Editing c:\windows\system32\drivers\etc\hosts

My ISP is having some teething problems with its "upgrade." I needed a way to point my name resolutions for www.comcast.net to the one server they operate which is working, and not to the default server which isn't working. Following this tip I edited c:\windows\system32\drivers\etc\hosts:

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
63.240.76.72 www.comcast.net

Read More

Security Checklist for FreeBSD 4.8

While reading the BSDforums I learned of a new security checklist for FreeBSD 4.8. You can read the thread behind this doc. It's a work in progress and may help out the FreeBSD security initiative at CISecurity.

Read More

Odd Activity in Argus Logs

Checking my Argus logs this morning, I noticed a few odd scans. The first is to port 2 TCP, which according to the Internet Storm Center is becoming popular:

16 Jun 03 03:12:08 tcp 24.96.49.46.4396 -> my_IP.2 TIM
23 Jun 03 07:59:05 tcp 220.120.31.233.4900 -> my_IP.2 TIM

I'm also seeing scans to port 57 TCP, which has history dating to Oct 02 and Nov 02 and is a signature of a tool called FX-Scanner (analysis). Apparently port 57 is used as a host discovery mechanism. Here are three examples.

First, recon for port 1433 TCP:

12 Jun 03 18:22:17 tcp 161.53.40.97.4464 -> my_IP.57 TIM
12 Jun 03 18:22:17 icmp 161.53.40.97 <-> my_IP ECO
12 Jun 03 18:23:04 tcp 161.53.40.97.1217 -> my_IP.1433 TIM
12 Jun 03 18:25:08 tcp 161.53.42.46.2036 -> my_IP.57 TIM
12 Jun 03 18:25:08 icmp 161.53.42.46 <-> my_IP.55 ECO
12 Jun 03 18:25:55 tcp 161.53.42.46.3590 -> my_IP.1433 TIM

Next, recon for ports 80 and 21 TCP:

18 Jun 03 15:02:53 tcp 67.116.81.237.3836 -> my_IP.80 TIM
18 Jun 03 15:03:14 tcp 67.116.81.237.4067 -> my_IP.57 TIM
18 Jun 03 15:02:53 icmp 67.116.81.237 <-> my_IP ECO
18 Jun 03 15:03:35 tcp 67.116.81.237.4325 -> my_IP.21 TIM

Third, recon for ports 1433 and 445 TCP:

19 Jun 03 11:35:14 tcp 4.40.163.36.1951 -> my_IP.57 TIM
19 Jun 03 11:35:38 tcp 4.40.163.36.1725 -> my_IP.1433 TIM
19 Jun 03 11:35:13 icmp 4.40.163.36 <-> my_IP ECO
19 Jun 03 11:37:50 tcp 4.40.163.36.2221 -> my_IP.445 TIM

I'm also seeing recon for 3410 TCP. This has only picked up in the last few days. It appears to be associated with the Backdoor.OptixPro.13:

18 Jun 03 01:03:52 tcp 68.120.129.51.4730 -> my_IP.3410 TIM
19 Jun 03 08:30:49 tcp 207.190.78.253.1414 -> my_IP.3410 TIM
19 Jun 03 17:27:04 tcp 68.113.237.250.2200 -> my_IP.3410 TIM
22 Jun 03 15:27:27 tcp 12.247.109.85.1055 -> my_IP.3410 TIM
26 Jun 03 19:25:01 tcp 68.41.93.143.3327 -> my_IP.3410 TIM
29 Jun 03 11:13:00 tcp 68.169.152.189.3554 -> my_IP.3410 TIM
29 Jun 03 12:09:59 tcp 68.61.193.97.1707 -> my_IP.3410 TIM
29 Jun 03 12:40:17 tcp 68.78.131.6.1730 -> my_IP.3410 TIM
30 Jun 03 00:56:29 tcp 64.83.224.72.2246 -> my_IP.3410 TIM
30 Jun 03 02:38:13 tcp 217.231.192.242.4191 -> my_IP.3410 TIM
30 Jun 03 03:29:07 tcp 65.30.207.110.2940 -> my_IP.3410 TIM
30 Jun 03 04:02:53 tcp 24.126.135.126.1500 -> my_IP.3410 TIM
30 Jun 03 04:51:57 tcp 24.79.19.59.1319 -> my_IP.3410 TIM
30 Jun 03 05:30:51 tcp 81.103.33.198.1395 -> my_IP.3410 TIM
30 Jun 03 07:53:05 tcp 68.12.239.185.4690 -> my_IP.3410 TIM

Read More

TaoSecurity Web Down

My TaoSecurity web site is down while my hosting provider upgrades its servers. Estimated returned to service is at least by Monday morning.

Read More

Les Cottrell Network Monitoring Tools

Les Cottrell maintains a comprehensive list of network monitoring tools. He responds to email if you'd like to suggest additions. CAIDA (Cooperative Association for Internet Data Analysis), lists tools also.

Read More

Packet Creation Tools

Looking for packet creation tools on UNIX? Nemesis and Hping have been around for three years, while Packit is a newcomer from earlier this year. You can find the FreeBSD ports for all of these at FreshPorts. Others exist but these are some of my favorites. I've used IPSorcery on Linux. Windows users can check out Komodia and lcrzoex (which also runs on UNIX).

Read More

Anton Chuvakin profiles TaoSecurity Blog

Anton Chuvakin wrote this blog entry profiling my blog. Thanks Anton! Also, his blog made me aware that the former Psionic tools (acquired by Cisco in Oct 02) are available at Sourceforge. Cisco makes some of the tools available on their site, like Cisco Threat Response (formerly Clear Response), mentioned by Craig Rowland.

Read More