Mystery 'attack'

[Jim Ford-2]

Hi.

I'm running a Leaf firewall with Bering uClibc installed, and recently
on a whim installed a trial of the Kaspersky ant-virus tool on my client
machine.

A couple of times Kaspersky has reported an attack by 69.121.91.162.
I've done a DNS lookup, but don't recognise the site.

Is this 'attack' real and if so, how could it have got past my Leaf
firewall?

Jim

------------------------------------------------------------------------------
The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
production scanning environment may not be a perfect world - but thanks to
Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
Series Scanner you'll get full speed at 300 dpi even with all image
processing features enabled. http://p.sf.net/sfu/kodak-com
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

[Simon Bolduc]

It very well could be a real attack.  Leaf will prevent unsolicited
attacks from reaching your client computer, but if you have software
on the client machine that is trying to access content that Kasperskey
deems (or is) malevolent, Leaf will do nothing to prevent this access.
 This software could be malware, or simply a browser making a request
to a site that attempts to load malware.

A firewall is only a piece of the puzzle when it comes to protecting
computers on a LAN, relying on it as your only protection when online
is not a good idea (particularly if you're running Windows).

Simon

On Tue, May 12, 2009 at 1:04 PM, Jim Ford
<jaford@...> wrote:

>
> Hi.
>
> I'm running a Leaf firewall with Bering uClibc installed, and recently
> on a whim installed a trial of the Kaspersky ant-virus tool on my client
> machine.
>
> A couple of times Kaspersky has reported an attack by 69.121.91.162.
> I've done a DNS lookup, but don't recognise the site.
>
> Is this 'attack' real and if so, how could it have got past my Leaf
> firewall?
>
> Jim
>
> ------------------------------------------------------------------------------
> The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
> production scanning environment may not be a perfect world - but thanks to
> Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
> Series Scanner you'll get full speed at 300 dpi even with all image
> processing features enabled. http://p.sf.net/sfu/kodak-com
> ------------------------------------------------------------------------
> leaf-user mailing list: leaf-user@...
> https://lists.sourceforge.net/lists/listinfo/leaf-user
> Support Request -- http://leaf-project.org/

------------------------------------------------------------------------------
The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
production scanning environment may not be a perfect world - but thanks to
Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
Series Scanner you'll get full speed at 300 dpi even with all image
processing features enabled. http://p.sf.net/sfu/kodak-com
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/

[Erich Titl]

Jim

Jim Ford schrieb:
..

>
> Is this 'attack' real and if so, how could it have got past my Leaf
> firewall?

Did it really or did you invite it? Did you access that site with or
without your knowledge.
Please analyze the kasperski log to see the direction of this 'attack'.

It might well be a problematic site as the reverse lookup yields
ool-45795ba2.dyn.optonline.net. which looks like a dynamic address.

Registrant:
CSC Holdings, Inc
   1111 Stewart Avenue
   Bethpage, NY 11714-3533
   US

   Domain Name: OPTONLINE.NET

   ------------------------------------------------------------------------
   Promote your business to millions of viewers for only $1 a month
   Learn how you can get an Enhanced Business Listing here for your
domain name.
   Learn more at http://www.NetworkSolutions.com/
   ------------------------------------------------------------------------

   Administrative Contact:
      Rochler, Amy              CVDOMAIN@...
      CSC Holdings, Inc.
      1111 Stewart Avenue
      Bethpage, NY 11714-3533
      US
      516.803.4259 fax: [phone]

   Technical Contact:
      Security, Internet                abuse@...
      CSC Holdings, Inc.
      1111 Stewart Avenue
      Bethpage, NY 11714
      US
      516-803-2400

   Record expires on 06-Oct-2009.
   Record created on 07-Oct-1996.
   Database last updated on 12-May-2009 16:09:04 EDT.


Now if this really was an attack you can always try to complain to
abuse@.... Give them youe log entries. There will be no result but
you can annoy them :-)

cheers

Erich



------------------------------------------------------------------------------
The NEW KODAK i700 Series Scanners deliver under ANY circumstances! Your
production scanning environment may not be a perfect world - but thanks to
Kodak, there's a perfect scanner to get the job done! With the NEW KODAK i700
Series Scanner you'll get full speed at 300 dpi even with all image
processing features enabled. http://p.sf.net/sfu/kodak-com
------------------------------------------------------------------------
leaf-user mailing list: leaf-user@...
https://lists.sourceforge.net/lists/listinfo/leaf-user
Support Request -- http://leaf-project.org/