US Government Checking Up On Vista Users?

Paris The Pirate writes "This article at Whitedust displays some very interesting logs from Vista showing connections to the DoD Information Networking Center, United Nations Development program and the Halliburton Company; for no reason other than the machine was running Vista. From the article 'After running Vista for only a few days — with a complete love for the new platform the first sign of trouble erupted. I began noticing latency on my home network connection — so I booted my port sniffing software and networking tools to see what was happening. What I found was foundation shaking. The two images below show graphical depictions of what has and IS trying to connect to my computer even in an idle state'."

Comments

I call bullshit.

[XorNand]

I swear this place is becoming more and more like Digg everyday. I'm no longer renewing my Slashdot subscription while I can get this same quality news for free elsewhere. Where do I start?

1.The screenshots clearly show WinXP, not Vista. In fact, this guy's ultra-leet "port sniffing software and networking tools" is PeerGuardian 2. Straight from the product's home page: Note: PeerGuardian 2 does not support Windows Vista at the moment. This is a top priority, and we hope to have a Vista download soon.

2. Lame screen shots from some Windows app isn't enough to validate a conspiracy theory. Where's the complete traffic dump? And not from some random guy and his "fanboy" friend; how about a creditable network security organization? Hell, I'd even settle for an intern with his CCNA.

3. Hard to tell because all we have are screen shots, but it looks like nothing more than port scans. ::yawn::

(Guess is this is what I get for spending a beautiful Sunday afternoon indoors, on my computer).

Re:I call bullshit.

[igotmybfg]

1.The screenshots clearly show WinXP, not Vista. In fact, this guy's ultra-leet "port sniffing software and networking tools" is PeerGuardian 2. Straight from the product's home page: Note: PeerGuardian 2 does not support Windows Vista at the moment. This is a top priority, and we hope to have a Vista download soon.

The screenshots also clearly show another computer is involved, since he is remoting from his Vista PC to his Windows PC. Perhaps they are both on the same network, and he has reason to believe that these connections are being caused by having Vista on the network.

Re:I call bullshit.

[nbannerman]

Yeah, I don't get those screenshots either - the RDP window is Vista, but the contents are XP... I'm willing to call bullshit on this as well - nothing more than anti-MS FUD without verification.

Re:I call bullshit.

[Anonymous Coward]

Wouldn't he be port sniffing on another box, say his xp box? Just a thought. Granted, it would have been l33t if he used his linux box with ethereal or something instead.

Re:I call bullshit.

[ClubStew]

It's nothing more than FUD.

Besides, if he wrote a paper and his professor was shocked, I'm sure it was only because of his horrible grammar (ex: countries instead of country's). Sheesh. If you're going to spread FUD, at least try to sound intelligent.

Re:I call bullshit.

[avaric3]

The machine running the peer guardian is an XP machine. It is sniffing traffic on the local network and filtering out all the results that don't originate from the vista machine. He is running remote desktop from the Vista machine to the XP machine (the one running Peer Guardian). He probably did this because of the issues that software has with Vista, or possible because he feels that Vista would hide this information from programs running locally.

Re:I call bullshit.

[Anonymous Coward]

I agree, but .. you missed the best part.
PeerGuardian is for blocking *incoming* connections, this has nothing to do with Vista *AT ALL*.
The names that show up against the IP are taken from user submitted rule files(In case you didn't know this is so that IP's from RIAA/MPAA employed companies can be blocked-who log all ip's connected to any torrent as seeds/leeches). There is no validation on the name corresponding to the IP. Complete and utter FUD.
Even the IPs DID correspond to DoD etc.. there is a completely plausible reason for that.
Bit torrent clients cache IP addresses so that they can connect to all the seeds/leeches in case the torrent managing host goes down. All this has proven is that the US Government uses Bit torrent.

Re:I call bullshit.

[SocialEngineer]

Maybe he's got multiple machines hooked up to a hub, with the XP machine sniffing in promiscuous mode. Maybe he's tunneling the connection through the XP machine. Who knows. While I too am inclined to call BS, the XP argument doesn't fly.

Re:I call bullshit.

[ptbarnett]

Hard to tell because all we have are screen shots, but it looks like nothing more than port scans.

Or P2P. But, the important part is that he is showing nothing more than incoming frames, and conveniently obscures the destination port(s).

And to even get to the point where PeerGuardian (or whatever) can see the frame, it has to pass through his firewall -- presuming that he has one. And that means he either is explicitly allowing that port through or he made the connection himself.

I wonder what Task Manager would show running?

Re:I call bullshit.

[aichpvee]

This guy obviously doesn't use Linux if he thinks he needs to "upgrade" to Vista to keep up with the "technology evolution."

Re:I call bullshit.

[Anonymous Coward]

if i had vista installed id try it out myself. im not saying its right one way or the other, but i will say this. you sound like the kind of skeptical asshole that even IF this were proven true, you'd say, 'so what, its not like theyre doing anything bad. theyre the government. crazy conspiracy theorists.'

Re:I call bullshit.

[guardiangod]

For the first time in many years, I agree that /. ain't what it used to be.

Blah how does this make the front page? There are million of reasons for these connections.

Maybe he is using a dynamic ip based isp and he just got a new ip? Maybe the last person who used that ip was using bittorrent? Botnets trying to reconnect to this ip?

Aside from those "Remote Desktop" xp screenshots, I noticed there are Hei Long Jiang education committee, UN Development program, China Edu and Research Network, and whatever.

I guess the DoD and the "Chinese intelligence agency" are both attacking his computer.

UN probably sent some people to infiltrate his computer as well.

Wait, Hei Long Jiang is right next to Russia? Maybe the KGB is using China's network to go after him as well!*roll eyes*

Even if they are not bt, they might just as well be port scans.

News for nerds, indeed.

Re:I call bullshit.

[Anonymous Coward]

1.The screenshots clearly show WinXP, not Vista. In fact, this guy's ultra-leet "port sniffing software and networking tools" is PeerGuardian 2. Straight from the product's home page: Note: PeerGuardian 2 does not support Windows Vista at the moment. This is a top priority, and we hope to have a Vista download soon.

If you're going to assume that your OS is doing something underhanded on the network, you probably want to sniff your packets from some other host, otherwise your underhanded OS might not provide the packets with the evil bit set to the packet sniffer.

Re:I call bullshit.

[larry bagina]

ethereal runs just fine on windows (although gtk is a ugly as cowboyneal's brown hole). A halfway decent firewall (kerio) would also show the same information.

Re:I call bullshit.

[Corson]

peerguardian2 works fine on vista.

Re:I call bullshit.

[JimDaGeek]

1. It shows an RDP from Vista to XP.

2. There is a version that is working on Vista. However it is command line only right now, the GUI is not done.

3. I am sure a lot of people will be monitoring now. This guy just noticed increased traffic from suspicious organizations AFTER he installed Vista. Did you see all of the Vista code? Do you know what info Vista sends and to whom?

It sounds like you are trying to apologize for MS. This sounds just like the crap MS would do. All these connection attempts weren't there in XP. "Upgrade" to Vista and now all kinds of "terrorist" scans are taking place? What the hell is Haliburton doing scans for? This seem more than a coincidence to me.

Re:I call bullshit.

[Dude McDude]

Blah how does this make the front page? It gives the anti-Microsoft crew yet another chance to bitch and moan.

Re:I call bullshit.

[Anonymous Coward]

Bah! You get that with any computer on a open network. Spambots, torrent clients and what not... Halliburton has botnet infected PC's too. Oh my!
No info on his network setup or for that matter what other boxes on the network might be running.

Re:I call bullshit.

[phayes]

Given that the firehose seems to be broken, there's no way to get this unsubstantiated bullshit off slashdot...

Re:I call bullshit.

[fredklein]

Botnets trying to reconnect to this ip?

Even if they are not bt, they might just as well be port scans.


Port scans from GOVERNMENT computers? Oh, okay, nothing to see here...

Re:I call bullshit.

[entgod]

I love how you're clearly indicating that vista ist't windows enough to be windows :)

Re:I call bullshit.

[Tuoqui]

Well considering all the DRM and crap that Vista has in it. He is doing the right thing by NOT trusting a Vista machine to accurately represent the IP traffic passing through it.

I personally would have done it with a Linux machine myself using Ethereal or something reliable. The fact is you cannot trust Vista to report the packets in an unbiased manner. It could theoretically drop these packets before they make it to your OS.

Either way if you set up a ARP spoofing attack on your own network (or have a managed switch) it would be better means of packet sniffing the network so that you dont even have to remote into Vista to get this going.

Re:I call bullshit.

[Igmuth]

And to even get to the point where PeerGuardian (or whatever) can see the frame, it has to pass through his firewall -- presuming that he has one. And that means he either is explicitly allowing that port through or he made the connection himself.

If you look at the screenshots, you can see he's connecting RDP to 192.168.0.1, which is the typical gateway address on most NATs. I think he might actually be running a WinXP box as a firewall. This would explain how he is seeing all of the packets, with the external destination IP. Therefore I wonder if his XP box has just been rooted.

Re:I call bullshit.

[Anonymous Coward]

Dugg!

Re:I call bullshit.

[spyrochaete]

The XP machine is on 192.168.0.1. Maybe he's using it as a router.

Re:I call bullshit.

[gujo-odori]

Yeah, I looked at the wide-ranging place he's getting connections from and asked myself, "Now, what do IPs in all those places - especially China - tend to have in common?" I've been working in email security for four years and was a postmaster before that, so I had a ready answer to that question; zombies.

P2P and fast-flux networks is the current cutting edge of botnets, and that fits with all the inbound connections he's seeing.

The explanation that fits best with his experience is that his Vista box has already been owned and has become part of a botnet.

While his conspiracy theory that Microsoft is in bed with DoD, DOHS, and Haliburton (gimme a break!) is clearly anti-MS FUD, there is good reason to draw a bad conclusion about Vista from this. One of Vista's big selling points was better security, yet here we have somebody stepping up front and center with an apparently freshly installed and freshly owned Vista box.

The article doesn't speak well of Vista, but not for the tinfoil hat theory advanced by its author.

The other leading theory, which has been advanced by a number of others, is that he's running bit torrent or another P2P app. This is also plausible, and if the zombie theory is wrong, then the P2P app theory still holds. Bhy far the least likely explanation is the conspiracy theory advanced by the author.

Re:I call bullshit.

[arth1]

One thing worth noting is that Vista-running boxes don't have telepathic connections to the US DoD, Halliburton and all the others. They won't know that his machine runs Vista and to contact him unless they're told about it -- normally by an outgoing request.
If there's no outgoing requests, but just incoming, this is more likely to be cached P2P entries, where the outside hosts are trying to reach a (now gone) peer, be it bittorrent, edonkey, kademlia or whatever.
It would have been very interesting to see the incoming port numbers that the outside clients are trying to connect to. My bet would be on these being p2p software ports -- quite possibly known because this very same guy was leeching pr0n the night before.

Re:I call bullshit.

[Anonymous Coward]

More likely he was running P2P software on one of the machines on the network and Peerguardian was picking up the network scans.

Re:I call bullshit.

[Maniac-X]

Well PeerGuardian doesn't run on Vista, so that's probably why he RDP'd to it.

Though what I can't figure out is why he didn't use actual port sniffing software like WireShark. I call bullshit on this lame post.

Re:I call bullshit.

[mistahkurtz]

we're all forgetting one thing. most large organizations or corporations have problems with keeping track of 100% of the computers in the organization, let alone making sure that no outside machines have been brought in. we've all heard of some rogue machine, plugged into a network or running with a wireless nic, sitting in a 3rd basement janitorial closet for who knows how long doing who knows what, with an origin of who knows where... the DoD and Halliburton wouldn't be immune to this sort of thing. major organizations all over can't even keep track of the hardware they knew they had...let alone monitor what's happening with the hardware they don't know is there.

however, since none of us have access to the DoD, Halliburton, or this users computers or logs, almost any explanation is as likely as another.

Re:I call bullshit.

[Columcille]

while I can get this same quality news for free elsewhere.

Did you say quality? Slashdot is getting pathetic. Quality need not apply.

Re:I call bullshit.

[Oldsmobile]

Ha, ran in to this on Digg myself and immediately got a red warning light flashing in my head.

I do think it's worth posting about on Slashdot since it'll get a better quality debunking here than on Digg.

Re:I call bullshit.

[mikkelm]

So, what, he has the Vista machine and the XP machine sharing a hub of all things, or does he have a SPAN session up? Why does he feel the need to remote desktop to a local machine that's in all likelihood in the same room as the Vista machine to take a desktop of some rather anonymous looking "port scanner" that's lacking any real verifiable bits of information?

If this guy is doing this internally, why is the remote desktop session showing 192.168.0.1, and the PeerGuardian logs showing a destination of 24.247.148.173? Surely if these two machines are on the same network with internal addresses, there's a NAT box somewhere stripping any evidence of the global outside destination in the original IP header. Even if the XP box is sitting at the end of a SPAN port monitoring traffic, why is he delegating global IP addresses to his equipment behind his router?

If the XP box is in a DMZ, is it really any wonder that it's receiving random traffic from large bot infested networks, and even then, why is the traffic so infrequent, and why are there no regular ISP ranges like you'd normally find in a promiscuous scan of incoming traffic?

This just does not look credible at all.

Re:I call bullshit.

[Ash Vince]

I call you a moron.

I can show you screenshots of a windows XP PC that is made to look like windows NT. Many people I knew when XP came out installed it but chose to make it look like the interface they were used to. I have an XP installation on my PC that looks like Unix.

Also, if I wanted to see what traffic an OS was sending to and from the internet, I would not use an app running under that OS. I would telnet to my router and run a traffic monitor on that PC. In my case that would be an old version of Liunx I have not upgraded in a year or so. If I used the same PC I was trying to monitor then the OS could hide whatever traffic it liked. Rootkits have been able to hide their traffic from all apps running on the same PC for years.

With this in mind please hurry up and leave already.

Re:I call bullshit.

[Vexorian]

. I'm no longer renewing my Slashdot subscription

Oh no!

Re:I call bullshit.

[Thexare Blademoon]

I believe that was the point...

Re:I call bullshit.

[ScottKin]

The last time I checked, Microsoft has more of a liberal / left-wing / Democrat bent than a conservative / right-wing / Republican leaning direction. So, to go off on a very left-field tangent with your "Haliburton" comment would indicate that your own take on this is definitely not from far-left-field, but in another ballpark alltogether. Your link between Microsoft and Haliburton and/or "Conservatism" would be akin to linking Richard M. Stallman (See, Rich...I just didn't use "RMS" this time!) to Apple; yes, analogy is not directly related, but IMHO it explains the incongruency for that linkage.

--ScottKin

Re:I call bullshit.

[Khazunga]

Surely if these two machines are on the same network with internal addresses, there's a NAT box somewhere stripping any evidence of the global outside destination in the original IP header.

Please go read up on NAT. Of course the destination IP is there. Nat is supposed to be transparent for the computers involved.

Re:I call bullshit.

[JimDaGeek]

The last time I checked, Microsoft has more of a liberal / left-wing / Democrat bent than a conservative / right-wing / Republican leaning direction.

Nah, MS is a typical corporate whore that gives bribe money where ever they can to maximize profits. If you look at their SOFT MONEY DONATIONS from 1998, 81% went to the Republicans.

With the current Democrat control, MS will obviously send more bribe money their way.

Re:I call bullshit.

[Ravnen]

For the first time in many years, I agree that /. ain't what it used to be.

I'm afraid I have to agree. The misleading article summaries are bad enough, ranging from being irrelevant to actually implying the opposite of what the articles in question say, but I find it hard to believe the Slashdot editors would really believe the sort of claptrap written in this article. I think the sad reality is that they know it's drivel, but also that it will generate traffic, especially from the nutter contingent, and this, in my view, reflects poorly on their integrity.

Re:I call bullshit.

[blowdart]

yet here we have somebody stepping up front and center with an apparently freshly installed and freshly owned Vista box.

Incoming P2P connections are proof of ownage? Really? How exactly is showing Peer Guardian *snicker* as a "packet sniffer" on his gateway, which apparently is XP (err, uber 3l1t3 points there) showing incoming traffic from a range of IPs to a Vista machine running P2P software ownage? Heck you can't even tell if it's Vista making the connections, or if they are inbound as normal P2P traffic is because his "packet sniffer" doesn't log that information, it simply logs inbound connections.

Funny how the original forum post this "news" came from was deleted.

Re:I call bullshit.

[Anonymous Coward]

Well, you're clearly a bozo. First, you can see the window INSIDE the window is XP - likely a remote connection to another box to run the packet sniffer (you do know how packet sniffers work, right?) The main external window is clearly the default Aero window.

Re:I call bullshit.

[KDR_11k]

there is good reason to draw a bad conclusion about Vista from this. One of Vista's big selling points was better security, yet here we have somebody stepping up front and center with an apparently freshly installed and freshly owned Vista box.

However, we don't know how much user error was involved.There's always the chance that he was running admin and clicked yes when it asked him whether vista_activation_keygen.exe should be allowed to run with full admin rights...

Re:I call bullshit.

[ScottKin]

I don't think I could add anything more to that analysis, XorNand.

It appears to me that the Slashdot Overlords have either lost their collective minds and have forgotten to vet posted articles, or that the inmates truely have taken over the asylum.

Sadly, I believe it's more along the lines of "Cool - another Microsoft-bashing post...let's get it posted ASAP and bypass any vet-ing of the content; no one would ever submit an article here that was both anti-Microsoft and was dishonest and disingenuous...would they?"

How does the kool-aid taste?

--ScottKin

Re:I call bullshit.

[gilgsn]

Digg is a bunch of bored teenagers reading sensationalized news posted by greedy bloggers. Try http://over30news.com/ for more mature news. I just started it...

Re:I call bullshit.

[mikkelm]

Well, I could explain to you how you are misunderstanding either my post or NAT, but since you started out so rudely, I'll just leave this hanging for people to chuckle at.

Re:I call bullshit.

[Squirmy McPhee]

The screenshots clearly show WinXP, not Vista.

You can identify his OS from a screenshot? If you saw a screenshot of my system you'd swear I run Win2k. I don't.

Re:I call bullshit.

[twistedcubic]

Are you kidding? I bet if subscriptions declined significantly, the situation would improve. Nevertheless, it's not the stories that make Slahdot great, but the posts from experts in so many diverse areas that make it awesome to read, everyday, over and over again.

Re:I call bullshit.

[VGPowerlord]

Please go read up on NAT. Of course the destination IP is there. Nat is supposed to be transparent for the computers involved.

You weren't talking to me, but I have read up on NAT.

Since the other reply didn't say it, I will: If the XP machine was behind a NAT, the destination address would have been rewritten by the NAT. In other words, the IP would have been in one of the RFC1918 address ranges:
10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

However, the destination address starts with 24.

Therefore, the only possibility is that the XP machine was acting as the NAT.

This test would only be useful in two circumstances:
1. The test showed the outgoing traffic from the Vista box (it doesn't).
2. The packets were being monitored behind the NAT and the Vista machine was the destination.

Also, since the destination port numbers are conveniently cut off on the right side of the screenshot, you should be suspicious. Why is such a crucial piece of information missing?

Re:I call bullshit.

[mombodog]

1. They have a beta version of PG2 for Vista, running it right now. Maybe he is using ICS through a XP box. 2. I agree using PG2 to support a theory is silly, I get the same results, but I have to visit a Government website first, like whitehouse.gov, then I get all these requests blocked by PG, even after IE is closed, and continues for some time. 3. Agree

Re:I call bullshit.

[Kennon]

I have an XP installation on my PC that looks like Unix.

LOL you are like one of those retarded 16 year old street racer wannabes who puts a gigantic spoiler and exhaust pipes and a hood scoop on their beater 1998 toyota corolla.

Re:I call bullshit.

[Miseph]

"even after Ron Paul is elected president"

A little presumptuous, aren't we? It's not that I don't like Ron Paul, he seems to have some good ideas (and he also has some not so good ideas... like completely eliminating most publicly funded programs beyond a skeleton military and a few law enforcement and regulatory agencies which would be re-purposed to enforcing only the core laws), and he certainly has a reputation for protecting civil liberties second to none... but he's a long shot, emphasis on "long". Assuming he can even win the Republican primary, which (realistically speaking) probably won't happen, he'd then ALSO have to beat whatever Democratic ticket comes up, and that one's shaping up to be a powerhouse no matter who gets it (I guarantee that either Hillary or Obama is going top be the nominee for VP, and I wouldn't be surprised if the other is up for president). Point is, calling the election for him now is just a tad premature.

Re:I call bullshit.

[fishbowl]

>LOL you are like one of those retarded 16 year old street racer wannabes who puts a gigantic spoiler and exhaust >pipes and a hood scoop on their beater 1998 toyota corolla.`

I really, really like LiteStep and CygWin.

The car analogy for this would be more like a 40 year old who gets an FJ Cruiser, paints it a solid color, installs hardcore suspension upgrades, offroad tires, winches and lights, etc., and then uses it for forest fire fighting in the Rocky Mountains.

Re:I call bullshit.

[Blain]

I don't know. I liked the year they did LOL-Ponys!

But, wait. This isn't April.

Re:I call bullshit.

[tiffany98121]

except that, as was already pointed out before, those screenshots don't even show vista.

Re:I call bullshit.

[Skreems]

You'd be amazed by the number of government employees who run BitTorrent on work machines...

Re:I call bullshit.

[tomhudson]

... tipped my DS meter this point ... ""complete with a user rights management system that a seasoned Linux user could appreciate"

I guess I need more seasoning ... perhaps with MS' "secret sauce" ...

Re:I call bullshit.

[Anonymous Coward]

I see tags "fake" and "bs" ... does anybody actually read here?

Re:I call bullshit.

[Wolfger]

4. Somebody named "the Pirate" wonders why the government is scanning them....

Re:I call bullshit.

[RobertM1968]

Or maybe it's a way of getting free advertising from /.?

...I'm getting to that.

See how your network really works! Eve 3D Network Surveillance by Whitedust Labs

After installing all of my usual apps on Vista I was impressed to see most everything was 100% backward compatible. I expected much of my...

Just a thought...

And interesting that he used Peer Guardian instead of this EVE 3D Network Surveillance Tool he is advertising on the site.

Re:I call bullshit.

[node159]

You know some people have 192.168.0.254 as their gateway, theres no regulation saying it has to be the first ip, hell a university I worked for had an entier class B range set up that way (except for one f*cking department).

Re:I call bullshit.

[sgt_doom]

Botnet, for sure. Yeah, you're unequivocally correct. And I state that for the record as a card-carrying member of the Global Tinfoil Hat League (GTHL - restricted membership to carbon-based lifeforms only).

Re:I call bullshit.

[node159]

Then again yeah, its some wanabe scripy kiddy flipping out cause he saw DoD in his logs, get a grip kid, the world is out to get you, just not in the way you think :P

Re:I call bullshit.

[RobertM1968]

The screen shots clearly dont show anything. (Vista/XP/Whatever)

Presumably, (as I have done, but NOT using XP as the router/NAT device), the XP box would be his gateway, and he is connecting to it using Remote DeskCrap via the Vista machine.

That's assuming the screenshots actually are showing an XP and Vista machine - or a Vista and XP machine - or two XP machines - or two Vista machines.

There are a (growing) number of add-ons for XP to make it look virtually identical to Vista... and Vista can also OOB be made to look like XP. The XP machine we have here looks like Vista...

The lack of pertinent data is the biggest point making this seem like BS...

The fact that his site - or the site he is hosting on, is displaying an ad, in such a great place, for software to scan for such things, makes me think this whole thing is more of an ad to lure the unenlightened public and conspiracy theorists into buying their software...

Snippet of the site, including the ad (which shows up on the site in a box, in the middle of the article, with a link to buy the software - that oddly he didnt use for his very own little tests...

...I'm getting to that.

See how your network really works! Eve 3D Network Surveillance by Whitedust Labs

After installing all of my usual apps on Vista I was impressed to see most everything was 100% backward compatible. I expected much of my...

Re:I call bullshit.

[Majik Sheff]

Agreed, but my bullshit alarm went off as soon as I read the word Haliburton. The current litmus test for conspiracy freaks seems to be how quickly they use the word Haliburton in their arguments. I'm surprised he didn't work out a way to work in Roswell, the Illuminati, the Black Chamber, the Masons, the Vatican and the Jewish High Council. Watch this author of this article's space for further updates...

Re:I call bullshit.

[gujo-odori]

Actually, yes, a lot of inbound connections like the ones he showed are a smoking gun for ownage. There are only two explanations that cover it on a network like his:

1) You are running P2P stuff knowingly and are too lacking in knowledge to figure out that that's what your packet sniffer is showing you; I did note in my post that this may be regular P2P stuff

2) You have an owned box. Anybody involved even slightly with botnet research can tell you this. As I already stated, P2P is the state of the art in botnets. If a person is not running BT or any other P2P apps, and yet we see a lot of connections on his network that can only be reasonably explained by P2P activity, then they can also be reasonably explained only by one or more owned hosts on the network.

As to why the original post is gone, it could be b/c it was BS and they pulled it, it could be because it was /.ed and they pulled it, it could be that he took so much shit for it that he decided, he'd be better off retreating from the field. Whatever the cause, that does not undermine the basic concept that if his claims were true and not just something he made up, then the two most reasonable explanations for what he saw both involve P2P; the only question between them is whether it was voluntary P2P or involuntary P2P (ownage).

Re:I call bullshit.

[spyowl]

I think he might actually be running a WinXP box as a firewall.

And that is the place to stop reading this discussion thread.

Re:I call bullshit.

[Khazunga]

Do it. Fire up wireshark, and observe a request to slashdot. Your packets leave your system with slashdot server IPs on the destination IP header field. The mac frames will be addressed to your gateway, which is also probably your NAT box. The gateway will grab the ethernet frame, observe the IP packet inside, and change the *source* address before forwarding the packet. When a returning packet from slashdot is received, the NAT box will rewrite the destination packet and return it to you.

My point: if you observe all packets originating from any given computer on your NATed private network, you will observe the real-world destinations of those packets. When your computer tries to connect to the outside world, it doesn't need to know it is NATed.

Re:I call bullshit.

[H310iSe]

RIP Kerio (2006) but I still use their final release wherever I need a software firewall. By far the best one I've ever seen.

Re:I call bullshit.

[pvera]

Or for all we know, the reason the scans come from these places is because THEIR machines are infected with something.

Re:I call bullshit.

[Anonymous Coward]

And Slashdot is a bunch of frustrated teenagers plus a handful of crazy old communists reading sensationalized news posted by a staff who just want to generate page hits, and don't care how much the site's content descends into utter garbage. I.e. greed as well.

Re:I call bullshit.

[Disfnord]

If you had read the article more carefully, you would see that it is quoting a post from a web forum. A freaking web forum!!! Talk about a trusted news source...

Re:I call bullshit.

[Anonymous Coward]

good job, as the prior posters seemed to miss this in their blind love for the monopoly micro$$$. One other point is that the article's grafix clearly show that most of the invaders are not uncle gorgious george but rather the Chinese People's Secret Police's front organizations. Now these are the folks that blow you away in order to mine the collagen out of your skin to sell to skin cream companies for money. These are worse than the nazis. At least they made lampshades and wallets of their victims and not skin cream. Creeeeeps me out! And to think they tried to kill my doggie too! Grrrrr! Bite 'em Fido

Re:I call bullshit.

[jhol13]

I seriously doubt ARP spoofing is reliable enough (to capture everything).

Re:I call bullshit.

[kestasjk]

"Corporate whore"? They're a public company, they have to maximize profits while remaining within the law. Make a law saying campaign contributions must be anonymous (anything else is just legalized bribery), don't blame MS for doing their best to make money while being within the law.

Re:I call bullshit.

[VGPowerlord]

OK, apparently you missed that these are incoming packets we're talking about, not outgoing.

Re:I call bullshit.

[DustyDervish]

How come everyone says "fanboy" these days? Is there some payola thing going on? Come on sheeple, use your brains and think up a new word. We really need a new #1 for the top ten list of words people like to say. People used to insult others by calling them a "liberal", now they just call everyone a "fanboy".

Re:I call bullshit.

[uvajed_ekil]

He said the traffic in question related to his home network, not necessarily the machine that was running Peer Guardian 2 for the screenies, right? I don't know how much difference this makes, just playing devil's advocate and trying not to dismiss every concern as BS. It's easy to ignore everyone's alarming claims as over zealous, misunderstood data, but maybe we should take this type of thing more seriously until we have all the facts.

Re:I call bullshit.

[Ash Vince]

Nah, You cant drive at 16 in my country. We have to wait until 17.

Re:I call bullshit.

[Max Littlemore]

I think he might actually be running a WinXP box as a firewall.

And that is the place to stop reading this discussion thread.

Hey, from the evidence he's gathered he's reached the conclusion that Vista is spying on him. He may well be running XP as a firewall.....

Re:I call bullshit.

[Fulcrum of Evil]

Yeah, but most people don't change the default. I do it differently out of habit, but oh well. The average person runs whatever it was running when it started working.

Re:I call bullshit.

[roscocoltran]

The subject was outgoing packets, not incoming.

Re:I call bullshit.

[Khazunga]

The same logic applies, only you need to observe the source address. The NAT box address never comes up in the IP packet header fields. Only the NATed workstation and the internet server come up. Regardless of NAT, you can always observe the traffic to/from a given machine and identify who is it talking to.

I was guiding myself by the parent post to the one I replied to. Indeed, the article shows packets sniffed from the NAT box. The NAT box, for our interests in this case, behaves as if connected to the net without NAT, turning this issue even more irrelevant.

Not to say that the article isn't ill-conceived and unproven. It's just that it's not because of NAT.

Re:I call bullshit.

[smilindog2000]

I found the responses to this article very informative. The article itself was just some college kid, probably not the world's greatest network analyst. However, the responses include some very insightful comments. I think it's wise of /. to pick articles that invoke interesting dialog, and if you take that measure into account, this article isn't half bad. In particular, if I similar connections to my home network in the future, my first thought will be "zombie or P&P", rather than "world governments are spying on me".

Actually, my first reaction to this article was "What! The US doesn't need to make connections to spy on me!" With AT&T's big fat pipe to the NSA, the government get's all the data it wants about me, even though I run Ubuntu.

Re:I call bullshit.

[VGPowerlord]

The subject was outgoing packets, not incoming.

First of all, we're talking about NAT in the context of this screenshot.

If this guy is doing this internally, why is the remote desktop session showing 192.168.0.1, and the PeerGuardian logs showing a destination of 24.247.148.173? Surely if these two machines are on the same network with internal addresses, there's a NAT box somewhere stripping any evidence of the global outside destination in the original IP header. Even if the XP box is sitting at the end of a SPAN port monitoring traffic, why is he delegating global IP addresses to his equipment behind his router?

If the XP box is in a DMZ, is it really any wonder that it's receiving random traffic from large bot infested networks, and even then, why is the traffic so infrequent, and why are there no regular ISP ranges like you'd normally find in a promiscuous scan of incoming traffic?

(Emphasis mine)

Second, even if you couldn't determine that he was talking about incoming traffic from the first paragraph quoted above, it's mentioned explicitly in the second paragraph.

Re:I call bullshit.

[mikkelm]

The possibility described in my post explicitly described a scenario of both the Vista box *and* the XP box being behind a NAT box. In that scenario, packets sniffed on the network would *never* contain the global outside destination address of incoming packets. It would be replaced with the local inside destination, being the workstation IP address.

In the context of the screenshot linked by VGPowerlord:

Remote host -> Src=203.162.247.11 Dest=24.247148.173 -> NAT -> Src=203.162.247.11 Dest=192.168.0.x -> Local host.

Any traffic sniffed from behind the NAT box would show the inside local address in the IP header, not the outside global address of the WAN interface.

Either you don't understand NAT, or you were a little too quick on the trigger, and misunderstood my post. In either case, the third option of the XP box being in a DMZ (or indeed actually being the NAT box itself for some ungodly reason) applies, obviously excluding the second scenario. This does, however, not make the second scenario technically impossible, and there is nothing wrong with the NAT speculation in it.

Re:I call bullshit.

[Tony Hoyle]

One thing worth noting is that Vista-running boxes don't have telepathic connections to the US DoD, Halliburton and all the others. They won't know that his machine runs Vista and to contact him unless they're told about it -- normally by an outgoing request.

Vista registers online automatically when you install it.. the IP of every vista machine could easily be collected. Wouldn't be very accurate with all the NAT and Dynamic addresses out there, but getting the list isn't hard.

Re:I call bullshit.

[beckerist]

From the article: Again, even when idle and running only a bare minimum of system processes.

With that said, has anyone ever installed Server 2003 on a box, only to realize you booted it for the first time with the ethernet plugged in (and the firewall defaults to "off?") and within 45 seconds it's crippled by one of about 7 different viruses? Yeah, well, it's happened to me more times than I can count on one hand, I KNOW I'm constantly scanned from multiple sources, P2P software or not.

Re:I call bullshit.

[Anonymous Coward]

That they have to do it is no reason not to call it what it is.

Re:I call bullshit.

[Khazunga]

The possibility described in my post explicitly described a scenario of both the Vista box *and* the XP box being behind a NAT box. In that scenario, packets sniffed on the network would *never* contain the global outside destination address of incoming packets. It would be replaced with the local inside destination, being the workstation IP address.

Wrong for the second time. Please go read up on NAT, and stop producing wrong information.

Re:I call bullshit.

[kabocox]

Bit torrent clients cache IP addresses so that they can connect to all the seeds/leeches in case the torrent managing host goes down. All this has proven is that the US Government uses Bit torrent.

No, it proves some folks in the government use bit torrent. Odds are for the same things everyone else uses it for.

Re:I call bullshit.

[drinkypoo]

When your computer tries to connect to the outside world, it doesn't need to know it is NATed.

More importantly (and accurately), if the NAT is done correctly, your machine has no way to know that it is NATed except for the obvious sign that they are on a non-routed network and communicating with routed hosts. The only thing that makes non-routed addresses non-routed is convention, and sometimes someone bones that and routes them places they shouldn't (with predictable, unfortunate results.) Everything else on the client is just TCP/IP acting like it normally does.

Re:I call bullshit.

[mikkelm]

Why don't you go do that Wireshark dump that you suggested?

Browsing slashdot, you'll see incoming packets with a source of slashdot's outside global IP address, and a destination of your inside local IP address.

I suggest you either take your own advice.

Re:I call bullshit.

[mikkelm]

, or produce some information of your own.*

Re:I call bullshit.

[drinkypoo]

Look, the client doesn't even know NAT is involved, so how would that be true? The client sends a packet with the source address set to its IP and the destination set to the REAL IP of the destination. The NAT box (in my case that I'm using right now, Linux with iptables) rewrites the packet so that it looks like it came from the NAT system, and then it handles making sure that the replies go back to the proper host. I am doing DNS through NAT right now, using Ubuntu behind Ubuntu. I am not using dnsmasq or any other DNS proxy. I am not using a web proxy, either (at least, I'm trying not to. I have privoxy installed but it's there as part of tor, which I am not using at the moment.) But the client system does not have any idea that it's doing NAT. It has a reserved IP address, but that means nothing to it. It's irrelevant to the operation of TCP/IP.

Re:I call bullshit.

[Khazunga]

There you go. Observe that this is a conversation between my PC (10.0.1.76) and slashdot (66.35.150.250). My NAT box (10.0.1.254) is nowhere to be seen in the packet dump. For the objective of determining with whom is my computer trying to speak to, NAT introduces zero noise.

Re:I call bullshit.

[mikkelm]

You aren't really getting what it is that we're talking about here.

Of course NAT is supposed to be transparent from layers 3 and up. That's the point of NAT. That's why when your data reaches your NAT box, it is stripped of its inside local address, and given an outside global source address instead, so that the destination knows where to reply.

When the reply arrives at the NAT box, the NAT box replaces the outside global destination address (the address of the NAT box, your own global IP address) with the inside local address of the workstation (the internal IP address assigned to the local workstation receiving the reply).

This is why doing a scan behind a NAT box, any incoming traffic will have the IP destination header set to the inside local address (again, the internal IP address belonging to the workstation for which the packet is intended), replacing the outside global address (again, your global IP address.)

This means that any incoming traffic captured BEHIND your NAT box, INSIDE your network will NOT show your EXTERNAL IP address as the destination, but rather the INTERNAL IP address of the destination machine. That's what makes it transparent. The destination IP address of incoming traffic inside of your network will be the same as the source IP address of the outgoing traffic that prompted the reply.

Re:I call bullshit.

[mikkelm]

Thereby proving my point that if a machine behind your NAT box, INSIDE your network is sniffing out traffic, it will never see an incoming IP packet with a destination of your external IP address, which is what is shown in the screenshot that is at the centre of this discussion.

Re:I call bullshit.

[roscocoltran]

As he said, who cares about the incoming packets ? We're talking about the packets leaving the machine, not incoming, that's the point of the article. Maybe you want to discuss about incoming packets, it can be interesting too, but it's not the subject.

Re:I call bullshit.

[Khazunga]

My point is that NAT is irrelevant in this discussion. If you're trying to determine whether your PC is sending packets to DoD, Microsoft or whatever, you can disregard NAT.

The 'anomaly' you point out is caused by the fact that the Vista box in the article is the NAT box. It is connected directly to the internet, and outside incoming packets sport the network's external address in the headers.

Re:I call bullshit.

[mikkelm]

NAT is absolutely -not- irrelevant to this discussion, as it is obviously present. It is very doubtful that the Vista box is the NAT box. The Vista box is using an internal address to connect to an XP box showing external traffic, making the XP box the only likely NAT box of the two, if either of the two are.

NAT as a technology is irrelevant to where the traffic goes externally, but this discussion is not about where the traffic goes, it's about the validity of the screenshot as a source of any real information, as commented on by the GP.

In this case, as I told you before, the question of whether or not seeing random incoming traffic from known zombie infected networks on a border device is uncommon and unexpected at all applies, making the NAT stipulation irrelevant, as it assumed that the author of the article wasn't completely technologically inept. The stipulation is, however, still technologically sound, so if you have any further complaints about it, I suggest that you go back to school, or at least study the topic again.

In conclusion, my NAT stipulation was technically correct, and you either misunderstood me, or don't understand NAT.

Re:I call bullshit.

[Khazunga]

NAT as a technology is irrelevant to where the traffic goes externally, but this discussion is not about where the traffic goes, it's about the validity of the screenshot as a source of any real information, as commented on by the GP.

NAT is irrelevant for the discussion of where the traffic goes. I'm glad we agree on that. It is now a linear deduction that discussing NAT in the context of the packet dump shown in the screenshot is also irrelevant. It is obvious you can deduce where the traffic goes by observing traffic originating or terminating in the target workstation. Regardless of NAT, naturally.

The external interface IP showing up or not is irrelevant. We're not interested in it. Will it show up? Yes if you have no NAT; yes if you are under NAT and observe traffic on the NAT box; No if you are under NAT and observe traffic on the workstation. Do we gain any information of where the traffic is going to by observing the "destination of global incoming packets" presence in dumped packets? Nope. Zero information there for us. Why are we discussing it? Beats me.

Re:I call bullshit.

[mikkelm]

It beats you because you obviously commented on my original post not comprehending at all what it is that I was talking about, and despite vigorously trying to clue you in, you're still failing to understand it.

Every single one of my scenarioes involving NAT have been technically valid. You just haven't understood what it is that I was saying. That you come out as arrogantly as you do and tell me to "read up on NAT" when in fact you don't understand what it is we're talking about is quite humourous.

In any case, all of my scenarioes have been explicitly described as both boxes being behind a NAT box, as it was a possibility. While you seem to somehow have magically determined that the Vista box is a NAT box, despite the XP box being the one seeing external traffic, it does not at all make any of my given scenarioes technically invalid.

Given full explanation of the scenario I was describing, not once, but twice, and still having you arrogantly telling me to "read up on NAT" when there was absolutely nothing wrong with what I was explaining leads me to conclude that you either are incapable of reading what it is that I'm posting, and debate from some fictional point existing only in your mind, or that you really do not understand NAT. In either case, anyone who knows about NAT, and is able to read, will be able to see this, and I really do not see why I should be wasting my time lecturing you on anything, so I'm just going to leave you wallowing in your own little world.

Re:I call bullshit.

[Khazunga]

I really do not see why I should be wasting my time lecturing you

Your past posting history on /. reveals an alternative view. You are quite the adept lecturer.

Re:I call bullshit.

[weizur]

Looks like /. fell for this guys linkbait, watch as googles funds flow into his pocket

Re:I call bullshit.

[VGPowerlord]

As he said, who cares about the incoming packets ? We're talking about the packets leaving the machine, not incoming, that's the point of the article. Maybe you want to discuss about incoming packets, it can be interesting too, but it's not the subject.

The "very interesting logs from Vista showing connections to the DoD Information Networking Center, United Nations Development program and the Halliburton Company" are incoming logs, ergo it's talking about incoming packets.

PeerGurdian is not a legitimate investigative tool

[Anonymous Coward]

The DOD NIC runs one of the DNS root servers. Yes, that's right... his DNS requests are sometimes going to the Department of Defense! Burn the government down.

Bullshit

[alflauren]

This looks like a typical log from a torrent-sharing user. It's not even a Vista screen cap.

Re:Bullshit

[Tablizer]

It's not even a Vista screen

That's because the FBI installed XP in the middle of the night.

Re:Bullshit

[arashi no garou]

I would normally just tell you to see the above thread where as many as six people tell the first dumbass that it's a remote desktop connection (Vista being the OS on the machine the screenshot came from) showing PG2 running on XP, but at this point I seriously doubt your reading comprehension. The point of the article is that the guy started noticing odd connections after he introduced Vista to his network. That doesn't mean he's right or wrong (I wouldn't bet the farm without trying it myself first), but only that he's observant.

Um...

[Perseid]

PeerGuardian does NOT qualify as port-sniffing software. I was expecting to see Ethereal logs or something. I ran PG for about 10 minutes, decided it was insane and uninstalled it.

Highly Suspicious to me...

[tgatliff]

Either M$ is the dumbest company on earth, or this is a scam article. I would assume that if M$ was in fact monitoring users, which I think is quite possible, then all of the information would go back to Redmond and then distributed to the appropriate groups. At least this way they have plausible deniability....

Also, "Halliburton"? Give me a break.... First, what type of tool is going to return a text output so blunt... Not is not "HA-39214", but instead is just "Haliburton" the evil company.... Also, I am certainly not a fan of the company and its former involvement with the vice president which just smells bad to begin with, but what in the world would a military contracting company that fufills soft drinks, food, oil, and other supplies to military groups want to monitor computers... This is just unrealistic...

Re:Highly Suspicious to me...

[Anonymous Coward]

whois 34.60.236.180
[Querying whois.arin.net]
[whois.arin.net]

OrgName: Halliburton Company
OrgID: HALLIB-1
Address: 10200 Bellaire Blvd
City: Houston
StateProv: TX
PostalCode: 77072-5299
Country: US

NetRange: 34.0.0.0 - 34.255.255.255
CIDR: 34.0.0.0/8
NetName: HALLIBURTON
NetHandle: NET-34-0-0-0-1

and so on. So, yes, it's in Halliburton's IP range. That still does not mean anything, though. PG as a traffic analysis tool is a joke, as others pointed out already. At least he could have displayed the destination port and check what service is supposed to listen to it, if any. This way it might very well be just a bunch of zombies portscanning away[*] - there are a bunch of University addresses (Purdue, Athens, Rio) and a couple of Chinese IPs. Wow, MS must have really sold out to the barbarian invaders, right?

[*] I'm giving the guy the benefit of the doubt about these not being attempts to connect to his previously-running p2p application, although with the carefully-trimmed destination ports from his screen-captures maybe I shouldn't. After all, he was clever enough to tune this blog entry to the net-herd paranoia and get hits from at least /.

Re:Highly Suspicious to me...

[Anonymous Coward]

LIAR LIAR LIAR! Micro$oft and Dick Cheney are paying you to say this! Say it is not so! We are right, we MUST be right, we are teenagers with l33t sk1llz the world belongs to US we ARE ALWAYS RIGHT blah blah 9/11 blah blah Kyoto Protocols blah blah fake Moon landings and WHAT WILL THE EUROPEANS THINK OF US! STFU or we will hurt ourselves!

Simple solution

[Enderandrew]

This looks suspect, as it has been noted before. And it may very well be FUD. However, given that the instructions appear to be laid out, why doesn't someone see if they can replicate this to verify or debunk this with some authority?

I'd do it myself, but I don't have Vista.

Re:Simple solution

[Anonymous Coward]

I agree. Can't someone at least attempt to verify this before calling bullshit on it? I don't have Vista either, so yeah...

Re:Simple solution

[MillionthMonkey]

Great plan genius- now we have to find someone who bought Vista! :)

FUD

[gregholt]

Yawn. 1/10 for FUD. Slashdot FUD: "...showing connections to..." Source: "...trying to connect to..." Nice faulty translation there. Tons of system try to connect to every other system on the Internet; bad guys, good guys and just curious guys. Also from the source: "...my computer even in an idle state..." The processes active on a target system is not indicative of what other systems are trying to do in most cases. Plz may I'z haves moore FUD. K thx.

nothing to see here.. move along now

[sonictheboom]

this is just normal scans that everyone gets all the time. nothing to do with having vista installed.

Ever been connected to a P2P network

[Anonymous Coward]

If that computer has, and I assume it has cause you're running PeerGuardian, it's likely that your IP is in a host cache or tracker somewhere. As for the DoJ it could be some guy on a break using P2P. A connection attempt alone means nothing.

Re:PeerGurdian is not a legitimate investigative t

[CastrTroy]

Which when you think of it, makes complete sense, because the Internet was invented for and by the military.

I swear.. Zonk is....

[Anonymous Coward]

becoming more and more a Fox Mulder wanna be.... Everything is a conspiracy... The MAN is out to get us... Oooohhh.... Spooky Mulder where are you....

Please... Can we cut back on the Slashdot Conspiracy Theories....

Re:I swear.. Zonk is....

[ScrewMaster]

Yes, well ... at least Fox Mulder was usually right, even if he could rarely prove it.

Re:I can confirm this

[Anonymous Coward]

Posting anonymously for obvious reasons...

I work in one of the extraterrestial government agencies not in question, and I can confirm that we have been doing this. To be fair to United States government, they had no choice to let us in. It's been going on for years now. Right here, directly out of our own network, so that any retard with a freeware tcpdump/traceroute frontend can see exactly what they're up to.

PS: this isn't real.

I'm confused

[raftpeople]

Isn't this inbound stuff? Isn't this the same crap that ZoneAlarm blocks for me constantly?

That explains it!

[Anonymous Coward]

I wondered why Vista defaulted to that Black Helicopter screensaver. I guess we know why now.

More reason I'm glad I'm running 2003 server that the nice man from the NSA helped me harden.

Just Vista?

[orkysoft]

So he installed Vista, plus his warez, and now he's seeing suspicious network connections? Get a grip.

I'd like to see a bare install of Vista (legit), with no other programs running, and connection monitoring being done on a router in between the Vista box and the internet, before I will believe this. And I say this as a die-hard Linux user who has barely touched XP.

Re:Just Vista?

[mini me]

I'd like to see a bare install of Vista (legit)

What if Vista only enables this feature after it sees suspicious activities, such as using P2P programs?

Re:Just Vista?

[orkysoft]

You could control for that by running the same P2P program on an XP box and on the Vista box, and compare the results, IF the P2P program doesn't make the weird connections only when it detects it is running on Vista.

Re:Just Vista?

[vuffi_raa]

more likely a better way to do this is to install it leave it on for a month and just log- since vista reports every 2 weeks i believe

Re:Just Vista?

[weicco]

Legit Vista here with no P2P stuff or any such programs running. I have installed only Visual Studio 2005, SQL Server 2005 Express, Live Messenger, Skype and COD2 so far. Monitoring is done by my ADSL/WLAN/NAT/FW router. End results: no suspicious connection attempts or outbound connections here. Maybe finnish people aren't so interesting to watch :)

I was going to mod you down...

[msimm]

Just as over-rated. But I realized leaving your post modded higher makes more sense anyway (since you obviously weren't ust trying to be a prick and this why the whole conversations is easy to read).

As you'll see in one of the follow-up posts to this parent the software is being run on a second systems (since as you point out Vista isn't supported the listener is XP).

As to the credibility of the rest of the story I suppose that's up for grabs. Or rather reproducibility. Sniffing software is easy enough to install/use. Maybe the poster of the original story is being watched via a government trojan. Maybe there is a backdoor for the government to use to monitor potential criminal. I imagine if ALL Vista systems phoned home like this they'd be drown in data so it's either addition software, activated existing feature or hoax/fluke.

you saw the reason, yet you didn't understand it

[Anonymous Coward]

Looks like the guy had to boot into XP to use that software he wanted to use. Ever hear of dual boot, sparky? Maybe YOU are too quick to be "leet" and showoff your complete lack of reasoning skills. +5, what a joke, anyone who modded your post up is a 'tard and can't think past ONE step.

Re:PeerGurdian is not a legitimate investigative t

[nEoN nOoDlE]

indeed. When I was running Peer Gaurdian, I got DOD requests all the time in XP. This is a non-story

I actually like the Slashdot conspiracy theories..

[Anonymous Coward]

Like that ScuttMoney was taking bribes from that * * Beatles guy for posting stories (and notice how that stopped not that he doesn't get a PR boost for those links...).

Anyway, I think Zonk is just auditioning for Coast to Coast AM since Art Bell decided to retire again.

Time for a "zonksucks" tag?

[Anonymous Coward]

Just sayin'.

Connection to or from?

[Britz]

I guess all those computers are botnets (check out the other connections, DoD is only one among a whole bunch of seemingly random international sites including a couple universities from Brazil and China) trying to get more bots using security holes and trying if they have yet been patched on random IPs.

Because those are trying to connect TO his computer from the outside, not the other way around.

What a load of bullcrap. Where does /. pick up its editors?

Re:Connection to or from?

[init100]

I guess all those computers are botnets (check out the other connections, DoD is only one among a whole bunch of seemingly random international sites including a couple universities from Brazil and China) trying to get more bots using security holes and trying if they have yet been patched on random IPs.

That was exactly what I thought when I read the article. I mean, many random computers try to connect to mine every day, probably to infect it with some crap, and that's why I have a firewall.

Re:PeerGurdian is not a legitimate investigative t

[iminplaya]

Burn the government down.

Got a match?

Slashdot

[Anonymous Coward]

Getting worse every day!

Re:Slashdot

[Anonymous Coward]

I used to think this was sour grapes. Everybody everywhere always thinks everything is worse than it used to be. But fuck, Slashdot really is getting shittier by the minute.

Re:Slashdot

[Anonymous Coward]

Slashdot is shittier than Cowboy Kneel's xxx-large underwear the morning after he eats at taco bell.

Re:I call bullshit. - About Lame Screen Shots

[Nom du Keyboard]

Lame screen shots from some Windows app isn't enough to validate a conspiracy theory.

They're certainly enough to get you sued, and thereafter spending upwards of $100K in legal defense against the RIAA.

Here it is!

[Anonymous Coward]

Basically no one I know uses Vista (after they tried it).

Microsoft is so upset by this that their market department invented this FUD so all geeks around the world try this to prove it! Nice scam!!!

Thank god my home computers are all Macs! No Microsoft-related issues or problems to worry about.

Statistics

[tsa]

Those are some very strong allegations. I can't understand why /. soiled its pages with this. The guy didn't even try other machines and other operating systems. No statistics at all. This is the worst 'article' I've seen so far on /., and I have seen some really bad stuff here already. Indeed, as one poster said, /. is becoming more and more like Digg. And that is NOT a compliment, Taco at al.!

Re:Statistics

[TopSpin]

I can't understand why /. soiled its pages with this.

As I see it, there are two possibilities:

The first is that the story actually had credibility with Zonk and he was more than happy to put it up. Put Halliburton in a story and the truthers soil themselves. The second; Zonk saw through it like any other technically savy grownup and knew it would be ridiculed. In that case it is a sort of April Fools joke.

Anyhow, there are plenty of reasonable explanations already posted for the 'evidence' provided. Here is one I didn't notice; why would 'they' use easily identified domains to spy on people? 'They' run the world so clearly 'they' could arrange for something less obvious, no?

Finally, is there any recourse for a business that has had it's products publicly slandered? I'd hate to see Microsoft get a piece of /. in court, but it wouldn't surprise me if they tried.

Re:Statistics

[TheAwfulTruth]

/. has seriously been sliding lately, anti-Vista hysteria is reaching a hysterical level. "First they make fun of you...", it applies both directions.

But I believe this "article" just may be /. jumping the shark. It is pure tin foil hat BS. 100% prime grade A bull flop and /. puts it up like they are the Onion or the National inquirer. It's not 04/01 is it? Grasping for ANY reason to reidicule those we don;t like. Even when it's pure slander.

Maybe we've been trolled? Nah, "Never attribute to malace that which can better be explained by stupidity". Editors are at least supposed to be smart enough to not be taken in by such utter nonsense. /., it's your choice, down hill or up from here. This is dangerously low already...

Ceiling Cat Is Watching You Masturbate

[bmo]

It's goddamn Windows. Even if this was something to get excited about, Windows users get what they deserve, especially if they're p2p'ing warez like the source of this dodgy "article" was doing.

Set up a pristine Vista machine. Put a box inline with it and run Snort. Post the logs in some sort of reasonable format. Then we might have something to talk about. But this? What can I say, besides "bullshit"? The origin of this may as well be ranting about Ceiling Cat.

--
BMO

Re:Ceiling Cat Is Watching You Masturbate

[bigstrat2003]

It's goddamn Windows. Even if this was something to get excited about, Windows users get what they deserve.... No. Just no. I'm sorry, but that's pretty much the height of stupidity, what you just said. "Even if the government were inspecting his computer, he deserves it cause he's using Windows!"

I can see a little bit of leeway for a similar argument about any other source of attack, but not one which is supposedly originating from our government (and note that those arguments aren't legit either, but they're at least a bit better than what you said). But you are correct in that this is nothing to get excited about, so it doesn't matter.

Re:Ceiling Cat Is Watching You Masturbate

[bmo]

Did you RTFA?

Maybe what I said was a bit over the top, but he got exactly what he deserved. He was p2p'ing warez on Windows. That's the _only_ reason to run PeerGuardian, and you _don't_ need PeerGuardian if you're doing something legal like torrenting Linux distros. I don't know about you, but running p2p on Windows and bitching about weird connections is like, oh I dunno, deliberately peeing on an electric fence and then complaining that it hurts.

I'm sorry if my lack of empathy strikes you as callous, but...well, my sympathy for stuff like this died a long time ago.

--
BMO

Halliburton?

[Jeian]

Halliburton?

He's really grasping, isn't he.

I might've read the article

[RichPowers]

Until I saw the bit about the "Halliburton Company" in the summary. Are these nutjubs now required to mention it in every one of their hackneyed theories?

The worst part about stories like these is that it obscures what the government is really doing to invade our privacy.

How about some editorial control, Slashdot?

Digg story down.

[Aaron England]

Article buried for lack of journalistic standards.

Re:Digg story down.

[tsa]

Digg is that way --->

Re:Digg story down.

[blowdart]

What, you really believe people Digg due to truth in URLs as opposed to "Micro$oft is evil" contents? Do you want to buy some land?

Re:Digg story down.

[geekboy642]

Yeah, just past the venomous bug-blatter beast of Tral. It's supposed to keep the digg children on their side of the internet, but somebody "Up-Dugg" a post about keeping your eyes closed and, well, there went the Internet.

You call that a conspiracy?

[Nate Eldredge]

Okay, so maybe the US government and Halliburton are checking up on Vista users, but that's benign compared to the folks after us FreeBSD users. I whois'ed some of my port scan logs and found McGraw Hill, The Washington Post, the BBC, and Ikea. Now that is one terrifying conspiracy. Eisenhower was right when he warned us of the dangers of the media-Swedish furniture complex.

Seriously, though. Worms and botnets are endemic and every organization has boxes probing the internet without their knowledge. Doesn't mean they're out to get you.

I always hated people who would whine about Slashdot story selection, but come on, editors, use a little discretion. You're just helping spread paranoid stupidity.

Re:I call bullshit. - About Lame Screen Shots

[monoqlith]

Don't be sillly. The RIAA will sue you with much less evidence than a screenshot.

Highly plausible...

[Ub3rT3Rr0R1St]

With the fairly recent uproar that occurred with the numerous accounts of illegal wire tapping by part of the Bush administration, why, oh why, would anyone discard this as some sort of sham?

Now, I'm not agreeing that the proof is 100% credible, and I'm not completely disregarding the fact that this might really be a sham, but the previous experiences the US has had with any sort of monitoring on the peoples should be enough to regard this with high suspicion.

Monitoring through the internet isn't difficult. You don't need to be a Government agency with vast resources at your disposal. All you need is a terminal, and knowledge. I think the Government has plenty of both. Most people with internet connections don't know how to check the connections going into their computer. They don't know how to "port sniff". This makes for millions upon millions of victims to such an invasion of privacy.

I strongly believe this should be taken more seriously than it is at the moment. If wire tapping is illegal, and is treated with such priority, then I think this should be handled the same way. We have nothing to lose by assuming this is legitimate, and we have so much more to gain by going directly to the facts, by means of thorough investigation. This shouldn't be taken lightly.

Re:Highly plausible...

[Dachannien]

We have nothing to lose by assuming this is legitimate

Except, perhaps, your credibility?

Never attribute to malice what you can attribute to zombies.

Re:Highly plausible...

[Jeian]

Plausible it may be, but until there's better proof than this article...

Re:Highly plausible...

[Ub3rT3Rr0R1St]

That's why I state in the end that this should be handled by a thorough investigation. You need to look for proof for there to be proof.

Re:Highly plausible...

[Ub3rT3Rr0R1St]

Why would there be any credibility loss? This is a serious issue that merits at least some effort to investigate, and just because it might be a hoax, it doesn't boast enough of a reason to drop it all together.

We're not talking about endless hours of monetary resources and man power to verify these claims are true. It's almost effortless, really, to simply "check this out". Just a few people scanning their computer's internet connection.

If anything, this should be a top priority, being that it can be solved so quickly if people would just give it a little attention. Then, if it comes out as a hoax, well, so what? It had potential to be a big issue, and it deserved to be investigated. Any cons to this? Not really, being that it didn't take a whole lot to disprove it. If it comes out real? Who knows what the ramifications could be.

I'm not saying we should put every little conspiracy theory under the microscope, but when something can easily be dissected, then I ask, why not?

Re:Highly plausible...

[smack.addict]

You must be one of the idiots who believes in the Bush/9-11 conspiracy.

You see, your logic suggests that because the Bush administration is capable of nefarious deeds, any nefarious deed is by default plausibly a result of their actions.

Your tires are slashed? Must be the Bush administration! After all, they are capable of it!

You need more than the belief they are capable of the act; you need a) a reason and b) an explanation of the action that shows the action is the most logical path to justify the reason.

This fails a) because, simply put, the government does not have the time or resources to deal with every fucking Vista machine on earth constantly pinging it.

It fails b) because, well, if you are going to set up a DoD program to monitor computers clandestinely, are you going to have them dial the DoD direct?

Doofus.

Re:Highly plausible...

[Ub3rT3Rr0R1St]

You're all idiots. Every last one of you. You all think I'm just an anti-bush activist or something? Well, you're all wrong. Jesus, all I do is bring up an example of a recent event THAT JUST HAPPENS TO BE RELATED TO THE BUSH ADMINISTRATION, and all your arguments become directed at that, and ONLY that. GET A BETTER ARGUMENT. I'm NOT promoting anti-bushism here, hell, I don't even FOCUS on that.

I simply state that if it's been done before, it can be done again, and through another medium. Don't throw your "you just hate bush" fodder at me. It's the stupidest reply you could ever give, and makes it seem like you're just looking to pick a fight with anyone who mentions even the slightest negative thing about Bush. I could care less about Bush, you bunch of morons. Santa Claus could be the president now for all I care, but if he and his administration had been accused of illegally wiretapping American citizens, I'd suspect him just the same! STOP focusing on the person, and focus on the whole entity, i.e. the Government, their actions and their record.

And it's real funny how I try to maintain a normal debate, and all of you just add your little "dweeb" or "doofus" comment at the end. Real top notch there. Between the senseless name calling, and the idiotic replies that I've just wasted my time reading, well, if I didn't know any better, I'd say you were all Fox employees.

Re:Highly plausible...

[Dachannien]

But that's not what you originally proposed. You said that we have nothing to lose by assuming that it is legitimate from the outset. Doing so taints your efforts to determine whether the claims are true or not, because in the absence of clear evidence one way or the other, your assumption would still stand. The stronger your assumptions are to start with, the more evidence to the contrary you'll require to change your opinion, possibly as far as the point where you'll be regarded as a crackpot for your refusal to believe substantial clear evidence against your position.

UFOs, the moon landing, and 9/11 are all supposedly huge U.S. government cover-ups as well, despite ample evidence to the contrary, yet people still believe in them. They wanted to believe that those things were true, for whatever reason, and have therefore refused to see that evidence for what it is. The credibility of those people is marginalized because of that.

If you think these claims deserve further investigation, then go right ahead. But don't start by assuming that the rather unlikely answer of massive nefarious government spying is the truth, because then you'll just keep on looking through the haystack for a needle that may not even exist.

Re:Highly plausible...

[javaman235]

Thanks for that thought...I feel like were living in the age of conjecture. Its not just the talk of what the logs might mean, but of what the supposedly don't mean. People are so busy blasting Slashdot for running the story that nobody is looking deeply at what it means that there might be "bots" inside the DoDs computer system rather than something in Vista, or whether these "bots" are really what they appear in an agency that has billions of dollars invested into "information warfare".

I feel like between the people yelling about a conspiracy and the people desparately yelling about the non-existence of one, the more complex truth of what's really happening is completely lost.

Re:Highly plausible...

[Shihar]

This deserves not a single scrap of wasted time. Just TRY and contemplate the conspiracy that it would take to make this crap credible.

It goes something like this:

The government has decided to snoop on the computers of average Americans, despite the fact that there are countless private and corporate computer researches scrutinizing network traffic. Not only does the government decide to go ahead with a massive invasion of privacy and committing a clearly and blatantly illegal action on all Americans, but they are so fucking incompetent that they don't even bother trying to hide what they are doing. They don't bother taking precautions that even the lowest level of viruses might take, and instead decide to make their super sekret spy virus easily visible to the most basic of free down loadable software. To top this all off, a government that can't keep secret that even limited domestic spying programs has in the course of a year magically developed a way to pull off the greatest hack in the history of man kind without anyone spilling the beans... until one teenager kid looked at his network traffic and caught them! OMG! ponies!!111!!

Even the most vaguely computer literate person should be able to see that no vast evil conspiracy has been uncovered. What has been uncovered is a kid who has discovered that bot networks not only exist, but can easily be blocked with free software.

If the government is reading your e-mail, believe me, it isn't doing it by installing a virus that the most basic of firewalls is able to detect. You would have to be stupid beyond help to install software onto computers that are constantly scrutinized by hundreds of thousands of experts every single day. If the government is watching you watch pr0n on the internet, it is doing it by plugging black boxes onto network backbones.

think again

[CiderJack]

PG2 blocks both incoming and outgoing connections to blacklisted IP addresses.

Granted, we don't know which particular software is requesting the connections, although from a quick glance at the screenshots, it appears that the connections are indeed incoming requests.

Color me skeptical.

Re:think again

[Fallingcow]

Peerguardian2 under WinXP commonly shows DoD and other odd incoming requests. Let's see what's on my log of recent attempts right now...

Kuwait Ministry of Communications
AAFES/Barracks
Military Medical Academy

And a host of other weird entries. I know I've seen DoD on there before... let's check my older logs:

Federal Electric and Water Authority (WTF?)
Saudi ARAMCO (oil company)

OK, no DoD now, but the point is that weird crap shows up in Peerguardian all the time. DoD entries appear fairly frequently. If this guy's run any P2P software in the last, oh, week or two, that'll cause this to happen.

Re:think again

[Anonymous Coward]

MCO (oil company)

OK, no DoD now, but the point is that weird crap shows up in Peerguardian all the time. DoD entries appear fairly frequently. If this guy's run any P2P software in the last, oh, week or two, that'll cause this to happen.

Care to explain why to those of us not knowing?

Re:think again

[Fallingcow]

I *think* that what happens is that the Peerguardian folks blacklist whole IP blocks based on their nominal ownership, so three things might cause them to show up:

1) The attempted connection is actually a P2P monitoring or spyware thing coming from a DoD machine, and is legitimately blocked and correctly labeled
2) Someone's running P2P software on a DoD machine (or their own machine on a DoD network).
3) Someone's running P2P software on a NON-government machine that is unlucky enough to be on the same IP block, for whatever reason, so the label's actually wrong.

I'd imagine that's how a lot of the weirder ones show up, like "CHINANET henan province network" and "Zhuji Municipal People's Government" (those are real entries from my log right now) and crap like that; Peerguardian just blocks chunks of IP space that are owned by any governmental agencies in any country.

I don't KNOW this to be the case, but it seems to be what's going on.

Re:think again

[Anonymous Coward]

Actually, AAFES is Army Air Force Exchange Service. Which is owned by the DoD.

Re:PeerGurdian is not a legitimate investigative t

[Jherico]

That's as may be, but a default OS installation should have no reason to talk to any of the root servers. Only a machine RUNNING a DNS server should have any reason to communicate with root servers.

Bullshit OR Bad Writing!

[sciop101]

The author should have given a short explanation of his technique (backout to Vista, separate machine, whatever...)

I suggest a separate machine.

Re:PeerGurdian is not a legitimate investigative t

[Anonymous Coward]

That's as may be, but a default OS installation should have no reason to talk to any of the root servers. He may run a non-standard install or even a DNS server... BIND will run on anything.

Hacker took over the box perhaps?

[Adammil2000]

Is it possible that this box was taken over by a hacker and is trying to attack DoD addresses? As opposed to some alleged "phone home" behavior that Vista is showing?

Re:PeerGurdian is not a legitimate investigative t

[Jeremiah Cornelius]

Not since Superman died.

Ba-dump!

Bad facts

[Anonymous Coward]

fta "We're talking about a Microsoft upgrade that almost rivals the audio development quality seen on Mac DAW's for years - but with none of the proprietary hardware BS that is forged into the Mac world."

I'd like to see a list of these so called "proprietary" mac parts.

hmm

[LinuxRegisteredUser_]

I don't see any connections on the new vista machine. I'm watching the packets go through the router. Read that headline and was about to go uninstall. Glad I checked to confirm first.

LOL Cat!

[Jeremiah Cornelius]

We'rE In uR Ip'S, SteaLiN' Ur GovAminTS!

Don't believe negative hype created by gov plants

[Anonymous Coward]

This article isn't any more or less plausible than any other article on slashdot, however there are many angry and negative reactions towards it. It's entirely possible, probable infact that the people trying to "Digg it down" are plants by the government or the type who easily chime in with government plants.

Think about it, the person is just asking a question and is showing what they did, screenshots and all. It requires more investigation and it's important for someone to do it, but it's not the writer's responsibility. They are simply sharing some very disturbing news.

Our government does use undercover people to sway public opinion and paranoia bashing is one of their effective methods. They know that the target audience fears looking like some sort of off-the-rocker loonies and would rather not voice or investigate their suspicions in order to save face. It works.

Don't give into conformity people, think! THINK!!

Re:Never trust a compromised box.

[Technician]

Great plan genius- now we have to find someone who bought Vista! :)

Never trust a compromised box to tell the truth. Wake me when he has router logs instead of Vista logs or worse XP logs of a Vista monitor. Many routers will send connection logs to a 3rd machine. This way you don't have to trust the machine under test. Simply log it's traffic as it passes an external router. Now you have evidence of real traffic.

I was skeptical of the original setup. Was it Vista. The author claimed "idle" while running remote desktop software. That's hardly idle to me. What if it isn't Vista, but something like a back door into some communications package such as remote desktop?

The Department of Homeland Security may have in intrest in remote connections, especialy if they cross into hostile territories. Someting could have flagged this connection as something they wanted to watch for some reason. Maybe it's the connections to all the overseas .edu's. Many of the people being watched are on educational visa's. Having ties to some of these schools may be a red flag. It's not Vista, but the remote software that may be to blame. Having active connections to schools in several contries may have raised intrest. See the logs in the screenshots.

Re:PeerGurdian is not a legitimate investigative t

[bev_tech_rob]

Especially if the machine is resolving to 192.168.0.1 on his internal network. Looks like the XP box is set up as a router (ICS maybe?) and probably a DNS server as well for his internal network (Smoothwall or a similar flavor of firewall software would be a lot cheaper alternative than WinXP..imo)

No Destination Ports

[tiny69]

The screenshots conveniently leave out the destination ports. With out that information and without knowing what programs the user had installed or running, the entire article is a waste of time. We have no idea if the traffic is associated with a program he's running or if it's something else. He's concerned about connections that appear to originate from the U.S. Government, but isn't phased by the connections appearing to come from China. Oh noes!?! China has a backdoor in Vista!!

My guess is that he's running some P2P software. Guess what? The U.S. Government does get 0w3nD and does have problems with viruses, trojans, and P2P software.

Nothing to see here. Move along....

Re:No Destination Ports

[Anonymous Coward]

The word you're looking for is 'fazed'.

Not 'phased'.

Worst /. Story Ever?

[nuintari]

Okay, this has got to one of the most pointless slashdot stories ever.

One, he is sniffing with a crappy piece of software that is barely a sniffer. Secondly, unless he has that XP system he claims is a Vista system, monitoring a HUB, not a switch, that the Vista machine's traffic has to go thru, he isn't sniffing anything relevant. Last, this is pointless paranoia.

You want to see more of your "government conspiracy traffic?" Find someone at an ISP to help you, as you will need a piece of public IP address space. Route it to someplace where you can monitor all the traffic destined to it, and plug nothing into that segment of your network. It just has to exist, and be publicly accessible. It goes nowhere, has no devices in it, it just exists. Then turn your sniffer on, and watch the botnet traffic fly by. Yeah, you will see attacks coming from everywhere, nowhere to go, and still they scan like crazy. And yes, you will see it come from DoD address space too, heaven for-fucking-bid.

Oh, and when do your sniffing, use a real sniffing tool. Then you can tell us what kind attacks the scary US government is mounting against its most paranoid citizens.

Re:Worst /. Story Ever?

[TropicalCoder]

this has got to one of the most pointless slashdot stories ever

I don't agree at all. I find it very educational. In spite of being a programmer for over a decade, it is only within the last few years I have been learning about the network side of things, as the majority of software I developed didn't require such knowledge. Today, for example, thanks to a post, I learned there is an update to Ethereal called WireShark that I have just installed, along with an update to WinPcap. I imagine there are many Slashdot readers that have as much knowledge on the network side as I have on the programming side, and I for one am very grateful they share their knowledge with the rest of us.

Re:Worst /. Story Ever?

[nuintari]

Okay, I will grant you that some of the discussions that spawned as a result of this article were fairly useful, but the original article itself was a pointless bit of geeky paranoia without any real evidence to back any of the ludicrous claims the write made.

Re:PeerGurdian is not a legitimate investigative t

[arth1]

Indeed. That's why one of the other DNS TLD root servers sits in Al Gore's basement...

Linux and Amiga users can be safe...

[3seas]

http://zapatopi.net/mindguard/

A better question is

[brennz]

Why does Zonk continually post such uninformed articles?

Re:A better question is

[c0rruptc0d3]

The better question how did it get to the front page on /. Peer guardian is about as useful as a network sniffing tool as my dog is at sniffing packets.

gotta be careful about rev. lookups on port scans

[bl8n8r]

It's pretty trivial to spoof a source ip. Just ask the folks at DenyHosts. If the attacker could care less about return packets and simply wants to create a lot of traffic (DoS) count on it. You really have to be careful with the data that's returned from tools like this. A lot of times it's useless. He should have scrubbed his IP from the screenshots too, poor bastard. This article would be perfect Diggchow except he never mentioned Apple in the article. Oh well.

Compromised machine

[ubrgeek]

His machine has been compromised and is being used to more on to other locations on the network. Wipe, reinstall, patch and hope to avoid zero-days. Nothing to see here.

Mods on crack again.

[HornWumpus]

Who modded this dweeb insightful.

Metamoderators please spank these mods.

Re:Mods on crack again.

[Ub3rT3Rr0R1St]

Not to start a flame battle, but why do you have to reply with such a useless post, calling me a dweeb, when all I'm doing is stating a valid opinion based on previous experiences that have been noted, such as illegal wire tapping?

If you have nothing constructive to say, don't reply to my posts.

Re:Mods on crack again.

[toddhisattva]

Please don't insult crack users like that.

Re:PeerGurdian is not a legitimate investigative t

[Anonymous Coward]

Indeed. That's why one of the other DNS TLD root servers sits in Al Gore's basement...

Fully secure from the depradations of ManBearPig. Do you have any idea of the potential ramifications if ManBearPig got ahold of a DNS TLD root server? It'd be really, really bad. I'm cereal.

In Soviet Russia ...

[PPH]

... computers keep YOU in an idle state.

Re:PeerGurdian is not a legitimate investigative t

[empaler]

I'm cereal. That may be, but I'm supercereal.

First thing I thought when I saw this...

[cswiii]

..."Hrm, sure seems like the whole Prodigy STAGE.DAT dust-up".

As it turns out, I was wrong - it's even more innocuous than that.

As I've Said Repeatedly in the last couple weeks

[Master of Transhuman]

Yes, NSA has a way to break into Windows Vista (and probably any other version of Windows) since they were allowed by Microsoft to try (and supposedly report their results to Microsoft - which of course they didn't entirely.)

However, this story makes little sense as it stands. Until somebody sets up a proper test, there's nothing to see here.

And if people like the NSA, Halliburton and DOHS were scanning everybody's PC, they damn sure wouldn't be allowing a traceback to their own IP addresses assigned to them. Unless, of course, they wanted you to know Big Brother was watching. And Halliburton, despite being in bed with Big Brother, obviously wouldn't want that - they'd get sued blind by somebody.

Yawn!

[no-body]

What else is new? That M$oft is in kahuz with all kinds of 3 letter agencies is not new.

Since Windows XP, info from your XP computer is sent out to Microsoft.com - I don't have it, so I can't report much about it, but with a decent firewall installed, many software packages "call home", repeatedly and totally without justification. One does not need to check daily for updates! Adobe on my top list.

And - with the recent court approved installing of a sniffer on a potential suspect's computer - doing non-approved sniffer installs is probably more frequent, not even considering botnets.

It furthers an atmosphere of fear, is not empowering and in short - sucks!

Re:Yawn!

[The Cisco Kid]

'kahuz' is not a word, as far as I know. At least, not in English.

The word you were looking for is 'cahoots'.

http://www.answers.com/topic/cahoots

Paranoids

[nurb432]

Sure, they may be out to get us, but this is just plain garbage.

DoD and Haliburton?

[Anonymous Coward]

It must be Skynet. It's unleashing The Virus on all unsecured systems on the Internet.

Everyone has infected PCs

[Proudrooster]

If VISTA were connecting to the DoD and uploading data, I would be concerned, however these connections are from infected Zombie PCs running malware and trying to infect/control other PCs. It has NOTHING to do with VISTA, but EVERYTHING to do with Microsoft and their pathetic security in Windows. A large percentage of Internet traffic after bittorrent, streaming content, and spam is zombie PCs looking for more PCs.

Re:Everyone has infected PCs

[cdrguru]

The only way to have a computer that is truely secure is to have it locked in a closet.

If the user can authorize the installation of WeatherBug any other form of security is pointless. The first step is to disable the installation of unauthorized software.

In a company the IT department may be able to decide what is authorized and what is not. For a home computer the only security can come from disallowing anything - it is all unauthorized. Nothing that can be executed can be added to the computer and nothing is ever executed (like scripts). Then you can start worrying about buffer overflows that allow arbitrary code execution and turning them off.

Until you are in control of what is being installed, I'd say the rest is pointless.

Re:Everyone has infected PCs

[NeuroManson]

Or, perhaps one should ask if those versions of Vista that are doing this were warez products, and if that malware came preinstalled, "slipstreamed" as it were, so those who burned a copy and installed it would think they were getting nothing more than a cracked version of Vista.

I doubt it's due to Vista...

[Anonymous Coward]

With PeerGuardian, you see all kinds of crap. I doubt anyone is checking up on him due to Vista. It's more likely his IP is confused for one running P2P.

I mean, hell, 38.100.26.190 (SafeNet / MediaSentry) has been DoSing me with 10 connections/second bursts for ages now because I once clicked the wrong torrent but you don't see me writing Slashdot stories over it.

Re:I doubt it's due to Vista...

[Anonymous Coward]

I mean, hell, 38.100.26.190 (SafeNet / MediaSentry) has been DoSing me with 10 connections/second bursts for ages now because I once clicked the wrong torrent but you don't see me writing Slashdot stories over it.

Maybe you should. In the context of ISPs crying poor because they may have to deliver a significant portion of the bandwidth that they are being paid for, that 2.5 billion+ packets per second is probably signficant (assuming only 250M "suspects").

Re:I doubt it's due to Vista...

[likes2comment]

Peer Guardian's website deems to b down at the moment, most likely due to the /. effect.......

As we say, http://www.buzzoffbozo.com/ to the DOD.

Great response in his site's comment section

[6350']

I noticed this in one of the comments on his site:

"So the gov't and Haliburton have bot infected computers just like everyone else. What else is new?"

Hah! Awesome.

Your partisan nature colors your experiance!

[HornWumpus]

You ever hear of echelon? It started under FDR or Truman depending on who you believe.

The only difference is that Bush thought he could get away with admitting to doing what the last 10 or so presidents have been up to (tapping overseas calls without warrant).

The fact that this whole story has been shown to be the hyperbole up thread didn't stop you from posting a 'Blame Bush' screed. Which the moderators, being on crack, called insightful. Dweeb!

Re:Your partisan nature colors your experiance!

[Ub3rT3Rr0R1St]

I'm not blaming Bush in the sense you are pointing out. Sure, a lot of presidents have been guilty of these actions, I don't deny that. What I was doing with that example was simply bringing up the most recent case which seemed to fit into this article's particular category.

Don't focus on one particular example. Take the whole thing in. I'm not making a huge verbal attack on the Bush administration. I don't really care for the Bush administration. What I'm conveying relates to the Government as a whole, albeit whichever administration is in control at the moment.

Laughable.

[Kaenneth]

I actually did contract test work at Microsoft, testing a Vista component that used the network.

So I ran its networking through a seperate machine that ran ethereal, and studied the logs in great detail. I also watched for any 'privacy issues'. Basically, anytime Vista 'phones home' it's required to be by the user Opt-In, and never as a default. If you didn't read the EULA/Privacy Policy, etc. and just kept hitting 'I Agree', 'Accept' and 'Next' every dialog... you might get some things you didn't expect

say you visit a HTTPS url... aside from what actually appears on the page (content + ads) you may need: the digital certificates for the signing authority, revocation lists, accurate time, to check for expiration, DNS, Sytle Sheets, DTDs... a lot of that can be cached, but at some point they may be automatically downloaded.

Playing a (non-DRM) song?, you may get the album information automatically.

Plus all the non-MS software 'phoning home', Adobe Acrobat reader, Quicktime Updater, HP printer drivers, anti-virus updates, *Peer Guardian blocklist updates*

As for the incoming connections mentioned in the article, it seems well within Homeland Securities domain to scan for botnet and such infected machines, in order to defend against DOS attacks on critical infrastructure (like root DNS servers).

I once did a Google search for 'attrs' using Firefox on a Linux box. What popped up was a box asking me to accept a Department of Defense digital signature, served from a DOD server.

why? Google had suggested I was looking for 'atrrs' which was a DOD term, and Firefox tried to pre-load the first result, which was a DOD run website, which popped up the certificate from a site I did not intend to visit! If there is a conspiracy, then Google, Mozilla, and Slackware are in on it.

Re:Laughable.

[alodien]

ATRRS? LOL...it is a conspiracy - the DOD wants you to sign up in ATRRS to take Defense Acqusition University courses. Heaven help you - don't do it - they will literally bore you to DEATH!

Re:Laughable.

[VGPowerlord]

I once did a Google search for 'attrs' using Firefox on a Linux box. What popped up was a box asking me to accept a Department of Defense digital signature, served from a DOD server.

why? Google had suggested I was looking for 'atrrs' which was a DOD term, and Firefox tried to pre-load the first result, which was a DOD run website, which popped up the certificate from a site I did not intend to visit! If there is a conspiracy, then Google, Mozilla, and Slackware are in on it.

Let me guess, you had FasterFox or some other accelerator loaded? I'm fairly sure that Firefox doesn't do this by default.

Re:Laughable.

[geekoid]

"Basically, anytime Vista 'phones home' it's required to be by the user Opt-In, and never as a default. "

Just to point out that this is the OS we are tlaking about. The machine could easily decide when it want's to do something without you knowing about it. Opt-in or otherwise.

"As for the incoming connections mentioned in the article, it seems well within Homeland Securities domain to scan for botnet and such infected machines, in order to defend against DOS attacks on critical infrastructure (like root DNS servers)."
bullshit.
No more then they shoudl ebgoing through your house 'Just in Case'

Not plausible at all

[teg]

Are there hidden things which the US government or others can use in Vista? Not impossible.

Should you trust Vista crypto totally, if you really have something to hide? Probably not.

Would they be as stupid as to let every computer send traffic to DOD computers? Obviously not. Even if most don't know how to monitor traffic, enough do that there would be an immediate uproar.

Possible "hidden features" would either need the system in question (secret keys....) or would be dormant. If turned on by some events, I'm sure their effects would be non-obvious too. Sending network packages to a DOD address isn't.

This story is BS.

Can someone please post the entire article ?

[Anonymous Coward]

Does anyone have the entire article? Please leave a link in this forum.
and for the person posting this news article, I think you should at least
check and see if the article is available in it's completed form.

That link to see the rest of the article is dead, or goes to something
totally different.

Re:Don't believe negative hype created by gov plan

[Anonymous Coward]

Ah, the new favourite ad-hominem: "everyone who disagrees with me is a paid shill."

Sorry, but some things are worth investigating and some aren't. Here's a quick rundown:

• "Windows DRM is deleting my home movies, and here are 500 other people who've had the same problem": plausible, worth investigating
• "This suspicious Windows file is an NSA backdoor - here is the decrypted source code that makes me believe this": implausible, but still worth investigating
• "Halliburton is spying on me, and I know this because one Halliburton-related IP address appeared when I ran this tool (which was written for thieves to use to stop copyright owners seeing what they are stealing - boy do I sound honest!)": totally implausible, not worth investigating

Look, if I wanted publicity, I could post photographs of aliens probing my anus in Area 51 - would you still say that I was sharing disturbing news that it was important to investigate? Because this is the tech equivalent of that. Someone who doesn't know what he's doing misinterpreting a few irrelevant results from a tool that he doesn't know how to use, and building a huge and implausible conspiracy theory on top of that? Give me a break. Come back when at least it's the NSA spying on you, Mr Tinfoil.

And, no, for the record I'm not a government plant, and nobody is paying me to write this. I'm not even American. I don't care what Halliburton does, as long as you don't invade my country and make them do it here too. I'm just a guy with a brain who knows a bullshit story when he reads it, and I don't like seeing other sensible people being accused of being government shills just because they are also capable of spotting bullshit.

Quality research...

[Shemmie]

I'd like to applaud the commitment and bravery of the researchers in bringing this information into the public domain.

I'm from a similar underground organization, and have been monitoring Vista for some time. Notable connections we have so far made are:

Dinosauroid-like Alien Reptiles using Vista UMPCs are dominating the World
Apollo 11 Moon Landings were faked by Vista
September 11 was orchestrated by the U. S. government using Vista and Workflow Foundation
etc.

It's pretty conclusive stuff, people.
(Conspiracies kindly provided by http://www.2spare.com/item_43133.aspx - note it's on an IIS server - don't trust it. The truth is out there!)

/.ed

[tubapro12]

Not only (from what I hear) is this lame BS, the link is apparently slashdotted...

What Vista version? What software? What?!

[Anonymous Coward]

We all know that Vista comes in several releases; it would help to know to which version he "upgraded". I myself recently bought a Chilligreen (yes, thats right. A German PC brand) as a new game PC. I normally upgrade my main box' components but at this time I am too lazy to dive into the whole hardware market again. My new game box is running Vista Home Premium Dutch. Its an Intel dual-core 6420 (2.13Ghz), 2Gb RAM, 500Gb SATA HD, Realtek 100mps NIC, GeForce 8500GT and has some extra's like a cardreader, soundcard, etc.

Its in a network which also has a Linux box (my regular 1.2Ghz AMD box) and my Cyrix Solaris 10 server (VIA chipset, even the CPU. Very nice PC, doesn't even use fans while its still a whooping 850Mhz which is enough for fileserver, proxyserver and webserver usage).

Now let me share with you the results of running "pfexec snoop host 10.0.0.167" (for you linux fans: this is like tcpdump, it sniffs the network) for the duration of one evening:

magi:/home/peter $ pfexec snoop host 10.0.0.167
Using device /dev/rtls0 (promiscuous mode)
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Syn Seq=2626883403 Len=0 Win=8192 Options=
magi.intranet.lan -> 10.0.0.167 TCP D=49248 S=3128 Syn Ack=2626883404 Seq=123510362 Len=0 Win=49640 Options=
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Ack=123510363 Seq=2626883404 Len=0 Win=16425
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Push Ack=123510363 Seq=2626883404 Len=409 Win=16425
magi.intranet.lan -> 10.0.0.167 TCP D=49248 S=3128 Ack=2626883813 Seq=123510363 Len=0 Win=49640
magi.intranet.lan -> 10.0.0.167 TCP D=49248 S=3128 Push Ack=2626883813 Seq=123510363 Len=843 Win=49640
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Ack=123511206 Seq=2626883813 Len=0 Win=16214
magi.intranet.lan -> 10.0.0.167 TCP D=49248 S=3128 Fin Ack=2626883813 Seq=123511206 Len=0 Win=49640
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Ack=123511207 Seq=2626883813 Len=0 Win=16214
10.0.0.167 -> magi.intranet.lan TCP D=3128 S=49248 Rst Ack=123511207 Seq=2626883813 Len=0 Win=0

The 'magi' is my main Solaris server, port 3128 is the port used by the Java webproxy. These logs were created while I was simply checking the control panel and device properties on the Vista box. The proxy server logs show this:

10.0.0.167 - - [22/Jul/2007:23:34:25 +0200] "POST http://sqm.microsoft.com/sqm/windows/sqmserver.dll HTTP/1.1" 403 0 403 0 472 472 162 353 206 261 0
10.0.0.167 - - [22/Jul/2007:23:34:25 +0200] "POST http://sqm.microsoft.com/sqm/windows/sqmserver.dll HTTP/1.1" 403 0 403 0 472 472 162 353 206 286 0
10.0.0.167 - - [22/Jul/2007:23:34:26 +0200] "POST http://sqm.microsoft.com/sqm/windows/sqmserver.dll HTTP/1.1" 403 0 403 0 472 472 162 353 206 261 0
10.0.0.167 - - [22/Jul/2007:23:34:26 +0200] "POST http://sqm.microsoft.com/sqm/windows/sqmserver.dll HTTP/1.1" 403 0 403 0 472 472 162 353 206 261 0
10.0.0.167 - - [22/Jul/2007:23:40:18 +0200] "GET http://money.service.msn.com/StockQuotes.aspx?v=1& symbols=$NL:AEX,NL:GTN,NL:JETIX,NL:KPN HTTP/1.1" 200 465 200 465 - - 409 378 449 304 0

OH NOES! Vista is trading on the stock market without me knowing, MS is stealing my money!!!
And now for the people who don't believe in fairytales: the only thing it did was polling from time to time to get recent information. My Vista's sidebar is keeping track of a few stock funds. Next to that it seems to be downloading "sqmserver.dl

Re:What Vista version? What software? What?!

[Anonymous Coward]

Doesn't matter anyway, the NSA is already able to look at almost anything through your commercial ISP.

Yes

[BlueParrot]

They probably are collecting personal data and passing it on to the government, but this sure as hell isn't how they do it...

Vista sniffing

[Beyondism]

'click stream' info is monitored to est. online behaviours as routine>= building up profiles. US gov blocked strong encryption progs, classifying them as 'munitions' to enable transparency (on their side of mirror) when they set the whole 'thing' up. This 'conspiracy' is a 'ring-fence' for the real conspiracy. The whole forest not one tree.

Re:PeerGurdian is not a legitimate investigative t

[HotNeedleOfInquiry]

My farts and your breath.

Re:PeerGurdian is not a legitimate investigative t

[iminplaya]

Wow! Minty fresh farts. A unique individual you must be.

A Security Expert in the Making...

[Anonymous Coward]

FTA:

I've written a college report on the same phenomenon, which has gained considerable attention by even my instructor. I've posted similar articles on a few tech sites and the like that I frequent more often than this bored, and there are a number of Vista users who have replied with similar claims. Even his instructor?! Shit guys, this sounds like pretty serious business. I know I'm going to be disconnecting my network from the internet from now on. Thank God there are security experts like this watching our backs or we'd be screwed.

Move along. Nothing to see here.

Re:I can confirm this

[gEvil (beta)]

PS: this isn't real.

Uh huh. That's just what you want us to believe...

Re:PeerGurdian is not a legitimate investigative t

[gad_zuki!]

Exactly. What oversight is there in the peerguardian lists and why should anyone trust them? Seems like they can call any IP range whatever they like and paranoid people will start sending stories to slashdot about how the "gubmnt is in their 'puters."

Its nice that the methlabs people keep putting out this software, but its no a drop-in replacement for real security sluething. Hell, its not even a replacement for etherreal.

Re:PeerGurdian is not a legitimate investigative t

[Sycraft-fu]

Specifically, they run G. Because of the development of the Internet as on originally military project, and then subsequently adding US research institutions, it turns out there's a reasonable chance your query will go to some entity that's a part of, or beholden to, the US government. H is run by the Army Research Lab, and E is run by NASA (which is a government agency). The only roots not run by a US company, university of the US government are I, K, and M.

If this guy wants to actually prove anything ro see what is going on, he needs to first find out what the address is for, and then toss a software firewall or other sniffer on the Vista box to see what process is interacting with it.

I do love the conspiracy theorists that think that someone like MS is smart and sneaky enough to build monitoring like this in, and assume it won't be found (please remember there are a lot of places with the Windows source code http://www.microsoft.com/resources/sharedsource/de fault.mspx) but stupid enough that the address it talks to is tagged as DoD. You know because the DoD couldn't quietly get a block of addresses from Cox that would show up to the world as just any other cable modem IPs.

Karma whore!

[HornWumpus]

You did show up saying this was 'highly plausible' without even scanning the comments to see that is was not remotely plausible and in fact had a reasonable explanation.

But you got modded up because in no small part you were ready to blame Bush. (No surprise there, this is /.)

Having had some hours to scan up thread you still defend your stupid position. Please get a clue. As to the name calling we call 'em as we see 'em, idiot.

Re:PeerGurdian is not a legitimate investigative t

[LaughingCoder]

That probably explains Al Gore's gargantuan electricity bill then.

Old News remember Titan Rain, TIA ... +URLinks

[OldHawk777]

Believe it or not the USA, Germany, Japan, and France are not the leaders in this activity

Old News, Two of the better know:
China Titan Rain: http://en.wikipedia.org/wiki/Titan_Rain
US DARPA TIA: http://en.wikipedia.org/wiki/Total_information_awa reness

EU, Russia, Arabs, Israel, UN ... It is the new SOP for CoOp spycraft and cyberwar.
US ain't the only one on the block, globally they are all on pot calling the kettle black.
As I always say, "Reality is self induced hallucination." If you're a politician/idiot it ain't that FUBAR.

Wikipedia blocked the USA Congress IP address block, as to why ....
http://majikthise.typepad.com/majikthise_/2006/01/ wikipedia_block.html

Maybe some folks need to be blocking some top-level domains .cn/203+202..., .mil/199+207..., .gov/216+206+69+209+82+66... ....

IOW, consider the following:
US DOD NIC: 6.0.0.0 - 7.255.255.255
US DOD NIC: 11.0.0.0 - 11.255.255.255
US DOD NIC: 21.0.0.0 - 22.255.255.255
US DOD NIC: 26.0.0.0 - 26.255.255.255
US DOD NIC: 28.0.0.0 - 30.255.255.255
US DOD NIC: 33.0.0.0 - 33.255.255.255
US DOD NIC: 55.0.0.0 - 55.255.255.255
Halliburton Company 34.0.0.0 - 34.255.255.255
Computer Sciences Corporation 20.0.0.0 - 20.255.255.255
USPS: 56.0.0.0 - 56.255.255.255

You can do your own homework:
IANA: http://www.iana.org/
ARIN: http://www.arin.net/index.shtml

!HAVEFUN!

Re:PeerGurdian is not a legitimate investigative t

[inode_buddha]

Instant meme, just add milk.

From the beginning...

[rickb928]

- The PG trace window shows INCOMING frames...

- Apparently the author's firewall is not blocking incoming requests...

-or-

- The trace does not show the outgoing requests...

- No evidence from the screenshot that anything is reporting back to anywhere from the author's machine...

- Further discussion without more information is a waste of time

Re:As I've Said Repeatedly in the last couple week

[segra]

not while everyone "knows" how much BS big brother and all that is :) and id say its pretty safe to agree with you the NSA/ANYONE IN THE WORLD can break into windows, hell, kids using google can track down a usable exploit with shellscript in a few minutes. imagine what a well trained research team could track down over a few years, especially if they could examine the original source code :)

Re:I call bullshit. - About Lame Screen Shots

[Anonymous Coward]

(Score:5, Funny)

Yes, and no... I'd give it a more:
(Score:5, Funny Ha-ha-ha... ha... damn, that's the truth... *Insightful*)

Of course it's bullshit. Just look in the summary.

[jadin]

After running Vista for only a few days -- with a complete love for the new platform the first sign of trouble erupted.

Re:As I've Said Repeatedly in the last couple week

[geekoid]

"...they damn sure wouldn't be allowing a traceback to their own IP addresses assigned to them. "

they may have made a mistake, Seriously. Maybe some developer did in on the side?

On the internet, everything is trace-able.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:As I've Said Repeatedly in the last couple week

[The Cisco Kid]

And just for the record 'traceroute' has absolutely no bearing on 'tracing' someone and isnt really relevnt to findout out who or what exists at a particular address. 'whois' with an appropriate RIR would be appropriate

'traceroute' is a network troubleshooting tool, and its similarity to the word 'trace' as used in 'tracing a call' is an unfortunate accident.

What an idiot.

[Anonymous Coward]

Either the article, or the submitter is an idiot. Those seem to be connections TO THE computer, not as the submission implies as connections FROM THE computer to those networks.

Also, the writer of the article is a moron, since he seems to think there is a big MS Vista/US Government conspiracy going on, but appears totally unconcerned with the large number of Chinese attacks on his system.

This person needs to get a firewall so he doesn't get pwnd. If it's not already too late (which is all too likely).

The only thing missing to make this look like some hysterical Digg-esque behavior is a Ron Paul reference. Damn, now I've gone and done it!

High-tech Paris Hilton

[BillGatesLoveChild]

> I swear this place is becoming more and more like Digg everyday.

Like Digg, Slashdotters vote which stories to run http://slashdot.org/firehose.pl so its a popularity thing. I've submitted some stories I thought were relevant and interesting to Slashdot's mission, but it's hard to get them run. If you don't get a lot of people voting for you quickly, you drop off. Ok: The R2D2 was borderline, but the academic study on narcissistic YouTube/MySpace isn't the sort of thing people want to hear: They'd rather hear the Tech-equivalent of Paris Hilton stories.

Takes maybe 20 minutes to submit a story to Slashdot: you need to write something postable, gather and cross-check background links, preview until it reads right and submit. Most of the time, your story won't run. That's just the way it is on a democratic news site. When you see ill-researched stuff like this get voted to the head of the queue, hmmmm....

As for this particular story, you're right: His claims are a flimsy. Doesn't tell us what he was doing, and he hasn't even resized the peer guardian window so we can see what the port numbers were. If he was running BitTorrent, that'd explain it. Haliburton is a vast corporation, and I bet there, even on ECT (Evil Company Time) some employees run BitTorrent. Does the guy really think the United Nation Development Program cares what he's running on his PC? More so some UN worker is experiencing the joys of capitalist bittorrent. The Hei Long Education network means China isn't as closed off from the world as you'd think. Maybe that would be a better story?

Re:High-tech Paris Hilton

[andrewd18]

+1 Insightful.

UNDP in charge of "Informatics"?

[Joao]

First off, I work for the United Nations Development Programme (UNDP). The UNDP organizes and help find financing for projects in developing countries. Helping organize local elections, find donors for a project to build a local road, get a good NGO to setup a National Park, find the right people and pay them to go train a local group on sustainable farming methods, and so on and so forth.

To claim that Vista is sending encrypted information to UNDP because UNDP is parent branch of the U.N. Informatics Division is beyond bogus. They saw the word "development" in the name and assumed it was in charge of "developing" the UN. Heck, UNDP doesn't even run most of its own servers! They are hosted with local ISPs.

I must call a New World Order Nuclear Shenanigan on the original article.

Re:I call bullshit. - About Lame Screen Shots

[Anonymous Coward]

Quit! This NOT funny and should not be modded funny! It is the absolute truth!

I call bullshit., too

[CaptainZapp]

I'm no longer renewing my Slashdot subscription while I can get this same quality news for free elsewhere.

Dude, you don't need a Slashdot subscription to get the exactly "same quality news" as a subscriber.

Sheesh!

HELLO?!?! This is MS astroturfing, you guys.

[Fantastic Lad]

If it isn't, then they ought to hire the guy.

Geez. The article starts by listing all the 'great' qualities of Vista; it sticks it to Mac users, and expresses how important it is to not be left behind in the evolutionary game of change, and the bullshit about how all software is 99% backwards compatibile, (which isn't even true).

Then it makes a frightening claim which even the lowest level geek would recognize as being false.

The end result? Everybody who has read this article has now blithely absorbed a first rate sales-pitch which 1)Lists 'hot' features, and 2)Hits multiple social pressure buttons known to create sales, and 3)Trades on the bullshit "Only Losers Believe in Conspiricies" saw, because a bogus Straw Man threat has been set up and knocked down. --And everybody knows that the most powerful way to get people to believe in a lie is to lead the mark by the nose to the point where they connect the dots themselves and think that it was their idea all along.

And heaven knows that NEVER could happen with the Slashdot crowd. (sic)

Slashdotters and the like are so ego-impaired that when they knock down a Straw Man, they'll congratulate themselves for weeks afterwards and would actually prefer to believe that somebody really is that dumb and that MS isn't manipulating them for all their worth. --Simply so that they can feel smart.

The sad part is that this stuff works. I bet a number of you are going to actually upgrade based on this crap. Doesn't anybody do meta-analysis at all anymore? For goodness sake, I learned the power of the word, 'Meta' , by reading Slashdot!

-FL

PeerGuardian == scareware

[crondata]

The chances that this is peergaurdian forging exotic sources of port scans in order to scare users into relying on their software VS. The chances that said sources would waste effort scanning a simpleton's home use windows box for vulnerable ports without masking their identity. Now taking bets! Together with the previous submission "Re: Kids think E-Mail is dead" gives me a distinct impression that Zonk is one of the simpletons himself. Who in this world cares what a child's opinion is re: email ? It is a time tested and infinitely usable communication path, regardless of a silly child's opinion. Might as well submit that most mature, rational thinkers hold that SMS is a fad, which is just as obvious an opinion as the former. Give me some news that matters! Tell me someone is forging a new SMTP implementation that will stop email and it's spam from becoming any more of a network burden. Please tell me it's happening!

big deal

[boshans]

I started up my peerguardian after reading this article. Within 1 minute, I had peerguardian block requests from china, mexico, and a few random companies. I am running windows xp also.

Maybe hes just being probed by botnets

[Paul Johnson]

Why assume that the owners of the domains are behind this? Isn't it more likely that their computers are pwned by bot-herders and these are probes coming from botnets seeking to spread?

Paul.

whois for IP addresses

[wolftone]

In the interest of checking, a simple whois request on 34.60.236.180 does in fact come up with the Halliburton Company of Houston, TX. Similarly, a whois for 55.2.86.54 shows the US Army.

I don't know if MS is actually selling out to the US military or to Halliburton, but if the screenshots are doctored, they are, at least well researched.

Check out the whois records for 34.60.236.180 and 55.2.86.54 yourself.

Absolutely

[ta bu shi da yu]

If I could score you higher than 5, I would.

Re:What Vista version? What software? What?!

[man_ls]

Internet-facing applications written in an ASP.net language are called as .dlls on occasion.

POSTing to http://sqm.microsoft.com/sqm/windows/sqmserver.dll means it's sending some data to a web application on that port, and it's getting a 403 back. Pretend that it's called sqmserver.php or sqmserver.cgi if that'd help clarify it a bit.

Bad article, even worse user comments.

[pjr.cc]

I swear i had to look at the date to make sure i hadn't slept until the next april fools day.

But, to everyone who's sitting there going "oh thats crap! what is slashdot doing?" remember you have a bit of a say in that too! So dont just sit there blaming slashdot, help fix the problem...

Re:Bad article, even worse user comments.

[adavidw]

But, to everyone who's sitting there going "oh thats crap! what is slashdot doing?" remember you have a bit of a say in that too! So dont just sit there blaming slashdot, help fix the problem...

How exactly can I help? How do I have a say? I've been saying that Zonk needs to be fired for at least a year now, and he's still here. So, tell me again how I can actually help fix the problem?

Re:Bad article, even worse user comments.

[TheAwfulTruth]

yeah, uh... how?

Where is the moderation for the article or better yet, the editor?!?!?

All we can do is rate each other into oblivion, /. should allow us to do the same to them if they had any balls. Article rating -5 Pure Drivel, editor rating -5 Ineffective. It should have dissapeard from the front page in minutes where it never belonged in the first place.

This would make a great scary movie.

[Ohreally_factor]

Imagine that he disconnects his LAN from the internet. . . . and keeps getting the DoD traffic!! OMFG!! The DoD is hiding somewhere in his house! Probably with a big butcher knife or a a hook or one of those chain saws with a silencer that government assassins are now using.

Now what's he doing? No, you FOOL! Don't go into the server closet!!!

uhm...

[My Name Is Neo]

# nmap -sS -D 64.233.167.99,66.35.250.150,63.161.169.137 localhost

Oh crap, I'm being hacked by the whitehouse, google, AND slashdot?!

...
06:16:48.365581 IP www.whitehouse.gov.63143 > localhost.http: tcp 0
06:16:48.365676 IP py-in-f99.google.com.63143 > localhost.129: tcp 0
06:16:48.365708 IP slashdot.org.63143 > localhost.129: tcp 0
...

this article shows /. has poor editorial controls

[Anonymous Coward]

as other posters have pointed out, Slashdot is sliding down a slippery slope here, and i'm afraid it will get even worse...

editorial quality demands quality editorial control, and Slashdot doesn't have it for a number of reasons:

1. unwillingness to spend money on professional, qualified editors

2. inability to hire qualified editors (not Slashdot's fault, but due to a bigger problem in the educational system, more specifically communications and journalism departments at the collegiate level)

3. skewed weltanschauung due to the age, reliqious, political beliefs of the editors

4. lack of journalistic integrity, objectivity, and ability on part of the current editors

5. burn-out of founding editorial contributors and controllers

- and most likely many others... but the fact remains:

SOMEONE IS ASLEEP AT THE WHEEL! WAKE THE _ _ _ _ UP!

Priceless

[Anonymous Coward]

Windows Vista: $199
Website: $10/mo
Posting half-arsed FUD and including your IP at the same time: Priceless

Screenshot -> Destination -> D'oh!

To everyone bashing SlashDot for article...

[Anonymous Coward]

What do you expect? You KNOW why it's been posted despite being complete BS.

It makes Vista look bad so it's ok to post it without any sort of reality check.

Sorta sounds like Dan Rather...

And I agree..SlashDot is becoming more and more worthless - between 95% of the posts being comedian wannabes and the just silly ass 'news' articles, it's time to find somewhere else to read.

No, sir, it is you who is full of shit of a bull.

[SyncNine]

No, sir, I call BS on your post. If you'd ever installed Windows Server 2003, you'd know the following:

1) Firewall defaults to ON out of the box on a default install UNLESS you're installing it into an existing domain with a DC GPO that forces it to off. (read: if so, you set it up that way, stfu)
2) Machine does not allow incoming connections until you close the Manage Your Server dialog. It brings this fact to your attention no less than 3 times during the initial setup. (read: after first boot, OS configuration, server type setup, domain creation, role assignment, windows update -- unless you close the dialog without doing that, in which case, again, your fault, stfu)
3) Machine really does not want to allow incoming connections until you complete a Windows Update and does make you click OK about 3 times to enable incoming connections.
4) Did I yet mention that you have to explicitly close a dialog that says 'No Incoming Connections are allowed until you close this dialog.' before it will allow incoming connections? I wanted to make sure I mentioned that.

So, no. I've never, ever installed Windows 2003 Server and 'accidentally' had a network cable installed, only to find that within 45 seconds it was crippled, and neither have you, because it's not possible unless you personally clicked 'yes, allow incoming connections to my unpatched, non-updated machine, and hey, while you're at it, let me open firewall.cpl (or the firewall control panel applet for you non command-line users) and disable the firewall'. See, because that's what you would have had to have done to create a situation that could exhibit those results, in case you weren't aware. I am, because I've installed Windows Server 2003, and all flavors thereof, no less than 100 times.

Thanks for playing, game over.

Holy Crap Its true!!!

[Aerook]

Anyone running vista, it's true! After a few hours of playing some games (mostly America's Army) and some brief web browsing (FAFSA information mostly), I found that there were TONS of connections going in and out of government IPs...OMGWTF!?!?!

Re:Holy Crap Its true!!!

[-kevin-]

well at least you were playing America's Army...lol what do you expect?

Try tracerouting the source IPs.

[Lee Cremeans]

Someone on another forum was complaining about this same thing, so I ran good ol' traceroute on the IPs.

Result: unroutable past the first or second hop.

These are obviously forgeries generated by a portscanning program using info from ARIN; the addresses don't even have to be connected to anything, they just have to belong to a scary-looking government organisation (and if they were real, they'd route over the Internet at least as far as that agency's firewall).

-lee

Re:Try tracerouting the source IPs.

[Anonymous Coward]

i totally agree. at the same time, i have seen windowz do all sorts of spooky stuff. for example, we did a secure installation of nt machines in a protected facility.
this was in the days of isdn. well, our nt machines promptly started trying to contact microsoft and darpa. we got a four thousand dollar dsl bill delivered in different boxes. these were nt machines with nothing on them at all.

the people who know about this stuff are the router folks.... cisco, etc. they knew all about our nt machines behavior and sent us the patch for our routers right away.

so while there are a lot of legit explanations for what this story got started on;

i wouldn't trust vista further than i can throw it.

Reflections

[huckamania]

The reason he is getting packets from these networks could be because these networks are under attack, not the other way around. Surely someone, somewhere is dossing Haliburton and DoD servers and they are probably using phony return addresses. Maybe they list their targets and spoofed addresses and generate an attack for each or maybe they're running mulitple scripts and their random IP generator isn't the first part.

There were some studies done about the amount of collateral traffic generated by dos attacks and it turns out to be quite a bit.

The interwebs were built on a foundation of trust, which is a goodness for everyone.

lol...

[Anonymous Coward]

Easy there fan boy.

Slashdot Community

[KingCZAR]

You know, if it werent for the slashdot community, this place would be a desolate wasteland of information. I have seen so many attention grabbing headlines on here lately, with commentors giving 1k times more facts (with sources) than anything the originial content served up. Bigs ups to the community....

Re:No, sir, it is you who is full of shit of a bul

[HiThere]

He's probably just using an older version of the software. Such complaints were common around here a few years ago...and if that's when your CDs date from, the problem will still exist on them.

My MS CDs date from 1995-98, and *I* sure wouldn't install them while attached to a network! (Where Debian potato, of a somewhat later vintage, would give me no qualms. But there was a time when Linux installs were also wide-open not only during installation, but until fixed by a knowledgeable user.)

In the US Armed Forces

[Anonymous Coward]

The PX hacks you!

Re:No, sir, it is you who is full of shit of a bul

[Anonymous Coward]

Your Windows Server 2003 CDs date from '95 to '98?
Man, you are 1337!

Re:No, sir, it is you who is full of shit of a bul

[bensode]

Actually, Windows Server 2003 SP0 has no firewall -- you get that with SP1 or R2 versions. So tone down your pwnt rant it's obvious you have not installed all flavors thereof and the ink on your MS cert must still be wet. To be perfectly clear here, let's go to the source, Microsoft. I've pasted the important bits after the link. No need to believe me, just google "introduction of firewall Windows server 2003".

http://www.microsoft.com/technet/community/columns /cableguy/cg1204.mspx

Differences in Default Behavior for Windows Firewall
Windows Server 2003 SP1 includes Windows Firewall, which works the same way as Windows Firewall in Windows XP SP2. However, because the purpose of a server computer is to accept incoming unsolicited traffic, Windows Firewall for Windows Server 2003 SP1 is disabled by default.

The exception to this behavior is the following: for a new installation of Windows Server 2003 that already includes SP1 (known as a slipstream installation), Windows Firewall is enabled by default for the duration of the Post-Setup Security Updates, a portion of the initial setup of the server computer in which the latest security fixes are downloaded and installed from Windows Update and Automatic Updates are configured. After the Post-Setup Security Updates is complete, Windows Firewall is disabled. If you do not want the Post-Setup Security Updates, you can use the Unattend.txt file or Group Policy to configure Windows Firewall settings. The Post-Setup Security Updates does not occur if there are configured Windows Firewall settings.

You can enable Windows Firewall on a computer running Windows Server 2003 with SP1 manually using the Windows Firewall component of Control Panel, through Group Policy settings as described in Deploying Windows Firewall Settings for Microsoft Windows XP with Service Pack 2, or you can use the new Security Configuration Wizard in Windows Server 2003 SP1. The Security Configuration Wizard is the recommended method to enable and configure Windows Firewall and other security settings on computers running Windows Server 2003 with SP1.

Maybe a little late, but not 100% false

[socz]

I run torrent clients on a few OS', but it wasn't until someone recommended "peer guardian" that i checked it out, or even cared about incoming traffic related to it. I kinda freaked out at first when i started seeing gov't agencies, but since then don't care!

For those who don't run windows, torrents and or peer guardian, peer guardian basically blocks incoming connections from undesired sources. It is not only for P2P purposes, but for all network connections.

With 4 main options, something like government blocks, spyware, edu's and blacklisted P2P hosts, you can block out those who would likely trace you and find out your downloading the latest movie! You can also allow or deny new hosts on a needed basis.

It's pretty good for what it does, but is a hassle to use continually. My experience with it on an XP machine is that there are a lot of sites i want that are blocked. I can't really think of any off the top of my head but, there are a lot. I think hotmail might have been one that refused to come up, while gmail had no problems

I too also get boat loads of random "blocks" of hosts trying to connect, which i know is because of torrents. When i have no torrent activity, my connection is nice and idle with nothing out of the normal. Fire up a torrent and a client and BAM, so much traffic that i don't bother logging because it is mostly unimportant and i just don't care.

Finally, in this case, it doesn't matter what OS you run, if you run certain torrents then you will get this barrage of blocked hosts with PG. So vista, xp or even BSD/Linux, will get the same traffic with the same types of torrents.

Like i told people in some forums who say "you won't get caught with this stuff," i haven't been caught without it :P

So obvious it can't be true?

[Vitriol Angst]

While I think there should be a lot more independent testing before making too much hay of this,

the kind of logic that states; "the evidence is too obvious to be considered evidence" is really troubling me. What happens if most of the public has this mentality? I think we can look at recent US events to figure that out.

"Why would they have an identifiable URL?" That is not a critique. There are a lot of people in prison right now, because they did some very bone-headed things. If you do a LOT of crime, you are more and more likely to be tripped up by a bone-headed move.

"How can you have a conspiracy with people involved?"

"Why does everyone talk about this, with something this big, everyone would know."

>> There is a kind of dangerous acceptance of the status quo -- as bad as the "everything is a conspiracy" big foot crowd (apologies if we do one day find Big Foot), that is unable to accept the obvious -- because the conclusion is unacceptable. Why would Haliburton be linked to by a P2P by the way? Evil company that has been found guilty of defrauding the American taxpayer of $20 Billion and moved to Dubai, involved in an effort to spy on everyone's computers? Preposterous! The mere fact that there are so many accusations of wrong-doing makes it impossible that they are guilty.

Excellent!

[Gr8Apes]

I wish I had a mod point today, you deserve it.

Re:No, sir, it is you who is full of shit of a bul

[beckerist]

Windows 2003 with no service pack, and the instance where I was receiving the viruses was when I was at college on Internet2 with a completely open connection.

I kept getting the sasser virus, most specifically, and had to constantly run the "shutdown -a" command in start > run or it would restart in a minute.

I promise I wasn't trolling, I was really just saying "I understand!"

...so yeah, chill man!

Wow

[dynomitejj]

Computers were much more fun when you actually had to know something about computers to use them.

so...

[mythandros]

...why don't we set up a honey pot? I don't have the technical know-how but I'd be more than happy to help out in any way I can.

Yes, the article is a troll, and

[tommy_traceroute]

holy shit did it bring out the MS astroturfers. Educational if for no other reason than to see who's who.