Hacked!!! Port 1080 Exploit!

[mcb]

Yesterday we were hacked via the socks port (1080) used by Wingate. There were 3 sets of IP ranges that made it inside and were trying to send out spam. Luckily Symantec Enterprise AV stopped it. I blackholed the IP ranges for the attackers and the mayhem has stopped for now.

But at this point i am still unsure how the attackers made it inside. How would i determine this? Every attack was on the external adapter of the Wingate machine and all were directed to port 1080. The firewall settings were fairly brief and i saw no more settings to tweak there.

How does Wingate use port 1080? Can i block it altogether if my service ports are mapped (25, 80, 110 etc.)?

Anyone who has to deal with this type of exploit please lend me your observations. I am new to Wingate, so i am still getting used to the ways of a proxy server.

Thanks,

Matt

[labull]

Matt,

If you're not using Socks you could just disable the service.

That should take care of it.

What version are you using?

Larry

[mcb]

Thanks for your reply. I did go ahead and disable that service. This internal IP is still continuing to try to contact port 1080. I went ahead and blocked port 1080 for all LAN and WAN computers.

I guess what concerns me most is that a machine on our internal network is exhibiting such suspect behaviour. And right around the time we had a documented intrusion. We use Symantec Enterprise AV and nothing has shown up in subsequent scans.

As for Wingate we use 5.2.2. I have been trying to upgrade to 6.0.1, but everytime i do, communication with our mail server gets blocked. We use straight through mapping to accomplish this, so it has been a mystery to techs why we get this problem.

I do think my bases are covered as far as an exploit on this particular port. But i am still uneasy since i don't know how these guys made it in unsolicited past the firewall. Wingate was serving them as if they were internal network machines until I blackholed their IP ranges.

Thanks again for your help.

Matt

[labull]

6.0.2 is out. Here's one of the fixes

15. Changed the default behavior of adapter detection, so that now an adapter with a private IP and a default gateway will now show as Internal.

Don't know if that fixes your problem but you might give it a try!

Larry

[controlair]

Thanks for your reply. I did go ahead and disable that service. This internal IP is still continuing to try to contact port 1080. I went ahead and blocked port 1080 for all LAN and WAN computers.

I guess what concerns me most is that a machine on our internal network is exhibiting such suspect behaviour. And right around the time we had a documented intrusion. We use Symantec Enterprise AV and nothing has shown up in subsequent scans.

As for Wingate we use 5.2.2. I have been trying to upgrade to 6.0.1, but everytime i do, communication with our mail server gets blocked. We use straight through mapping to accomplish this, so it has been a mystery to techs why we get this problem.

I do think my bases are covered as far as an exploit on this particular port. But i am still uneasy since i don't know how these guys made it in unsolicited past the firewall. Wingate was serving them as if they were internal network machines until I blackholed their IP ranges.

Thanks again for your help.

Matt

were you able to determine what internal machine it was and what software/service is attempting to remote? could have been a spyware/filesharing app with a backdoor. i doubt its a virus/trojan or your NAVCE would have taken care of business

[adrien]

Actually use of port 1080 is quite common, and not necessarily suspicious.

apps like ICQ, or even Internet Explorer (if configured to use a SOCKS server in its proxy configuration) will use SOCKS.

However it would definitely be a really bad idea to have your SOCKS server in WinGate available to users on the Internet.

This must have meant that port 1080 was open for connections from the Internet?

Your SOCKS server logs should show who was connecting.

If it was closed, what type of Internet connection do you use, and how does the WinGate machine connect to it?

Adrien