Keep getting intrusion attemps

CyrixInstead

I keep getting Norton telling me it has blocked a recent intrusion attempt.

The information is characteristic of the Invalid UDP Destination Port attack, whatever that means.

The troubling thing is it always seems to be from IP address XXXXXXXXX.

Can anyone shed any light as to what's going on??

~Cyrix


(IP ADDRESS EDITED OUT BY DEXTER)

Dexter

I edited out the IP address above, because my little button that lets me see your IP address shows me that the address you gave is actually your own. Let me check some things out.

Dexter...

Dexter

OK, Symantec says:

http://securityresponse.symantec.com/avcenter/attack_sigs/sigs/invalid_udp_destination_port.html

Invalid UDP Destination Port

Severity: Low

This attack poses a minor threat. Corrective action may not be possible or is not required.

Attack Category: Suspicious Activity

Anomalous network conditions or traffic patterns. A suspicious activity signature, for example, might detect two systems with identical IP addresses, a condition that indicates an attempted IP spoofing attack.

Description

This attack signature detects packets that have a UDP destination port of 0. 0 is an invalid value for the UDP destination port and must not be used.

Additional Information

Attackers sometime send UDP packets with a destination port of 0 as means of fingerprinting/profiling your operating system.

False Positive

None.

What does that mean....well, it depends on a couple of things. Do you have a router installed on that system? If so, do you have other computers on that system? Or are you just running one computer with a direct connection and Norton Firewall?

Dexter...

CyrixInstead

I have just one computer with a direct connection and Norton Firewall.

\\edit Well, it would seem that it's nothing to worry about. Thanks for the help Dexter.

~Cyrix

Dexter

Yep, it looks like this is low risk. On a direct connection like yours, it could be something as simple as another computer in your subnet (ie, one of your neighbours who uses the same ISP) doing a DHCP request, and the ISP replying with a full subnet scan to see what addresses are in use and what is free. You can probably safely ignore these.

Dexter...

Kwitko

Anything that gets blocked I don't care about. 99% of the time it's a port scan being done by some script kiddie. The other 1% is just intarwebnet garbage, accidental scans, and crap like that.

Norm

I'm new to the forum and I appreciate the posting privilage.
I realize this thread is a month out of date. I hope no one will mind too greatly if I bring it back for a moment, as the trouble I'm having is a bit un-nerving, at least to a newbie.

What brought me here (to Short-Media) was an ongoing problem I am having that resembles the problem CyrixInstead was having, with a slight difference. I know that one thing that was mentioned above may be a neighbor using his computer on the same IP, but this is happening at any given time during the day or night, and never stops.

My computer is also a single unit, no network. I have WinXP Home, 2005 Norton's, and a couple of spyware programs installed...SpyBot and AdAware.

Everything was going along fine for the first few weeks. I would check Norton's Personal Firewall in Statistics, and would possibly have 3 or 4 attacks. Then, a few hours later, maybe 3 more, all from different IP numbers.
All of a sudden in the last three days I am racking up several thousand attacks a day, all from the same IP # 68.119.111.29.

According to the Arin Whois database, this belongs to Charter Communications in St. Louis, MO which is also my own broadband cable company. I have tried to call their tech support people and inquire, but so far have not been able to reach anyone to help me with this inquiry. My local cable office said they were not equipped to deal with a tech issue like this.

My firewall is stopping all this, but it a bit disconcerting to see such a massive attack against my computer, especially in view of the fact that I have used it to go online and do bill paying, etc, at the great urging of my wife who has insisted that I 'join the 21st Century'.

Any help as to what could be causing this will be deeply appreciated, or if anyone has had a similiar experience with no ill effects.

Norm

primesuspect

Well, the IP belongs to charter, so that must mean it's a customer on their network. All you can really do is email abuse@charter.com and tell them that you are logging several thousand intrusion attempts per day from that IP. Give them your IP, attach a log, and somebody will probably take care of it.

My guess is that you're not being "targeted" - you are just being hit by someone who probably has a trojan installed on their computer and doesn't even realize it. I wouldn't worry about it at all. If you can see the attempt, that means it is getting blocked, and your firewall is doing its job.

Dexter

primesuspect wrote:

My guess is that you're not being "targeted" - you are just being hit by someone who probably has a trojan installed on their computer and doesn't even realize it.

Or a Worm on their system, trying to spread itself.

Like Prime said, notify the ISP, give them all the data you can. They can monitor it from there.

Dexter...

Norm

Primesuspect and Dexter, thanks for the quick replies on this matter. Earlier this afternoon I put in a call (on my quarter) to Charter in St. Louis and tried to wiggle my way through an automated tree to get a real human ...I wound up just leaving a voice mail and my callback number.

I also e-mailed two different Charter tech support addresses, including the abuse e-mail. So far, I haven't received any replies or callbacks, but then it's only been a short while. The abuse email is very rigid (like the telephone tree) and there are only a few choices that can be made, unfortionately none directly related to my problem.

I have noticed after looking at the address that is doing the attacking (68.119.111.29)
that it is only 3 away from my own IP address which is a .32.

I also noticed that the attacks would come in bursts of 8 or 10, then no activity for as long as four minutes, then another ten or so attacks would rack up.

Primesuspect and Dexter, thanks for your help and advice. Hopefully, I'll eventually hear from Charter and maybe we can get a fix on this.

primesuspect

Since they are on the same class C as you (the first three octets are 68.119.111), they MUST be someone in your neighborhood. I really am sure it's just someone with a virus or a trojan on their computer, blasting out intrusion attempts on every computer on their local network.

SpywareShooter

I have been getting these lately--usually about 3 per day. They usually come from 127.0.0.1 (localhost) or 0.0.0.0. Is this anything to worry about? Could the 127.0.0.1s be coming from ads blocked by my host file?

Norm

Spyware Shooter, I have had an interesting week with this stuff. I did as Prime and Dexter reccommended and got in touch with Charter Comm on this issue, and interestingly enough, it seemed to do some good. I never heard back from any of my attempts to contact them but as of late Wednesday night (the 8th) I saw that the attacks had dropped so low they were almost insignificant. I was about ready to come back over and repost that all was well in Charterville. I had only a trickle of 'attacks' through last night then suddenly it was like all the stuff that hadn't hit me for three days had been saved up and came in one fell swoop:

Personal Firewall..........
You were last attacked on: 12/11/2004 8:01:40 AM
Recent intrusion attempts: 1308
Most frequent attacker: 68.119.111.29

My old buddy is back with a vengence. That was since I booted up this morning about thirty minutes ago.
I can see me now going door to door in my neighborhood with an IP log asking every adult and child if they would run a 'cmd ipconfig' and check their address on Charter to see if it matches, that they probably have a a nasty in their computer and need to get rid of it.

Prime and Dexter made me feel a lot better by explaining what they thought it was and the fact that NIS firewall was at least doing it's job and keeping this thing at bay, but I'd still feel more comfortable if I knew it was permanently gone. Kinda like having a gitchie-goomie just outside your house and knowing that all there is between you and calamity is a piece of sheetrock.

In any event, if I can find out who it is by watching the neighborhood and seeing who goes on vacation and corrolating that with when this thing goes active, I'll make a friendly attempt to ask to clean up their computer. One or two 'attack' attempts from different IPs I could live with, but this is ridicules.

SpywareShooter

My problem is different though. It is coming from 127.0.0.1, which means localhost, or "this computer". And 0.0.0.0 is an invalid IP address.

552211

These intrusion attempts are normal and come from many different sources. Some could be valid attempts to hack into your comp for malicious reasons but 99.9% of them are not. If your firewall software keeps popping up notices of them, great, it's doing it's job. If the pop ups annoy you, you can change your firewall settings to not show them. If the intrusion attempts really bug you there are several methods of changing your IP address but sooner or later the intrusion attempts WILL start again.

Just set your firewall to not show you them to you and forget about them. If someone gets past your firewall and/or other security features you probably won't know about it until it's to late anyway so stop watching those pop ups and biting your nails.

TheOnyxGuy

I was getting similar problems. Dec 29th, I changed my modem of my ISP to a faster one they sent me. Since then, my wireless router's firewall has been sending me intrusion attempt notifications every 10 minutes where as before they very occasional. Here is an example:


Dear User
Your router has detected and protected you against an attempt to gain access to your network. This may have been an attempted hacker intrusion, or perhaps just your Internet Service Provider doing routine network maintenance.
Most of these network probes are nothing to be worried about - these types of random probes should NOT be reported, but you may want to report repeated intrusions attempts. Save this email for comparison with future alert messages.
Your router Alert Information

Time: 01/01/2002, 08:50:54
Message: IP Spoofing
Source: 192.168.2.1, 1798
Destination:239.255.255.250, 1900 (from WAN)

Visit the UXN Combat Spam web site to get more detailed information about the intruder - http://combat.uxn.com/
1. Type the intruder's IP address into the IP WHOIS search engine
2. Click the Query Button
3. Detailed network and administration information will be displayed


The Time stamp is incorrect. The Router's log says it fails every 30 secs to get an NTP time. The 192.168.2.1 is the Gateway's IP address. According to IANA, the 239.255.255.250 is a multi-cast ip address. My ISP tech support says it's coincidental that these attempts started when I changed my modem. SMC's tech support says there are attempts on my network but they don't seem concerned. They suggest I turn off the notification but then I think that defeats the purpose of having that option.

My computer is connected via ethernet cable and I share the access with my 2 tenants who connect wirelessly.

Any suggestions would be greatly appreciated.

Thanks,

TOG

Dexter

TheOnyxGuy wrote:

Time: 01/01/2002, 08:50:54
Message: IP Spoofing
Source: 192.168.2.1, 1798
Destination:239.255.255.250, 1900 (from WAN)

Note the destination port #1900. That is SSDP - Simple Service Discovery Protocol. This is part of UPnP - Universal Plug and Play. My guess is that 239.255.255.250 is either your new modem, or a UPnP enabled device trying to connect with the UPnP service. Port 1798 is ETP - Event Transfer Protocol, which can be used for all kinds of things.

I suspect that a UPnP device is active on your LAN, or trying to connect via wireless, on port 1900. The router is responding with an ETP packet on port 1798 to authenticate. Nothing else is connecting. The reason you get IP Spoofing warnings is that the 239 address does not resolve within your LAN, so the firewall thinks something is spoofing an IP address.

A couple of things to try:

- find the control for Universal Plug n Play on your router, and disable it

- if that does not work, try this reg hack on all connected PC's: http://www.winguides.com/registry/display.php/1235/

Let me know if that helps.

Dexter...

TheOnyxGuy

Sorry, it's taken so long to write back.

I tried what you suggested. I turned off the Plug n Play on the router and that didn't help. I did the registry thing on my computer and told my tenants to turn off their computers over night. That didn't work.

SMC tech support wrote back and had me change some settings and that didn't work. They also had me update the firmware and that didn't help.

I don't know. Maybe I should just turn off the notifications.

Dexter

From what I read, you need to try that reg hack on ALL connected computers, so you would have to get your tenants to do it too (or do it for them.)

Or just kill the notification....really, the firewall is blocking the attempt, do you really need to know about it?

Dexter...

TheOnyxGuy

Well, killing the notification is what I think I'm going to have to do. But then it begs me to ask why have the feature to begin with. My ISP is sending me a new modem in hopes that will fix the problem.

Thanks a lot for the help Dexter, your analysis of the problem is more substantial than any of the two tech support lines I've been calling. I appreciate it.

TheOnyxGuy

I found a solution. I have to connect the modem directly to the computer without the router. Get into the settings by going to 192.168.2.1 and change the modem to bridge mode. Then hook back up the modem. I no longer get the messages every ten minutes. Thanks for the help Dexter, your insight but me on the right track to finding my solution.

TOG