Another little script I threw together
For the day job, I sometimes need to gather info about an IP address that is being used to launch attacks. I normally query several different whois servers to find this info. Being the lazy individual that I am (and because I'm pretty comfortable in Perl), I wrote a little perl script (using a couple of nice packages that others had put together previously, all can be found on CPAN), to grab all the info at once. The result is ip-as-geo.pl which gives me the following info (separated by |'s): the IP, the CIDR block (or net range) it belongs to, the 2 letter country code where it was allocated (understanding that the system itself may not be in that country), the country name spelled out (in case I can't remember what US stands for), the ASN the IP belongs to, the BGP prefix for that ASN, and who that ASN is registered to. If you find this useful, great. If you don't, please don't send me e-mail telling me it was stupid. If you have suggestions for improvements, please do send those.
---Jim
The scoop on the spike in UDP port 7 traffic
As I mentioned during my last shift, one of the first things I look at when I start my shift is our trends graph. When my shift began 20 hours ago, I noticed that huge spike in traffic on port 7 (and when looking at the ascii data, noted that it was 100% UDP). For those of you who don't remember, port 7 is the old "echo" service (anything sent to that port on a system running the service would be echo-ed back to the sender)
jac@leibnitz[518]$ fgrep echo /etc/services
echo 7/tcp
echo 7/udp
I wasn't quite sure what was going on, but I decided not to put out a call for packets right away. So, when I get to the day job today, I notice that one of our honeypots got hit with traffic to UDP port 7 (so I had the packets without asking you, our readers). I immediately looked at the pcaps and noticed the contents of the packet were a URL and the source was an IP at Texas A&M University. The URL was http://irl.cs.tamu.edu/projects/sampling/service.asp. So, I went and took a closer look at the source IPs in our dshield data and sure enough, most of the sources were IPs in the same subnet at tamu.edu. So, apparently they are trying to find out if anyone still runs the "echo" service (and in 2008 I would hope they won't find any, since for many years we knew this could be used to DoS an innocent party and for probably at least 10 years now, best practice has been to disable it on all of your servers and routers and ...).
Followup to "What's going on..."
During my last shift I posted a story where I noted increased traffic on ports 8800, 1100, and 5905 and asking if anyone had packets. We didn't get any captures, but a week or so later, our friends over at MWcollect posted this story which I found very interesting/useful, so I wanted to point it out to the rest of you who may not follow their blog. I haven't played much with libemu, but after reading this, I clearly need to spend some more time with it.
Update: (2008-07-02-13:55 UTC) The MWCollect guys, say this is the most current version of their story. They also recommend that folks trying libemu for the first time use the SVN version as that is the most current version (bug fixes, etc.) Thanx, Markus.
Firefox 2.0.0.15 is out
For those of you that haven't yet made the move to Firefox 3.0, the Mozilla folks have released Firefox 2.0.0.15 which according to the release notes link (see below) fixes a security vulnerability. However, the "known vulnerabilities" page (linked from the release notes page) doesn't include any info (yet) on what that security fix is.
References:
http://www.mozilla.com/en-US/firefox/2.0.0.15/releasenotes/
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
Update: (2008-07-02-14:15 UTC) Well, they have updated the known vulnerabilities page. This version apparently fixes 12 issues, 4 of them critical, so if you are still running FF2, you'll want to update ASAP. Also, note that Seamonkey was also updated to version 1.1.10 and included fixes for the same issues plus one additional critical vulnerability, so updated that one, too, if you use it.
Comments