OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: (no subject)
From: Greg Hormann (ghormannalumni.indiana.edu)
Date: Mon Jul 31 2000 - 23:45:26 CDT

Today I noticed that my FreeBSD nat server was getting a extremely high
number of packet hits. Turns out that my socks5 server was under some
type of attack from multiple host. Looks like it started at about 2pm and
ran until I shut Socks5 down just after midnight.

Turns out the permit line in my socks5.conf just contained "-", a left
over from my dialup days. Not understanding exactly how the SOCKS
protocol works, I wonder

(1) What damage might this have done? The destination port appears to
always be 6112. Anybody know what is on this port?

(2) Whats the best way to block this? If I block external access to the
Socks5 port in my firewall will socks5 still work? Should I just use a
permit/auth statement?

Thanks for any input.

Greg.

Aug 1 00:13:51 hormann Socks5[89393]: TCP Connection Established: Connect (24.141.20.175:3560 to 216.148.246.9:6112) for user
Aug 1 00:13:52 hormann Socks5[89394]: TCP Connection Request: Connect (24.141.20.175:3561 to 216.148.246.9:6112) for user
Aug 1 00:14:06 hormann Socks5[89397]: TCP Connection Terminated: Normal (24.141.20.175:3580 to 216.148.246.9:6112) for user : 1 bytes out, 0 bytes in

To Unsubscribe: send mail to majordomoFreeBSD.org
with "unsubscribe freebsd-security" in the body of the message