to allow SMTP, RDP and HTTP to one of the two servers and a secondary HTTP forwarded to one of the wireless laptops, (mine), though the port on the laptop is no longer open - thus a dead forward.

Happenstance: The wireless laptop used by me is generally left connected with certain trusted web sites open in Firefox tabs including my SSL work email, (I know - naughty me). The wireless does drop from time to time and if it is left for a while I find it best to try to connect to Yahoo prior to trying to refreshing my work email or it fails out. Last night I restarted the laptop because it would not come out of hibernation - it was just doing too much but since I had 2 instances of IE also open - because you can't run StatTracker for fantasy football with anything but IE and since yesterday was Sunday both windows were there. I then opened Firefox and attempted to log in to my work email. The certificate came up which I accepted and the login screen was presented. I put in my credentials and hit "OK". I was then warned that I was leaving an encrypted page :eek:. I thought about it for a second and decided to proceed. I was provided with my work email - all nice and up to date. I selected an email to read and was presented with the login screen..... Hmmmm..... Me no likey.... The connection was HTTPS, the address bar still indicated I was at my work site but I hadn't been presented the certificate..... I chose to proceed regardless, entered my authentication information and everything went well from there.... There was a niggle in the back of my head but I dismissed it.....

Coincidence: I got up this morning got my coffee etc. and went to my wired workstation in my office. Since it was Tuesday it was time to check on the final results and standings in my fantasy football league. Upon finding how badly I am now doing I noticed that my brother had left me a message so I replied. As Yahoo does it will as you for your password if you have been inactive for a while - it did. I didn't think to check the address bar but the page absolutely appeared to be Yahoo's login screen. I entered my password and was warned that I was leaving a secure page.... which is unusual... I accepted the warning and was represented with the login screen..... :eek: Needless to say red flags are up everywhere..... Since time is limited at this hour on a workday I simply closed the two HTTP forwards on the router and checked for the existence of my logs from it on my wired workstation.

Those logs are the only ones I have since I turned off my snort some months ago because I use the VPN a lot for work and having two interfaces running crashes the computer if you fire up the VPN. I will be going through them in the near future.

Since arriving at work I have connected to home via RDP enabled the external interface, (outside the firewall), on my wired workstation and fired up ethereal on it. I then connected to the wireless WinXP laptop and have enabled Ethereal there too. We'll see what happens over the next 24 hours.

Additional Facts:

1. My surfing at home is entirely predictable. Work email, Yahoo, Yahoo UK and Sports, Reef Central and that's about it.

2. My surfing on the laptop is exactly the same as on the workstation but I also do some searches for woodworking stuff due to the bar construction. Basically, my surfing habits at home could be considered very low risk.

3. Sweetie Pie is a bit of an unknown quantity with regards to surfing. She does a lot of surfing for free stuff for her classroom but since she got herself some nasty spyware through IE about a year ago she has been switched to Firefox and has shown to be clean ever since.

4. There are only two houses close enough to me to be able to hold any kind of connection to my WAP reliably. While I don't really know the neighbors I don't believe they are technically adept enough to break my encryption, (run with this for now, ok). Add to that the fact that I have never seen another WAP from my laptop implies that there is no wireless device usage in range.

Questions:

1. Should I readily accept the fact that the "act of war" will come - ie. is this something more than coincidence?

2. Has anyone else noticed "glitching" like this and did I just get two in unusually quick succession making this look like a bad situation when it really probably isn't?

3. Am I a paranoid old bastige?

4. Any other thoughts or comments since I'm not yet ready to begin a full scale forensic investigation on 5 computers.... I'm trying to finish my damn bar..... and the login credentials I have used in these situation are, in no way, what I consider to be my secure ones and won't be able to be used for priviledge escalation nor additional password guessing ;)?

Glitches with Yahoo? Yes I've had it from time to time. I can't log into Yahoo from work using Firefox it continually presents log inscreens and other oddness.

I hate to ask the obvious but...

You've scanned the revant machines for malware?
Have you considered changing passwords as a just-in-case measure?

Possibility that an MS update or other software update could have produced a wobble?

Not had time to do much yet.... When the "coincidence occurred i was about 5 mins away from my scheduled morning shower..... Yes, I have one daily..... :D

Quote:

---

Possibility that an MS update or other software update could have produced a wobble?

---

I agree with aspman....may be due to a recent windows update.

Quote:

---

3. Am I a paranoid old bastige?

---

No....... not you Tiger :cool:

One question...do the servers do any authenticating on your network...like for your XPs and 2k ws...do you have to log on to the network for access to the internet etc?

MLF

Quote:

---

Yes, I have one daily

---

I remember speaking to an old farmer once and he proudly said,

"I have a bath once a week wether I need it or not!"

Morgan:

The servers do run AD for my "domain" however I log onto my workstation and laptop locally and sweetie pie logs on either locally, (if she needs to install something), or as a domain member under normal use so her stuff is backed up to the server.

Frankly I'm not particularly worried about a compromise of my domain but rather the fact that my workstation and laptop hold the "keys" to the work "kingdom" in that they are used to initiate VPN connections and then other domain authentications that I would rather not have "go public".

when you accepted the certificate....read it carefully....was it expired?

I have noticed a change recently with yahoo. If I receive an email through outlook and it contains a hyperlink to part of the yahoo portal, I get asked for confirmation if I use the link. I have attached a screen shot of the two logins. The login on the right is the first, at this one I have to enter login name and password. The second login already has my user name and I am just required to enter my password.

This confirmation login screen is new, to me at least. It has only been the last week that I have had noticed this occurring.

Is this the same behaviour you are experiencing?

Jinx: Memory fails me on that point and I just tried to test it and the session hasn't timed out yet so it lets me straight in.

Fyre: Nope... I didn't read it.... I never do now.... I log in to my work email so often that I don't bother.... Hey, no-one's perfect... ;)

You may want to verify if the certificate is valid. if it's not there is a good chance you're being hijacked probably on either side of your router. Applications such as Cain and Abel (www.oxid.it) can do it fairly easily. Basically the applciation allows an attackers machine to act as a router between you and another netowrk point. the initial attack is performed via APR cache poisoning, position the attackers machine as a a routing point for your traffic. When you connect to a secure site such as webmail the attackers machine will accept the certificate from the authority and then send You a fake certificate as tho the attacker was the authority. At this point you do have an encrypted tunnel between you and the attacker. It's a classic Man in the middle attack. Now this may not be the case but it is possible. If it is the case any userID and password you have entered since it began is compromised.

So how do you prevent it? or prove it? Where is the hack?

If it is inside your network via hole in the router ro what not not that will probably be detected by ethereal, look for excessive APR messages. If your concerned about the wireless side you can change your security schema (new keys, passphrases etc). If they have keyed off your IP address externally...I'm not sure how to fix that one.

it could also have compromised one of your local machines you can look for services such as Abel running as a process, Abel can operate as a remote "bug".

hope this helps a bit.


FyreMouse

I know you are not using WEP, right???

Also proximity isn't that relevant. A dedicated attacker can have something like this

http://www.cantenna.com/
http://www.turnpoint.net/wireless/cantennahowto.html

or just pull up in a car

also it helps to check if the time on your systems isn't screwed (expired cert. problem)

was the email legit ... not one of those made look like login screens which will re-mail your auth info to the attacker

I'm beginning to think I was being paranoid.... ["What YOU" everyone shouts.... :rolleyes:].

I have been through my ethereal captures on both the wireless sniff and the external.... There's lots of AV updates, some Windows updates, some scans etc but there isn't anything screwy in 10 hours of capture and I haven't had a repeat of either "oddity" either.... I'll run the ethereals overnight and see what pops up.....

Quote:

---

Originally posted here by Tiger Shark
I'm beginning to think I was being paranoid.... ["What YOU" everyone shouts.... :rolleyes:].

I have been through my ethereal captures on both the wireless sniff and the external.... There's lots of AV updates, some Windows updates, some scans etc but there isn't anything screwy in 10 hours of capture and I haven't had a repeat of either "oddity" either.... I'll run the ethereals overnight and see what pops up.....

---

Paranoia is good, ;)

But when one is troubleshooting, should we all go for the extreem measures first or look at the more simple?

That is rhetorical, as it should depend on the situation :D

Jinx:

Yeah, I like paranoia.... I see bogey men in the clouds.... ;)

I would be more concerned if the behaviour was repeatable.... Since it isn't then there are two options:-

i) coincidental glitches
ii) the "attacker" has removed his harvesting system, (possibly in preference of a better system)

As it is I gave away "nothing" passwords to date and have not been using hese boxes for anything other than the same stuff.... I will probably use an alternative way out if I _need_ to work fr a while to see what happens.....

your not paranoid your old. by the way, make sure to forward the logs to a non web email account. not sure what isp you use but send an email to yourself with the logs as an attachment so you can look them thoroughly over if possible. from what i have heard your from michigan too. maybe its time for some tux + gore and tiger chats because your paranoid which is ok but you leaving work email open like that, not sure how id go about telling you bad boy. you have to know by now that michigan is hot for war driving. its almost disgusting. one thing though, gore may be ok with all that windows you got there, but damn man id bring a sawed off.

Where the heck have you been mandraketux?

Good luck solving the case TS. Hopefully it's nothing. But if it is nothing, that might be bad if you're paranoid because you'll always wonder. Perhaps it would be better if you find something wrong and fix it.

Quote:

---

"coincidence occurred i was about 5 mins away from my scheduled morning shower.....

---

thats the trouble with coincidence and paranoia it wont even give you a chance to scratch your balls..

There is a saying.. "Better safe than sorry"

Quote:

---

your not paranoid your old

---

Well.... Don't beat around the bush old chap.... Say what you mean... ;)

Undies Old Man..... I agree entirely.... <LOL>

As to a wardriver.... I have discounted that for the following reason:-

1. If it were a wardriver he would have had to be sat in range on both occasions. That would mean he would have to have been there at 4:30ish in the evening and again at 5:10am the next morning. I would suggest that it would be unlikely that he would be there for that long or, coincidentally, on the two times I was on unless he had been stalking me for a long time to ascertain my habits.... I haven't lived there that long and my habits have only recenly become "established".

I have discounted this being an installed system for the following reason:-

2. If it were an installed system to harvest passwords it would have to have either be programmed to pick up on my specific connections that require a password or it should be able to recognize the fact that I am about to submit a password, form a copy of the page on the fly, submit the results to the wrong IP address and then return me to the password submission screen of the original web site. Is that _possible_? Yes, but it would take some significant programming and a certain amount of AI to accomplish and would, undoubtedly be quite buggy thus displaying other evidence of it's existence. Furthermore, in subsequent tests of sites, (both the ones that "glitched" and some that I haven't logged in to for a while or from my home network), where I am required to submit a password the symptom is not repeatable. An installed program would continue to display the symptom on web sites that have not been previously harvested - which would be illogical since it would be sensible to _always_ function in case the user has changed their credentials.

Conclusion: I'm paranoid!!!! :D

But, I have good news.... With all the sniffing I did I found a misconfiguration that leaks DNS information to the ISP's DNS servers which _could_ be sniffable to determine that I run an AD domain within my network. This issue is being fixed in a minute or two.... Oh, and I saved a bunch of money by switching to Geico...... :D