Slashdot Mirror
US Government Checking Up On Vista Users?
Paris The Pirate writes "This article at Whitedust displays some very interesting logs from Vista showing connections to the DoD Information Networking Center, United Nations Development program and the Halliburton Company; for no reason other than the machine was running Vista. From the article 'After running Vista for only a few days — with a complete love for the new platform the first sign of trouble erupted. I began noticing latency on my home network connection — so I booted my port sniffing software and networking tools to see what was happening. What I found was foundation shaking. The two images below show graphical depictions of what has and IS trying to connect to my computer even in an idle state'."
The DOD NIC runs one of the DNS root servers. Yes, that's right... his DNS requests are sometimes going to the Department of Defense! Burn the government down.
The machine running the peer guardian is an XP machine. It is sniffing traffic on the local network and filtering out all the results that don't originate from the vista machine. He is running remote desktop from the Vista machine to the XP machine (the one running Peer Guardian). He probably did this because of the issues that software has with Vista, or possible because he feels that Vista would hide this information from programs running locally.
Or P2P. But, the important part is that he is showing nothing more than incoming frames, and conveniently obscures the destination port(s).
And to even get to the point where PeerGuardian (or whatever) can see the frame, it has to pass through his firewall -- presuming that he has one. And that means he either is explicitly allowing that port through or he made the connection himself.
I wonder what Task Manager would show running?
this is just normal scans that everyone gets all the time. nothing to do with having vista installed.
Isn't this inbound stuff? Isn't this the same crap that ZoneAlarm blocks for me constantly?
1. It shows an RDP from Vista to XP.
2. There is a version that is working on Vista. However it is command line only right now, the GUI is not done.
3. I am sure a lot of people will be monitoring now. This guy just noticed increased traffic from suspicious organizations AFTER he installed Vista. Did you see all of the Vista code? Do you know what info Vista sends and to whom?
It sounds like you are trying to apologize for MS. This sounds just like the crap MS would do. All these connection attempts weren't there in XP. "Upgrade" to Vista and now all kinds of "terrorist" scans are taking place? What the hell is Haliburton doing scans for? This seem more than a coincidence to me.
General, you are listening to a machine! Do the world a favor and don't act like one.
indeed. When I was running Peer Gaurdian, I got DOD requests all the time in XP. This is a non-story
Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
Bah! You get that with any computer on a open network. Spambots, torrent clients and what not... Halliburton has botnet infected PC's too. Oh my!
No info on his network setup or for that matter what other boxes on the network might be running.
Well PeerGuardian doesn't run on Vista, so that's probably why he RDP'd to it.
Though what I can't figure out is why he didn't use actual port sniffing software like WireShark. I call bullshit on this lame post.
(A)bort, (R)etry, (I)gnore?_
I actually did contract test work at Microsoft, testing a Vista component that used the network.
So I ran its networking through a seperate machine that ran ethereal, and studied the logs in great detail. I also watched for any 'privacy issues'. Basically, anytime Vista 'phones home' it's required to be by the user Opt-In, and never as a default. If you didn't read the EULA/Privacy Policy, etc. and just kept hitting 'I Agree', 'Accept' and 'Next' every dialog... you might get some things you didn't expect
say you visit a HTTPS url... aside from what actually appears on the page (content + ads) you may need: the digital certificates for the signing authority, revocation lists, accurate time, to check for expiration, DNS, Sytle Sheets, DTDs... a lot of that can be cached, but at some point they may be automatically downloaded.
Playing a (non-DRM) song?, you may get the album information automatically.
Plus all the non-MS software 'phoning home', Adobe Acrobat reader, Quicktime Updater, HP printer drivers, anti-virus updates, *Peer Guardian blocklist updates*
As for the incoming connections mentioned in the article, it seems well within Homeland Securities domain to scan for botnet and such infected machines, in order to defend against DOS attacks on critical infrastructure (like root DNS servers).
I once did a Google search for 'attrs' using Firefox on a Linux box. What popped up was a box asking me to accept a Department of Defense digital signature, served from a DOD server.
why? Google had suggested I was looking for 'atrrs' which was a DOD term, and Firefox tried to pre-load the first result, which was a DOD run website, which popped up the certificate from a site I did not intend to visit! If there is a conspiracy, then Google, Mozilla, and Slackware are in on it.
Actually, yes, a lot of inbound connections like the ones he showed are a smoking gun for ownage. There are only two explanations that cover it on a network like his:
/.ed and they pulled it, it could be that he took so much shit for it that he decided, he'd be better off retreating from the field. Whatever the cause, that does not undermine the basic concept that if his claims were true and not just something he made up, then the two most reasonable explanations for what he saw both involve P2P; the only question between them is whether it was voluntary P2P or involuntary P2P (ownage).
1) You are running P2P stuff knowingly and are too lacking in knowledge to figure out that that's what your packet sniffer is showing you; I did note in my post that this may be regular P2P stuff
2) You have an owned box. Anybody involved even slightly with botnet research can tell you this. As I already stated, P2P is the state of the art in botnets. If a person is not running BT or any other P2P apps, and yet we see a lot of connections on his network that can only be reasonably explained by P2P activity, then they can also be reasonably explained only by one or more owned hosts on the network.
As to why the original post is gone, it could be b/c it was BS and they pulled it, it could be because it was
No, sir, I call BS on your post. If you'd ever installed Windows Server 2003, you'd know the following:
1) Firewall defaults to ON out of the box on a default install UNLESS you're installing it into an existing domain with a DC GPO that forces it to off. (read: if so, you set it up that way, stfu)
2) Machine does not allow incoming connections until you close the Manage Your Server dialog. It brings this fact to your attention no less than 3 times during the initial setup. (read: after first boot, OS configuration, server type setup, domain creation, role assignment, windows update -- unless you close the dialog without doing that, in which case, again, your fault, stfu)
3) Machine really does not want to allow incoming connections until you complete a Windows Update and does make you click OK about 3 times to enable incoming connections.
4) Did I yet mention that you have to explicitly close a dialog that says 'No Incoming Connections are allowed until you close this dialog.' before it will allow incoming connections? I wanted to make sure I mentioned that.
So, no. I've never, ever installed Windows 2003 Server and 'accidentally' had a network cable installed, only to find that within 45 seconds it was crippled, and neither have you, because it's not possible unless you personally clicked 'yes, allow incoming connections to my unpatched, non-updated machine, and hey, while you're at it, let me open firewall.cpl (or the firewall control panel applet for you non command-line users) and disable the firewall'. See, because that's what you would have had to have done to create a situation that could exhibit those results, in case you weren't aware. I am, because I've installed Windows Server 2003, and all flavors thereof, no less than 100 times.
Thanks for playing, game over.
To the darkened skies once more, and ever onward.
http://www.microsoft.com/technet/community/column
"Keep at least 3-6 full bottles of hard alcohol on hand, a 2 week resignation notice,..." - Poetmatt