Hy,
During a security check it was the evidence of an intrution.
The hacker placed 2 backdoor and a rootkit.
What is very strange is that all packets seems to pass inside
an Italian ISP Wan but inside its network there are some DoD IP.
Like this traceroute may reveal:
[EMAIL PROTECTED]:dave# traceroute ansa.it
traceroute to ansa.it (194.244.5.201), 30 hops max, 40 byte packets
1 192.168.1.1 (192.168.1.1) 0.293 ms 0.194 ms 0.294 ms
2 192.168.0.254 (192.168.0.254) 1.059 ms 1.328 ms 1.167 ms
Local Gateway.
3 1.48.143.2 (1.48.143.2) 5.397 ms 5.107 ms 5.737 ms
4 10.251.58.17 (10.251.58.17) 4.458 ms 2.709 ms 4.481 ms
5 10.251.54.27 (10.251.54.27) 3.735 ms 2.839 ms 3.238 ms
6 10.251.55.1 (10.251.55.1) 3.245 ms 3.606 ms 2.988 ms
7 10.251.59.194 (10.251.59.194) 2.985 ms 3.959 ms 3.425 ms
8 213-140-17-145.fastres.net (213.140.17.145) 3.294 ms 3.659 ms 3.408 ms
Fastweb Network.
9 10.0.0.178 (10.0.0.178) 5.898 ms 3.671 ms 3.131 ms
10 10.254.0.33 (10.254.0.33) 3.468 ms 3.411 ms 2.934 ms
11 26.26.26.xx (26.26.26.xx) 4.462 ms 3.674 ms 3.644 ms
12 26.26.26.xxx (26.26.26.xxx) 5.055 ms 3.834 ms 3.797 ms
13 26.26.26.xxx (26.26.26.xxx) 5.112 ms 3.541 ms 3.816 ms
DoD Network Information Center <- Why?
14 213-140-31-121.ip.fastwebnet.it (213.140.31.121) 4.132 ms 4.430 ms
3.546 ms
Fastweb Network.
15 Milano-6-ser5-1-0.tip.net (194.20.7.97) 4.899 ms 4.700 ms 4.535 ms
TIPNET
16 194.20.5.166 (194.20.5.166) 20.033 ms 21.354 ms 16.155 ms
17 194.244.2.114 (194.244.2.114) 22.524 ms 17.389 ms 17.625 ms
IT-UNISOURCE.
It seems that where used some 0-d.
I started the incident response, but i don't know how to check where packets
are going.
After few hours my ISP blocked the link and after a day any attempt to Trace.
I tried to test random TTL values without any success, but i would like
to investigate much more.
Tnx, Regards.
Davide Minini.
--
>here are more things in heaven and earth,
horatio, than are dreamt of in your philosophy.
--
Email.it, the professional e-mail, gratis per te: http://www.email.it/f
Sponsor:
Per i progetti che rimandi da tempo, Findomestic ti offre la soluzione ideale
per te, con semplicità e senza anticipi
*
Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=4970&d=1-4
