Date: Tue, 2 Mar 2004 18:57:42 +1100 From: Tony Frank <tfrank@optushome.com.au> To: Ian Smith <smithi@nimnet.asn.au> Cc: freebsd-net@freebsd.org Subject: Re: Bad loopback traffic not stopped by ipfw. Message-ID: <20040302075742.GA18966@marvin.home.local> In-Reply-To: <Pine.BSF.3.96.1040229004305.17000A-100000@gaia.nimnet.asn.au> References: <20040227151405.GA5540@marvin.home.local> <Pine.BSF.3.96.1040229004305.17000A-100000@gaia.nimnet.asn.au>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi, Bit of a delayed response I'm afraid - PC troubles. On Sun, Feb 29, 2004 at 01:28:23AM +1100, Ian Smith wrote: > On Sat, 28 Feb 2004, Tony Frank wrote (in freebsd-net@freebsd.org): > > > On Wed, Feb 25, 2004 at 05:21:34PM +0300, Gleb Smirnoff wrote: > > > On Wed, Feb 25, 2004 at 04:19:51PM +0200, Iasen Kostov wrote: > > > I> >>16:26:23.287642 0:1:2:9>c:cf:e2 0:02:55:b0:90:e4 0800 60: 127.0.0.1.80 > > > > I> >>192.168.118.205.1046: R 0:0(0) ack 1959723009 win 0 > > > I> > > > > I> >This is some kind of Win32 virus. This floods can be easily > > > I> >stopped by ipfw rule: > > > I> > > > > I> >deny tcp from any to any tcpflags rst,ack > > > I> > > > > I> These packets never reach IPFW as we can see. > > > > > > Ughu. Really. > > > But I have millions of them from non-localhost addresses. > > > > > > > This maybe is of interest? > > > > http://www.dshield.org/pipermail/list/2004-January/014027.php > > I'm sorry Tony, call me thick, but I couldn't see the relevance of this > posting "[Dshield] ISPs - How much monitoring is enough?" to the topic > regarding these inbound packets 'from' 127.0.0.1:80 ? I'm kind of > curious though, having seen several hundred of these (blocked by ipfw on > an ol' 2.2.6 system) over the last couple of weeks. > > Looks like an interesting list for such stuff, though; had a browse. The link seems to have changed. Checking it now I find something unrelated. Too much mail, too little sleep. Specifically on the question at hand regarding 127.0.0.1.80 business it seems to be relating to blaster and some aspects of how some admins tried to stop it. I'm including the message text (was a cross from securityfocus): -----Forwarded Message----- From: Dan Hanson <dhanson at securityfocus.com> To: incidents at securityfocus.com Subject: Administrivia: Are you seeing portscans from source 127.0.0.1 source port 80? Date: Tue, 28 Oct 2003 08:59:56 -0700 I am posting this in the hopes of dulling the 5-6 messages I get every day that are reporting port scans to their network all of which have a source IP of 127.0.0.1 and source port 80. It is likely Blaster (check your favourite AV site for a writeup, I won't summarize here). The reason that people are seeing this has to do with some very bad advice that was given early in the blaster outbreak. The advice basically was that to protect the Internet from the DoS attack that was to hit windowsupdate.com, all DNS servers should return 127.0.0.1 for queries to windowsupdate.com. Essentially these suggestions were suggesting that hosts should commit suicide to protect the Internet. The problem is that the DoS routine spoofs the source address, so when windowsupdate.com resolves to 127.0.0.1 the following happens. Infected host picks address as source address and sends Syn packet to 127.0.0.1 port 80. (Sends it to itself) (This never makes it on the wire, you will not see this part) TCP/IP stack receives packet, responds with reset (if there is nothing listening on that port), sending the reset to the host with the spoofed source address (this is what people are seeing and mistaking for portscans) Result: It looks like a host is port scanning ephemeral posts using packets with source address:port of 127.0.0.1:80 Solution: track back the packets by MAC address to find hte infected machine. Turn of NS resolution of windowsupdate.com to 127.0.0.1. Hope that helps D --------------------------------------------------------------------------- Regards, Tony
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20040302075742.GA18966>