aMule Forum

Please login or register.

Login with username, password and session length
Advanced search  

News:

We're back! (IN POG FORM)

Author Topic: I got someone sniffing my net through amule udp port.  (Read 5948 times)

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
I got someone sniffing my net through amule udp port.
« on: July 25, 2009, 05:11:02 AM »
Hi!
Today I was looking at dmesg for some reasons and I found this:

Code: [Select]
Jul 24 17:22:28 luca-desktop kernel: [34910.505086] device eth0 entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.510325] device eth0 left promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.525450] device lo entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.528138] device lo left promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.555142] device eth0 entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.558138] device eth0 left promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.564138] device lo entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.567137] device lo left promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.593144] device eth0 entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.596160] device eth0 left promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.602143] device lo entered promiscuous mode
Jul 24 17:22:28 luca-desktop kernel: [34910.605138] device lo left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.639526] device eth0 entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.662358] device eth0 left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.677601] device lo entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.680016] device lo left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.698028] device eth0 entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.701019] device eth0 left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.707024] device lo entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.723436] device lo left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.748030] device eth0 entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.751020] device eth0 left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.757020] device lo entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.760021] device lo left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.785026] device eth0 entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.788020] device eth0 left promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.794020] device lo entered promiscuous mode
Jul 24 17:22:29 luca-desktop kernel: [34910.797017] device lo left promiscuous mode
Jul 24 17:22:32 luca-desktop kernel: [34913.687027] device eth0 entered promiscuous mode
Jul 24 17:22:32 luca-desktop kernel: [34913.691024] device eth0 left promiscuous mode
Jul 24 17:22:32 luca-desktop kernel: [34913.697028] device lo entered promiscuous mode
Jul 24 17:22:32 luca-desktop kernel: [34913.700021] device lo left promiscuous mode
a quick investigation on google tells me that probably someone was sniffing my data.
Actually chkrootkit said:

Quote
Checking `lkm'...                                           You have     1 process hidden for readdir command
You have     1 process hidden for ps command
chkproc: Warning: Possible LKM Trojan installed

So I switched off amule and rebooted the pc.
After reboot chkrootkit was clean, but I found this in dmesg:
Quote
[   37.777080] UDP: bad checksum. From 80.36.171.166:7265 to 192.168.1.30:42220 ulen 48
[   60.280898] UDP: bad checksum. From 84.121.185.222:42212 to 192.168.1.30:42220 ulen 48
[ 1065.304055] UDP: bad checksum. From 77.231.12.197:5588 to 192.168.1.30:42220 ulen 47
[ 1718.102674] UDP: bad checksum. From 99.241.159.166:16464 to 192.168.1.30:42220 ulen 59
luca@luca-desktop:~$

42220 was my UDP port for aMule, now I changed it.
Actually it is quite a long time that I find some lines about "udp bad checksum..." in dmesg, so probably my internet connection was under attack since the same time and finally this "gentleman" has found a weakness in amule to exploit.

Is there something I can do against it?

edit: sorry I forgot to specify. I' m using aMule 2.2.5 , compiled from source,  on ubuntu 9.04 AMD64
« Last Edit: July 25, 2009, 07:46:59 PM by luquino »
Logged

lfroen

  • Guest
Re: I got someone sniffing my net through amule udp port.
« Reply #1 on: July 25, 2009, 01:43:15 PM »
Unless you're running amule as root, I can't see how someone exploited it to install LKM rootkit.
Logged

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
Re: I got someone sniffing my net through amule udp port.
« Reply #2 on: July 25, 2009, 07:45:16 PM »
no, I never use amule as root.

I use a script to activate iptables as firewall that close all the doors unless a program needs to open a specified port. I tested it enough with a couple of  internet sites that offer free port scanning and it seems  to work fine. Actually I' m not an expert in security and rootkit, but reading manuals and guides I understand that this should be enough.

I don't know if someone has installed something on my pc and I wish to know how to discover it, but with amule switched off the attacker couldn't sniff any more so I suppose that he didn't install nothing, he just was doing something trough the port 42220, protocol UDP,  that was opened for amule.
Am I wrong?
Logged

^marcell^

  • Developer
  • Hero Member
  • *****
  • Karma: 28
  • Offline Offline
  • Posts: 524
Re: I got someone sniffing my net through amule udp port.
« Reply #3 on: July 25, 2009, 10:39:30 PM »
Promiscuous mode is used to let you sniff data regardless of the destination host. Why would a hacker enable this? Can you post the result of your "quick google investigation"?

"UDP: bad checksum" indicates corrupt packets. Again: why would a hacker send you corrupt packets? Also there are different source addresses in those messages.

Observe your system and logs a little bit and tell us what happened. I am curious.
Logged

Kry

  • Ex-developer
  • Retired admin
  • Hero Member
  • *****
  • Karma: -665
  • Offline Offline
  • Posts: 5795
Re: I got someone sniffing my net through amule udp port.
« Reply #4 on: July 25, 2009, 11:18:42 PM »
Are you sure your dhcp daemon wasn't crashing?
Logged

Stu Redman

  • Administrator
  • Hero Member
  • *****
  • Karma: 214
  • Offline Offline
  • Posts: 3739
  • Engines screaming
Re: I got someone sniffing my net through amule udp port.
« Reply #5 on: July 26, 2009, 12:16:58 AM »
Quote from: ^marcell^ on July 25, 2009, 10:39:30 PM
Promiscuous mode is used to let you sniff data regardless of the destination host.
Also for virtual machines if they want to have their own MAC/IP.
Logged
The image of mother goddess, lying dormant in the eyes of the dead, the sheaf of the corn is broken, end the harvest, throw the dead on the pyre -- Iron Maiden, Isle of Avalon

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
Re: I got someone sniffing my net through amule udp port.
« Reply #6 on: July 26, 2009, 02:39:58 AM »
well, I changed the ports amule needs to work. Switching off/on the router I changed the IP as well.
I found no more warnings in chkrootkit, and dmesg is clean.
In the last 24 hours I red something about that issue over the web. It appears to be a well known issue of chkrootkit to give false positives of LKM trojan infection.

@StuRedman
Yes I have a Virtual machine running as well.

@Kry
In the logs (messages / kernels / daemons) there are no lines regarding problems with dhcp, furthermore I don't use never dhcp because I don't like it.

@marcell
I just put  "device eth0 entered promiscuous mode" in google and the first three occurrences are these:
http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2003-09/0582.html
http://lists.olug.org/pipermail/olug/2000-April/001010.html
http://www.mombu.com/gnu_linux/mandriva/t-devide-eth0-entered-promiscuous-mode-what-does-this-mean-1488785.html

Putting away chkrootkit and his false positive, all the people in the above discussions say that is not very nice that eth0 enter the promiscuous mode in that way. That has switched me nervous.

Anyway, I want all of you keep very clear that I was not blaming aMule, I use it since 3 years and I am totally happy with it. I just got in panic because is the first time that something like that happens to me and I was asking your opinion.

If you say that I can do something just in case, please tell me.
If you want to log for a while my pc, no problem.
If you say that I can put my mind at rest, I' ll do.

Thank you.
Logged

lfroen

  • Guest
Re: I got someone sniffing my net through amule udp port.
« Reply #7 on: July 26, 2009, 11:00:20 PM »
Most chances you're running virtual machine with network in bridged mode. Which mean, like Stu says, VM need to send/receive packets with MAC different from one on physical network card.
Hence, promiscuous mode.
Logged

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
Re: I got someone sniffing my net through amule udp port.
« Reply #8 on: July 27, 2009, 05:02:09 PM »
ok, thank you for your help.
I appreciate it a lot.    :)
Logged

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
Re: I got someone sniffing my net through amule udp port.
« Reply #9 on: July 28, 2009, 03:41:29 PM »
mmmhhhhh what could be this?

Quote
[56174.664995] possible SYN flooding on port 12820. Sending cookies.
[56277.075430] possible SYN flooding on port 12820. Sending cookies.
[56479.369499] possible SYN flooding on port 12820. Sending cookies.
[56986.284226] possible SYN flooding on port 12820. Sending cookies.

12820 is the  new TCP port for amule.
Logged

^marcell^

  • Developer
  • Hero Member
  • *****
  • Karma: 28
  • Offline Offline
  • Posts: 524
Re: I got someone sniffing my net through amule udp port.
« Reply #10 on: July 29, 2009, 12:39:12 PM »
Sounds very odd.

I would suggest you to install wireshark and sniff on the affected network connection to get details about what's happening.
Logged

luquino

  • Full Member
  • ***
  • Karma: 2
  • Offline Offline
  • Posts: 124
Re: I got someone sniffing my net through amule udp port.
« Reply #11 on: July 29, 2009, 02:23:59 PM »
I am checking the connection with etherape, since a couple of days, but my I'm not experienced in this  things. Can you give me some details about what I have to look for, sniffing my connection?
Logged