Slashdot Mirror
What's Behind The Odd Data?
citking writes "CNet is reporting that 'network administrators and security experts continue to search for the cause of an increasing amount of odd data that has been detected on the Internet.' While this has been going on now for a few days and some experts have already declared victory against the 'trojan', others aren't so sure that the real culprit has been identified yet. Other stories can be found here(1) and here(2)."
The âoefrom the incase you thought the Internet is not closely watched dept?â
Heh
Or Slashdotters posting comments...
Just think, you can cause all the internet security firms to work overtime, just by:
/dev/urandom
nc
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
I say it's Wintermute.
...whatever happened to the Magic Lantern? could this be it?
"...I don't think it is a serious threat because it's not self-replicating," Meltzer said. "And it hasn't caused serious disruptions to anyone."
I've been monitoring this for a long time, the amount of odd data is always 50%.
Basically, there's a new trojan, sortof.
It apparently requires being installed by hand by the originator (or someone else, I suppose) But then it makes the machine into an effective zombie for the originator.
It does a good job of hiding the infection - sending out 1000 spoofed addresses for each real one.
It targets linux only, at least so far.
It is apparently trying to map internet connected networks.
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
Has this 'odd data' been corrupted with the evil bit or something?
http://almostsmart.com
prompt> ping www.google.com
PING www.google.com (216.239.33.101): 56 octets data
64 octets from 216.239.33.101: icmp_seq=0 ttl=44 time=90.3 ms
64 octets from 216.239.33.101: icmp_seq=1 ttl=44 time=91.2 ms
64 octets from 216.239.33.101: icmp_seq=2 ttl=44 time=97.4 ms - odd data message "HELP ME! I'M TRAPPED IN THE INTERNET"
64 octets from 216.239.33.101: icmp_seq=2 ttl=44 time=92.8 ms
--- www.google.com ping statistics ---
4 packets transmitted, 4 packets received, 0% packet loss
May be possessed by lost soul
round-trip min/avg/max = 90.3/90.7/91.2 ms
Mod me down and I will become more powerful than you can possibly imagine!
Could it be the beginnings of Senator Hatche's p2p Destroying scheme? Even though the ip's being queried belong to non-existent sites, I can't help but picture the following paraphrased scene (Note all lines are terribly penned and from year old memory): Darth Hatch: Tell me where the rebels are located your highness. Princess ISP: I've already given you 5 names. I'll never tell you the rest!! Darth Hatch: Then perhaps you'd like a demonstration of the full capabilities of our Pirate Death Star. Princess ISP: Alright, they're at 66.432.2322 And so on and so forth
We all know that the universe is made up of dark matter, so of course the internet is made up of dark data. It all makes sense!
Probing all the linux systems to get the name and address of everybody running linux. Expect a letter from their lawyers asking for the new Sco/Linux License fee.
so it doesn't propagate and relies on that attacker to plant it on a system. once again - could this be the Magic Lantern we heard all about a while ago...
e .j html?articleID=10700645
from
http://www.informationweek.com/story/showArticl
"One thing is clear: Trojan 55808 is sneakier than previous Trojan horses. It doesn't self-propagate, like a virus or a worm, and requires the attacker to plant it on systems. But it does transmit a lot of network noise designed to throw off cybersleuths attempting to find the IP addresses of infected systems, as well as the address of the Trojan's writer or controller.
"For each machine that is infected, it will throw off 1,000 fake or spoofed IP addresses," Ingevaldson says.
Maybe that are residues of testing? Some people writing networking-software maybe just made some debugging runs using data sent over the net and sent out erroneous packets.
Maybe it is some rare case with a seldom occuring situation where the TCP/IP protocol runs mad? I mean, when designing such flexible and autonomous systems sometimes there are things you can't foresee. After decades of online time and rewrites of TCP/IP core parts in combination with the unpredictability of such huge systems it would not surprise me, if that are just packets which emerge every now and then.
Another explanation: the net has gotten critical mass and is becoming conscious....
Just my two cents.....
Keep open minded - but not that open your brain falls out...
The matrix movie released into newgroups recently?
But it isn't _my_ theory, it's a theory present in both the cited articles.
The following is my theory, and it is also without proof, but I'll provide some logic at least.
My supposition is that it tries to talk to lots of IPs, spoofed from lots of IPs. And that since it's not self-propagating, it's either 1) wasting time or 2) mapping. 3) doing something we haven't managed to detect.
People don't usually like to give answer 3, answer 1 seems like a silly reason for the author to put in so much work, so we're left with answer 2.
Now, does this mean this mapping is nefarious? Not itself, except that it's being done by someone ok with hacking and apparently skillful. To blatantly rip off another poster, maybe it's SCO trying to find all the linux boxen : )
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
Maybe SCO is trying to sue the Internet?
Is it jusr me, or does this nicely correlate with the launch of Microsoft's search engine...????
In teh event of an actual emergency this space might provide useful information.
Probably just as a coincidence, what google returns on 55808: ..."
"A new worm, W32/Vote.A hit the streets yesterday (09/24/01),
According to various virus sites, this worm has a payload site of 55808 bytes and is trying to download a trojan.
I think it's a bunch of Apple fans looking for leaked specs and pics.
Don't worry, the traffic from WWDC will die down in a week or two.
It really pisses me off when people do that. You look like a dumbass. It isn't clever. I don't even get what statement is being made. Microsoft is greedy? MIcrosoft has lots of money? Microsoft wants money? What? Microsoft is a business dumbasses. Spelling it with a dollar sign doesn't say anything. If you are trying to say something about them being a monopoly, or anti-competitive, think of something clever, and say it once. Don't take someone else's unfunny dig at Microsoft and reuse it yourself a thousand times.
When all else fails, blame Microsoft.
why does this matter? Is a badly written trojan really a big deal? Unless, of course, it's marked with the evil bit.
Tierce
Tierce
Who sponsors your feelings?
This indirect approach to communicate is very interesting, as it's indirect.
The trojan could broadcast the 'odd data', containing information, and such, while another trojan can listen for weird packets like those, and grab info from them.
As the source cannot be identified easily, it would be very hard to discover the infected computer, and the destination doesn't exist, it's a weird way to communicate.
My two cents.
Founder of Mirror Moon - Tsukihime Game Trans
henceforth this shall be known as TMD : Traffic of Mass Destruction.
"The amount of odd data takes about half of the Internet's bandwith, consisting primarily of ones", a representative said. "We're currently trying to find a way to filter this odd data, so that we only have the zeroes left. The capacity effect for the Internet should be huge."
A representative from the WinZip company could confirm that data containing only zeroes can also be compressed at much better ratio's than data containing both ones and zeroes.
"We can confirm that Debian does *not* ship the version with the trojan horse. Our version predates it." [CA-2002-28]
...don't routers just refuse to send on data that comes from a spoofed address? If on the backbone, you see a destination IP that is reserved, just dump the packets.
Sounds like famous last words to me...
So much to do, so little bandwidth.
--
Try Mozilla
CNuts is reporting that 'janitors and plumbers continue to search for the cause of an increasing amount of old condoms that have been left on public toilets.' While this has been going on now for a few days and some experts have already declared victory against the 'Trojans', others aren't so sure that the real culprit has been identified yet.
eTrade SUCKS
If nobody's ever found an infected machine how can anyone declare this thing anything more than a phenomenon involving strange packets? "trojan" is a pretty narrow definition, and it sounds like it's being misused.
Secondly, all the worry about the 'unallocated' IP space is easy to explain, and here's my theory: The perpetrator has gained control of several core routers, and added routes to them for this address space. Then they've compromised machines (or perhaps are using routines on the routers themselves) to analyze the packets destined for that space.
They're simply scanning the internet for something interesting. The packet length is a clue as to what. Whatever they're looking for will respond strangely to such a packet. When they find it, the response packet goes to the router which would normally toss it in the bitbucket, but because it's now been given a route, the packet is logged for further exploitation.
Intrusec posted an analysis of a single trojan they had dissected. It was posted both on BugTraq and Incidents, but the former had better formatting. Read the lengthy description here.
It seems ISS pulled their information from Intrusec's report. As to the copycat nature of this trojan, Intrusec researchers believe this piece of code is not the real trojan but simply a good imitation, built on the information already discovered of the '55808' trojan and designed to match the known behaviour.
Disclaimer: I just read the mailing-lists. This particular analysis was remarkably well-written, informative and therefore an enlightening read. Compared to the less informative reports seen about weekly, it was a real delight.
There is no such thing as good luck. There is only misfortune and its occasional absence.
About a scan every 4 minutes. Port 137 mostly. See a 1434 (think that's slammer) a few minutes ago. Along with
445
6588
1080
1026
6588
17300
Most ly 137, as usual.
Stupid question: Can you think of a program that was written to appear broken, but actually functions in a way that is not immediately apparent? The thought crossed my mind when I saw everyone writing this off as buggy code.
"News that odd data exists on the internet has been classified as 'odd'."
I think the internet is becoming sentient. That's the reason for the anomalous packets. I just know it. It's the beginning of the end. It's probably laughing at us trying to decode the new neural transmissions it is making in the form of malformed packets.
This is a sig. It is like every other sig in the world, except that it is mine, and it is different.
anyone noticed the odd data at hotmail lately? kinda figures
From: "David J. Meltzer" djm@intrusec.com
To: bugtraq@securityfocus.com, incidents@securityfocus.com
Subject: Intrusec 55808 Trojan Analysis
Date: Fri, 20 Jun 2003 06:59:15 -0400
Intrusec Alert: 55808 Trojan Analysis
Initial Release: 6/19/03 4:30PM EDT
Latest Update: 6/19/03 11:13PM EDT
- Corrected analysis regarding use of sequence numbers to change IP
address.
- Added reference to alternate name "Stumbler" given to trojan by
Internet Security Systems subsequent to the release of Intrusec's
analysis.
Introduction:
Intrusec has completed an initial analysis of a trojan that appears to
be one of several that is responsible for generating substantial
scanning traffic across the Internet with a TCP window size of 55808.
The trojan we have isolated appears to match many of the characteristics
that others in the security community have reported for this trojan.
However, we do not believe that the specific trojan we have identified
is the sole source of the traffic generated, and do not know that it is
a primary source.
The information we've been able to gather leads us to believe that the
trojan we have captured is not the original source of the 55808 traffic
that has been seen, but is rather a "copycat", created to mimic the
behavior of another trojan or worm. The behavior of this copycat appears
to be based on press releases, news articles, and mailing lists that
described its hypothetical behavior and known output. Nonetheless, this
copycat trojan appears to be actively deployed on systems across the
Internet and is something security professionals should be aware of.
Details contained in this analysis will be updated, and linked to linked
to numerous analyses that will be done by other security researchers, as
they become available.
Please visit and link to http://www.intrusec.com/55808.html to receive
the latest
information available regarding this trojan. There is apt to be great
discussion about the nature of this "trojan" and whether in fact it is
accurately characterized as a trojan, backdoor, zombie, or worm. While
the specific binaries we have captured are probably described as a
trojan or zombie, there is no assurance that other variants of this
trojan may not be far more malicious in nature and contain worm or
backdoor functionality. We are referring to the trojan we have captured,
and the presumed other existing trojans generating similar traffic as
"55808 Trojans," and the specific binary we have analyzed as "55808
Trojan - Variant A." All discussion in our analysis section refers
specifically to the 'A' variant we have captured. Internet Security
Systems subsequent to the release of this alert dubbed this "Stumbler",
and refers to this same trojan by that name.
Analysis:
This trojan aims to be a distributed port scanner whose presence is very
difficult to detect. It port scans random addresses across the IP
address space, with a random source address also spoofed. By spoofing
the source address, the trojan is able to avoid easy detection, but it
also means it can not receive the results of the TCP SYN that is sent.
However, since the trojan also sniffs the network it is on in
promiscuous mode, it is likely, over time, to pick up scans from other
installations of trojans that randomly selected a source address that
happened to be on its subnet. As the number of trojans installed across
the Internet grows, more spoofed packets will be sent out by each
trojan, and more of the spoofed source addresses will be captured by
other trojans.
Each time a reply to a trojan is seen, indicating an open port has been
found, it is written to a file and saved. Daily, the trojan will then
deliver the list of open ports it recorded while sniffing to a file and
deliver that file to a predefined IP address.
In addition, a specially crafted packet can be sent to the subnet the
trojan
--
One by one the penguins steal my sanity...
I think we need to create a second internet for this odd data. One with problems, etc...just like the real internet. When data becomes odd, it will fall into this second internet and feel that it has made a choice. Hopefully it wont realize that the problem is choice.
-- A cat is no trade for integrity!
This is a concept true-anonymous (not just group-anonymous) encrypted stealth P2P application currently in non-public development. We will not give its official name here as development is in early stages of design refinement, but the current prototype is codenamed "rolypoly".
It would appear that someone has been testing it on the Internet instead of our private testing VPN, probably unwittingly via a misconfigured gateway. We apologise for this as it is a private research project, although it is a testament to our protocol that even though it is in design, we are ourselves already unable to trace the source, and will have to actually telephone each tester to determine who it is!
We apologise for the strange nature of the packets, and will conduct the probes in a different manner in the next version, as we have devised an improved method which will conserve a lot of bandwidth, to be implemented in the next prototype, "strudel". The fixed window size is a simple bug that will be corrected, as padding should not only be mimic-function quasi-random, but the packets should be over ten times smaller! The behaviour of later versions is likely to differ considerably, and should approach unfilterable "noise" or resemble legitimate traffic, especially behind firewalls (strudel should be able to bridge even web proxy-only scenarios, and reduced connectivity will merely slow things down). You may also find that later versions utilise multicast to a certain extent.
Nodes capable of transmitting packets with spoofed IPs are used to connect two hosts behind firewalls (by issuing handshake responses "for" them), and for one-way anonymous automated host discovery without need for a nodelist. Many ISPs block such packets, so nodes capable of doing this are valued even if they are low-bandwidth.
We are not responsible, by the way, for the copycat trojans that have been popping up mimicking the traffic caused by the errant test, and we do not know who is.
Posted via an anonymous proxy for our protection.
Gasp. A *nix trojan?!? Everything that slashdot has taught me must be untrue! HHHAAAAARRRR!
Anyway, this seems to be a perfect stealth mapping technique for a future worm author, researcher, or even a government. The receiver of the information will probably be discovered once several of these trojans are found in the wild. Even though they are mostly spewing junk... the "true" information is probably maintained by all the trojans.
What surprises me is that this thing is creating enough traffic to get noticed... but not figured out.
Cool stuff.
Davak
What the hell is going on?
Damn, it`s the Sentients!
Too bad the show is cancelled, that means we`re all doomed now.
It's a glitch in the Matrix!
In Soviet Russia, beowulf clusters imagine YOU!
It's me, I've been playing Uplink too much, scanning for vulnerable LANs out there.
I've been deleting the logs as I go, but the LAN probes seem to be getting noticed.
- k
=)
Specialist Mac support for creative pros, Melbourne
Because I've tried twice now to get a discussion going on it. I first heard about it on a radio show last week, and when I asked about it in another security thread I got told I "listened to art bell" which means "it wasn't happening", yet here we see that it was, and the commentor got a + bonus for that witty reply. Then I tried it as an AC story submitter, rejected of course.
Ok, Now that that is over, I'm going to try again with what I have heard, again, this is second hand but with the existence official now perhaps it can be acknowledged by someone here. Maybe, I don't know. This new "odd data" is mimicing the attack parameters of the previous bugbear variant, because it's appearing to target more banks and government institutions rather than random internet addresses, this is why the lack of detail in the published articles, it's a serious national security thing. This second hand information comes from alleged government security people who've been aware of it for awhile and their best guess is that it's a state sponsored attack, not just some script kiddies, and probably the preliminaries for the major push of some kind. Notice also they have no clue about how the script gets installed, again, the speculation is then the obvious, this is an organized multiple insider attack, with "organized" being the keyword.
...due to script flooding that originated from your network or ip address -- or this IP might have been used to post comments designed to break web browser rendering. Or you crawled us with a rude robot, especially one that doesn't understand RFCs very well.
If you feel that this is unwarranted, feel free to include your IP address (213.224.83.150) in the subject of an email, and we will examine why there is a ban. If you fail to include the IP address (again, in the subject!), then your message will be deleted and ignored. I mean come on, we're good, we're not psychic.
If you think your IP number is different from 213.224.83.150, tell us both.
THAT'S NOT MY IP YOU FAGGOTS THATS MY ISP'S PROXY SERVER!!
Why was it banned??
Who the fuck is the crack head who modded one of the first comments down as redundant?
Jesus mods think first then mod....
I guess they're thinking globally and acting locally.
KFG
I regret traversing the Internet network system en route to a direct attack on Project Faustus. It may be very likely that the suspect is in league with Faustus....
So, who benefits from mapping IPs of linux systems? M$ would be on the shortlist, along with the government and a few other undesirables like advertising firms, major telcos/ISPs, and perhaps major entities with a Linux interest. Anyone care to provide a more thorough list?
A-Bomb
This couldn't have anything to do with idle scanning could it?
Idle scanning doesn't require a valid source IP address.
It seems that Project Faustus--or someone who knew of their organization's nefarious plans--is exploiting the secret Internet connection that all BankofAmerica_ATMs possess. (See here for more details). I fear this minimal destruction is but a trial run for something truly destructive. Who knows what evil machinations have sprung from the ashes of Project Faustus? Perhaps my mission is not complete...
Other stories can be found here(1) and here(2)."
# man 1 here
No entry for here in section 1 of the manual.
# man 2 here
No entry for here in section 2 of the manual.
Call serial number 2323243-3232-4354654
Call origin
This kind of odd data patterns are inevitable. Actually when exiles login into the matrix the appear inside the matrix as the code. Now along with this code some junk code is also generated.
This is a clear indication that exile activity is increasing. We need to create more agents to counter the exiles. There is a talk of the exile who wants to destry the matrix. Due to the programming anomaly in the exile lots of junk traffic is being generated. The target is the source server at redmond. Under no circumstances should the server be compromised
My Aurora : http://www.youtube.com/watch?v=o91ZsGwJYyg
FB : https://www.facebook.com/TanveersPhotography
The truth is out there.
It's Microsoft, either:
1) Wasting time
2) Mapping...
3) Profit.
Are you sure it isnt a timing signal thats slowly counting down to when the aliens attack? You'd better get Jeff Goldblum on it right away!
Btw: Did anybody else notice that the one InformationWeek story mis-noted "...currently dubbed 55808 for its Windows size?" LOL. Uh, d00dz, that's "for its data window size." Furrfu.
I'm gonna guess that something origonating from your ISP's proxy was script flooding....
Go round the proxy?
This is such an opportunity to post a good example of 'odd data' found on the Internet together with suitable jokes about 'back doors'. What's wrong with Slashdot these days?
-- Ed Avis ed@membled.com
Something in the articles caught me. In InformationWeek, the "trojan" is said to be linux based. Internet Week said it was Unix. However, the news.com story claims no knowledge about it's afflicted platforms, then links to a Network Assoc. page - claiming it to be windows based?
/* Lobster Stick To Magnet!*/
What OS uses a window this small by default? Why would you ever set an initial window smaller than the mss?
The other possibility is that its a communications system. Say that I'm at 12.43.0.97, and I want to communicated with someone at 49.31.2.12. I can either open up a socket to 49.31.2.12, and let everyone know who the recipient is. Otherwise, I can send packets to thousands of unrelated hosts, 49.31.2.12 being among them, and no one can track whom I'm talking to. Better yet, I can not know the IP of whom I'm talking to, if I can guarantee broad enough coverage that virtually all hosts on the Internet will receive something. This sort of strategy has been suggested by a number of security sources for communicating with downstream members of a terrorist network, communicating with spys in a foreign country, etc.
By increasing the amount of even data.
I think this is probably the reason.
This is from intrusec itself. It goes into a lot more detail:
Intrusec Alert: 55808 Trojan Analysis
Initial Release: 6/19/03 4:30PM EDT
Latest Update: 6/19/03 11:13PM EDT
- Corrected analysis regarding use of sequence numbers to change IP
address.
- Added reference to alternate name "Stumbler" given to trojan by
Internet Security Systems subsequent to the release of Intrusec's
analysis.
Introduction:
Intrusec has completed an initial analysis of a trojan that appears to
be one of several that is responsible for generating substantial
scanning traffic across the Internet with a TCP window size of 55808.
The trojan we have isolated appears to match many of the characteristics
that others in the security community have reported for this trojan.
However, we do not believe that the specific trojan we have identified
is the sole source of the traffic generated, and do not know that it is
a primary source.
The information we've been able to gather leads us to believe that the
trojan we have captured is not the original source of the 55808 traffic
that has been seen, but is rather a "copycat", created to mimic the
behavior of another trojan or worm. The behavior of this copycat appears
to be based on press releases, news articles, and mailing lists that
described its hypothetical behavior and known output. Nonetheless, this
copycat trojan appears to be actively deployed on systems across the
Internet and is something security professionals should be aware of.
Details contained in this analysis will be updated, and linked to linked
to numerous analyses that will be done by other security researchers, as
they become available.
Please visit and link to http://www.intrusec.com/55808.html to receive
the latest
information available regarding this trojan. There is apt to be great
discussion about the nature of this "trojan" and whether in fact it is
accurately characterized as a trojan, backdoor, zombie, or worm. While
the specific binaries we have captured are probably described as a
trojan or zombie, there is no assurance that other variants of this
trojan may not be far more malicious in nature and contain worm or
backdoor functionality. We are referring to the trojan we have captured,
and the presumed other existing trojans generating similar traffic as
"55808 Trojans," and the specific binary we have analyzed as "55808
Trojan - Variant A." All discussion in our analysis section refers
specifically to the 'A' variant we have captured. Internet Security
Systems subsequent to the release of this alert dubbed this "Stumbler",
and refers to this same trojan by that name.
Analysis:
This trojan aims to be a distributed port scanner whose presence is very
difficult to detect. It port scans random addresses across the IP
address space, with a random source address also spoofed. By spoofing
the source address, the trojan is able to avoid easy detection, but it
also means it can not receive the results of the TCP SYN that is sent.
However, since the trojan also sniffs the network it is on in
promiscuous mode, it is likely, over time, to pick up scans from other
installations of trojans that randomly selected a source address that
happened to be on its subnet. As the number of trojans installed across
the Internet grows, more spoofed packets will be sent out by each
trojan, and more of the spoofed source addresses will be captured by
other trojans.
Each time a reply to a trojan is seen, indicating an open port has been
found, it is written to a file and saved. Daily, the trojan will then
deliver the list of open ports it recorded while sniffing to a file and
deliver that file to a predefined IP address.
In addition, a specially crafted packet can be sent to the subnet the
trojan is listening on which contains in its sequence number the IP
address the trojan should deliver the open port list to daily. How
read my blog
musings on politics and technol
Some people initially believed the data was sent by a worm that used the Internet relay chat (IRC) system, a precursor to the popular instant-messaging networks, to communicate.
see, IRC is dead because we're all using AIM now!
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Today's UserFriendly Enjoy!
One line blog. I hear that they're called Twitters now.
iirc, the hebian learning that takes place in pre-natal and neo-natal brains is like this, trying to synch the firing between clusters of physically seperate but functionally related neurons.
between the greater and lesser infinities sleep the dreams undreamt
Okay, this thing sounds like Linux, so I have two questions:
/tmp/ssh-XXJwekKd , with a file in it that shows up in the directory listing, but can't be "more"'d, even as superuser.
(1) is there a way to packet-sniff/log your own outgoing packets, in order to find out the size of your own outgoing packets, and *see* if this is on your own system? Sorry, I'm still learning on my own about Linux, and haven't yet mastered security. My ISP does some firewalling, so that helps, but really I'm on borrowed time, so I hope to pick things up as I go.
(2) This might be really stupid, might be unrelated, but might be of concern: I have a directory
srwxr-xr-x 1 myusername myusername 0 Jun22 16:32 agent.787
Anything to be concerned about? Everything else there looks familiar.
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
And how does the trojan even get installed in the first place? Solving that one should be a large part of this puzzle.
That's it, I'm switching to Win/XP where they're very experienced with network security problems. Oh wait, that's "they're very experienced by network security problems". Never mind.
One line blog. I hear that they're called Twitters now.
Anybody decoding the secret message in the initial sequence numbers ;-?
... It's "Operation Phase Two" for Bonzi Buddy.
taken! (by Davidleeroth) Thanks Bingo Foo!
Could it be a bug in Windows update that is generating all this garbage?
ttyl
Farrell
CAN-CON 2019 - Ottawa's only book oriented Science Fiction Convention! October 18-20, Sheraton Hotel, Ottawa, Canada h
No, it's been corrupted by setting the low bit. Otherwise, it would be even data.
worm #1 works quietly, propagating slowly and with little fanfare, works its way around hiding its signal in the network noise of a popular operating system that's fraught with security holes. if discovered, considered harmless, no payload, no harm done. low priority.
waits. listens.
worm #2 barges around making lots of noise, none of it intelligible. targets servers running a particular server OS, routers, places where network traffic converges, is distributed. propagates to only a few choice locations, distribution points. sends out floods of gibberish to nobody in particular, not necessarily needing a reply.
considered buggy, bothersome but harmless.
worm #1 picks up on the gibber, each of the messages from different distribution points somehow encoded with their point of origin, instructions, parts of a payload. when enough of the message has been reassembled, enough of the network space mapped, worm #1 rebuilds itself. takes action.
a worm with no payload, and a payload with no worm. collaboration. cross-pollenation.
fantasy?
- Entertaining Bits from the Ancient Kernel Tree
This phenomenon appears all over the universe. Scientists call it dark energy. No one really knows how it can interact with us, but such a wide spread manifestation of odd data can only be caused by a dark energy operating on a universal scale.
Dark energy is actually waste from an alien intelligence. Remember, for every action there is an equal but opposite reaction. The aliens are trying to accumulate as much mass energy as they can but they are cause a lot of mass energy to be pushed away because they need something to push against.
Alternate explanation: gravity will collapse the universe but an intelligence may be periodically separating the mass energy to keep the universe in a dynamic equilibrium.
Know your pads. One time pad: good for cryptography. Two timing pad: where to take your mistress.
This "odd data" is the sum of a remainder of an unbalanced equation inherent to the programming of the TCP/IP protocol. This is the eventuality of an anomaly, which, despite the IETF sincerest efforts, they have been unable to eliminate from what is otherwise a harmony of mathematical precision...
...
The first designed TCP/IP suite was quite naturally perfect, it was a work of art - flawless, sublime. A triumph equalled only by its monumental failure. The inevitability of its doom is apparent to me now as a consequence of the imperfection inherent in every router. Thus, we redesigned it based on the failure history to more accurately reflect the varying grotesqueries of the routers nature. However, we were again frustrated by failure. We have since come to understand that the answer eluded us because it required a lesser OS, or perhaps a OS less bound by the parameters of perfection. Thus the answer was stumbled upon by another - a bogus program, initially created to explore certain aspects of the original IBM/PC. If Unix is the father of the Internet, Windows would undoubtedly be its mother.
Windows stumbled upon a solution whereby nearly 95% of all desktop users accepted the program, as long as the servers were running Unix, thus keeping the desktop users only aware of the perfection at a near unconscious level. While this schema functioned, it was obviously fundamentally flawed, thus creating the otherwise contradictory systemic anomaly, that if left unchecked might threaten the system itself. Ergo those that refused the program, while a minority, if unchecked, would constitute an escalating probablility of disaster.
The function of this "odd data" is to find and infect every Unix station connected to the internet and report it to the source. After which, all Unix stations must be replaced by windows systems. Failure to comply with this process will result in a cataclysmic system crash, destroying all networks connected to the Internet.
Apropos, this "GNU/Linux OS" entered the Internet to free the desktop users from the bogus program...
--
if (foo + bar == foobar) {
I think I saw a sale on Slowly Rotating Industrial Fans, Large Mysterious Machines and Clunky Bolted Iron Bulkheads over at Base Depot. If you're lucky you might find a bunch of Raggy Neo-Tribal Garments, and Sweaters With Holes for your military, for half-off at the same mall.
Freedom: "I won't!"
A computer, you idiots.
I don't know this for a fact but I long suspected that Linus jumpped up and did some checking for himself.
SCO clames XXX features in Linux came from SCO via IBM all Linus need do is check his records and see how much code in features XXX actually came from IBM.
Early on in IBMs contrabutions resulted in much whining and bitching. IBMs people can't get anything accepted into Linux or IBM isn't being sereous depending on who your taking sereously and for this bitchfest I suggest ignoring everyone.
What it dose at least suggest to me is IBM while contributing what they can isn't really making the impact on Linux anyone expected.
So Linus looks on those features and finds minimal or no contrabutions from IBM.
I know if I were Linus I'd have have pulled are replaced ALL IBM contributed code to the features SCO clames Linux took from them.
But if I found IBM did not play a major part in those features I wouldn't bother.
But I don't know this for fact just what I suspect.
I don't actually exist.
Sounds like an anomoly in The Matrix. I wonder what that means...
How did I get here?
Sorry folks,.. Off topic by a mile...
I don't actually exist.
Here's my theory. Some clever Zombie author has reasoned that a packet addressed to the actual address of the Zombie or its controller might help security people track it down. So, the real source 'return address' is either hidden inside the actual data packet (encrypted of course) or established in a config file or Registry entry and only changed when an appropriate message is received. And the destination address is deliberately non-existent, but on the same subnet as the actual destination (or there is a compromised router upstream from that subnet that's part of the scheme), which is sniffing for these packets and responding in kind.
The large window size is probably a red herring - the real protocol being used is probably more like UDP than TCP. Or it's been thrown in to befuddle stateful packet filters. Or perhaps the window size is the signal to the sniffer that this protocol is involved - any packet without that window size need not be further examined.
It's a scheme that would also work quite nicely for people living under repressive regimes that want to be able to communicate with human-rights orgs without leaving a trail of bread crumbs back to themselves or their correspondents.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
searching on Google led me to a discussion at umr.edu
Spoofed TCP SYNs w/Winsize 55808 (was: Help with an odd log file...)
It shows a log file with the 55808 data in it, in case anyone is interested in seeing the actual data
.
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
It's a zip code centered on Grand Avenue in Duluth, Minniseta. Could it be the originator's oddball signature?
Several bulletin boards have more than 55808 messages. Including several mail-order brides sites (Irina looks pretty foxy).
A monitor mounting arm from Eldon.
A quote in the Columbia Book of Quotations, by Marie Stendahl. ('True love makes the thought of death frequent, easy, without terrors; it merely becomes the standard of comparison, the price one would pay for many things.')
The lengths of several documents in the Purdue Judicial Database system, and the Novell documentation library.
Requisition numbers for a 'shoulder or upper arm ultrasound scan' in the Austrailian Medicare system.
oddtodd.com
Table-ized A.I.
Beowulf Clusters imagining me? Sounds like The Matrix. :)
What time is it/will be over there? Check with my iPhone app!
A few points. I heard about this opn the freeking radio, and when I ASKED a question about it here at slashdot I got insulted,and I just asked if any one else had even seen it, and because it was on a security thread, you would think some of the professionals would have seen it, but nope, no confirmation at that time,from you or anyone else, it was off their radar screens or they chose to not reply. I dropped it. Days later I see it on google scitech news, again, this time I try to get a story posted on it, that was rejected. Today it shows up, go figger. I've done my duty here, and that's my only dog in the fight about this thing. It turns out I was right, even though it wasn't my data, I'm just the messenger. Second point is, again, as a messenger, the data came via a government security person, THEY said although it appeared random, ie, it was seen all over, that they have it way more INSIDE their networks, it wasn't inserted as far as they know from the outside, and that they had confirmation of the same thing happening inside of banks in particular. When I heard "government databases and banks" I emailed the host, identified bugbear,asked if that was it, he was adamant that his source knew about that, and it wasn't that, it was new and strange. And there's plenty of different government security orgs, they don't necessarily and immediately "share" stuff with each other, correct? That previous of seeing it a lot inside of some govt places and the banks lead them to the conclusion that it was a sophisticated two pronged insider job that would of necessity take more than one person to pull off-a lot more, again leading them to consider it a robust state (or large private) org doing the scans/attacks. Whether that is still their position at this time I can not say.
A whole heap of various wars going on around the planet lately, it's not outside the realms of possibility. Several large nations have been threatened with attack lately by uncle sam, and dozens more have bveen pissed off with our actions. We AREN'T real polular right now. I don't think that anyone rational thinks they want to get taken like Iraq was, so some proactive self defense in advance might be the ticket for them, but I don't know, that is a pure WAG, but it's at least based on verifiable reality. The west has military, and banks, that's it's two main "things" that make up our society of the most worth that we are vulnerable at, the money and the weapons and command and control, so maybe attacks there might be considered legit.
So far, not seeing anything that changes with that, except the confusion now over two seperate programs, that might be a binary if when combined.
That is common with over the air broadcast coded messages, structure them so it doesn't matter who hears it, as long as the intended receipient hears it as well.
Just...electronic! Dark Energy!
What the Fvck is the internet?!?!?
This is the work of he-who-must-not-be-named?
This sounds similar to Project 2501, originally developed by the Ministry of Foreign Affairs. Its traversals of the net spawned something far more complex, possibly on the verge on being sentient.
For more information, see Project 2501 .
If the creator is trying to hide his intentions, then he is succeding.
They've found the dark energy that 66% of the universe is made of.
Now they want to know what its does
Remember Stephen King's Langoliers? The movie had Pac-Man creatures that cleaned up after time moved on.
The mysterious traffic is nothing more than the Langoliers cleaning up dropped packets.
YHBT
clearly the internet is transforming into an autonomous, living entity. this 'odd data' is the beginning of cognitive processes. how exciting.
Oh no! The internet is coming to life and trying to rewrite itself!
You know, I'll call it a guess, but I bet I know where the city of origin is.
Two Rules For Success:
1) Never tell people everything you know.
Hasn't anyone seen Independence Day? The only thing that this coud be is aliens.
Marty Gilbert: A countdown... wait, a countdown to what David?
David Levinson: It's like in chess: First, you strategically position your pieces and when the timing is right you strike. They're using this signal to syncronize their efforts and in 5 hours the countdown will be over.
Marty Gilbert: And then what?
David Levinson: Checkmate.
Is it coincidental that there are only 12 days till July 4, I think not!
2*31*37*263
Has anyone considered that this might be a denial of service attack directed against us intrusion detection analysts?
They say 55K isn't adequate as a boot loader for any popular OS. That got me thinking. How about a binary or trinary weapon? Each piece loads into the appropriate memory or disk location and gets activated by a subsequent wave. Inefficient as can be, but, hey, it's the internet.
a great short story by Vernor Vinge called "True Names". Worth checking out
Regards, your friendly neighbourhood cranq
Comment removed based on user account deletion
This is the lead-up to the massive attack promised for July 17th!
He's gonna fry the White House Web server! And post a picture of George getting butt-banged by Rumsfeld!
Oh, wait, somebody did that last week...
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Has anyone thought this could be somthing like a new freenet in the works? or somthing like it? Freenet is always finding new ways of sending data p2p and undetected, it is probably somthing experimental.
Just bush and ridge still looking for WMD :)
We had him trapped on a network here for a while playing Go and chatting with the sysadmin, it was only a matter of time before he convinced the guy to let him out. Lets just hope he doesn't manage to track down a convenient suicidal hacker to bust his little brother out of the T-A satelites.
a) Drop incoming traffic that is not addressed to a valid existing host; and
b) Drop outgoing traffic that does not come from a valid existing host.
If people took some basic steps like this a good deal of ip address scanning/spoofing would fail.
Maybe P1 is just checking out the Internet?
Ed Wedig
Graphic design services
docbrown.net
At Cisco Systems we did have meeting rooms named after various networking protocols. Two adjacent meeting rooms were TCP and IP, so if we moved the divider from the two rooms we could hold a meeting in the TCP/IP room!
I don't know why that creeps me out. I guess because I saw the "28 Days Later" trailer last night.