Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #205601

Re: Strange attacks in my log

From Reco <recoverym4n@enotuniq.net>
Newsgroups linux.debian.user
Subject Re: Strange attacks in my log
Date 2019-02-21 18:30 +0100
Message-ID <xu0kx-rj-3@gated-at.bofh.it> (permalink)
References <xtSZH-4w1-3@gated-at.bofh.it> <xtYsp-7LG-7@gated-at.bofh.it> <xtYLM-7RI-9@gated-at.bofh.it> <xtZy9-8mf-7@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

	Hi.

On Thu, Feb 21, 2019 at 05:29:56PM +0100, Hans wrote:
> Am Donnerstag, 21. Februar 2019, 16:46:42 CET schrieb Reco:
> Yes, worked. However, I did not find any unusual, however, putting a stick in 
> is starting "colord-sane", which will explain the UDP request.

Judging from the whopping 151 lines of the source of this colord-sane -
it cannot explain UDP.
Just a wild guess, though. Do you have HPLIP installed?

Oh, can I see the audit please? Unless it's private and all that.


> This does not explain, why a sd-card or usb-stick is calling this.

True.


> The only explanation I have, is that the kernel starts some module, which acts 
> as watched. 

Nope. See, nor kernel itself nor its modules do not have SNMP
implementation. Kernel can send broadcasts if told to. Kernel can
receive an answer to these broadcasts.
But nothing in the kernel can talk or understand SNMP.
It definitely was some userspace program.


> I wonder, why no one else noticed this behaviour, as this looks a "normal" 
> behaviour on all systems.

How many people run portsentry?
How many actually watch for the packets that are outgoing from the host?

Reco

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Strange attacks in my log Hans <hans.ullrich@loop.de> - 2019-02-21 10:40 +0100
  Re: Strange attacks in my log Reco <recoverym4n@enotuniq.net> - 2019-02-21 11:20 +0100
    Re: Strange attacks in my log Hans <hans.ullrich@loop.de> - 2019-02-21 11:50 +0100
      Re: Strange attacks in my log Reco <recoverym4n@enotuniq.net> - 2019-02-21 13:10 +0100
    Re: Strange attacks in my log Hans <hans.ullrich@loop.de> - 2019-02-21 16:30 +0100
      Re: Strange attacks in my log Reco <recoverym4n@enotuniq.net> - 2019-02-21 16:50 +0100
        Re: Strange attacks in my log Hans <hans.ullrich@loop.de> - 2019-02-21 17:40 +0100
          Re: Strange attacks in my log Reco <recoverym4n@enotuniq.net> - 2019-02-21 18:30 +0100
  Re: Strange attacks in my log Dan Purgert <dan@djph.net> - 2019-02-21 11:30 +0100

csiph-web