Development issues regarding the cerowrt test router project
 help / color / mirror / Atom feed
* [Cerowrt-devel] Possibly Serious Compromise
@ 2015-01-04  0:20 William Katsak
  2015-01-04  0:39 ` Dave Taht
  0 siblings, 1 reply; 2+ messages in thread
From: William Katsak @ 2015-01-04  0:20 UTC (permalink / raw)
  To: cerowrt-devel

I"m having a possible very serious issue with Cero. I started noticing 
slow internet access today and checked the router. I noticed a boatload 
of dns resolutions. These push the router load over 1, and eventually 
dnsmasq crashes and has to be restarted.

After tracing it for an hour or so and ruling out misbehaving software 
on the local net, I enabled logging in dnsmasq and saw that the 
resolutions were coming from 127.0.0.1. I kept running netstat -up until 
I saw some of the connections, and saw that they were coming from lua. 
All of the requests seem to be reverse DNS lookups of all kinds of crazy 
IPs.

These requests look like part of some attack/compromise. If I kill 
lighthttpd, everything settles down and runs fine. If I turn it back on, 
the traffic starts again. I am thinking some kind of vulnerability in 
the http server allowing malformed requests from outside? I can't for 
the life of me figure out how they are getting in though. I have very 
few changes to the firewall config, and only a few port forwards.

I'll send more info as I get it.

Anyone else see anything like this?

-Bill


-- 
****************************************
William Katsak <wkatsak@gmail.com>
****************************************

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [Cerowrt-devel] Possibly Serious Compromise
  2015-01-04  0:20 [Cerowrt-devel] Possibly Serious Compromise William Katsak
@ 2015-01-04  0:39 ` Dave Taht
  0 siblings, 0 replies; 2+ messages in thread
From: Dave Taht @ 2015-01-04  0:39 UTC (permalink / raw)
  To: William Katsak; +Cc: cerowrt-devel

Hmm. Port 81 is generally blocked from the outside world, which is
where lua runs. Port 80 is open, but serves up nearly no files by
default, and shouldn't be able to get to lua.

Please install tcpdump-mini. put in a usb stick and mount it. do a
tcpdump -i ge00 -w /whereverthestickis. Put the capture file up
somewhere I can get at it. Or just capture for 60 seconds to /tmp
(assuming little other traffic).You can also cut the size of the
capture down with -s 128, but that wouldn't reveal what was going on
as well.

I was, incidentally, under the impression we'd left reverse dns
lookups off in lighttpd.


On Sat, Jan 3, 2015 at 4:20 PM, William Katsak <wkatsak@gmail.com> wrote:
> I"m having a possible very serious issue with Cero. I started noticing slow
> internet access today and checked the router. I noticed a boatload of dns
> resolutions. These push the router load over 1, and eventually dnsmasq
> crashes and has to be restarted.
>
> After tracing it for an hour or so and ruling out misbehaving software on
> the local net, I enabled logging in dnsmasq and saw that the resolutions
> were coming from 127.0.0.1. I kept running netstat -up until I saw some of
> the connections, and saw that they were coming from lua. All of the requests
> seem to be reverse DNS lookups of all kinds of crazy IPs.
>
> These requests look like part of some attack/compromise. If I kill
> lighthttpd, everything settles down and runs fine. If I turn it back on, the
> traffic starts again. I am thinking some kind of vulnerability in the http
> server allowing malformed requests from outside? I can't for the life of me
> figure out how they are getting in though. I have very few changes to the
> firewall config, and only a few port forwards.
>
> I'll send more info as I get it.
>
> Anyone else see anything like this?
>
> -Bill
>
>
> --
> ****************************************
> William Katsak <wkatsak@gmail.com>
> ****************************************
> _______________________________________________
> Cerowrt-devel mailing list
> Cerowrt-devel@lists.bufferbloat.net
> https://lists.bufferbloat.net/listinfo/cerowrt-devel



-- 
Dave Täht

thttp://www.bufferbloat.net/projects/bloat/wiki/Upcoming_Talks

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2015-01-04  0:39 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-04  0:20 [Cerowrt-devel] Possibly Serious Compromise William Katsak
2015-01-04  0:39 ` Dave Taht

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox