Slashdot Log In
US Government Checking Up On Vista Users?
Posted by
Zonk
on Sun Jul 22, 2007 01:24 PM
from the security-theatre-in-your-home dept.
from the security-theatre-in-your-home dept.
Paris The Pirate writes "This article at Whitedust displays some very interesting logs from Vista showing connections to the DoD Information Networking Center, United Nations Development program and the Halliburton Company; for no reason other than the machine was running Vista. From the article 'After running Vista for only a few days — with a complete love for the new platform the first sign of trouble erupted. I began noticing latency on my home network connection — so I booted my port sniffing software and networking tools to see what was happening. What I found was foundation shaking. The two images below show graphical depictions of what has and IS trying to connect to my computer even in an idle state'."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I call bullshit. (Score:5, Insightful)
1.The screenshots clearly show WinXP, not Vista. In fact, this guy's ultra-leet "port sniffing software and networking tools" is PeerGuardian 2 [phoenixlabs.org]. Straight from the product's home page: Note: PeerGuardian 2 does not support Windows Vista at the moment. This is a top priority, and we hope to have a Vista download soon.
2. Lame screen shots from some Windows app isn't enough to validate a conspiracy theory. Where's the complete traffic dump? And not from some random guy and his "fanboy" friend; how about a creditable network security organization? Hell, I'd even settle for an intern with his CCNA.
3. Hard to tell because all we have are screen shots, but it looks like nothing more than port scans.
(Guess is this is what I get for spending a beautiful Sunday afternoon indoors, on my computer).
Re:I call bullshit. (Score:5, Insightful)
The screenshots also clearly show another computer is involved, since he is remoting from his Vista PC to his Windows PC. Perhaps they are both on the same network, and he has reason to believe that these connections are being caused by having Vista on the network.
Parent
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
I personally would have done it with a Linux machine myself using Ethereal or something reliable. The fact is you cannot trust Vista to report the packets in an unbiased manner. It could theoretically drop these packets before they make it to your OS.
Either way if you set up a ARP spoofing attack on your own network (or have a manag
I doubt it's due to Vista... (Score:5, Interesting)
I mean, hell, 38.100.26.190 (SafeNet / MediaSentry) has been DoSing me with 10 connections/second bursts for ages now because I once clicked the wrong torrent but you don't see me writing Slashdot stories over it.
Parent
Re:I call bullshit. (Score:4, Insightful)
Parent
This would make a great scary movie. (Score:4, Funny)
Now what's he doing? No, you FOOL! Don't go into the server closet!!!
Parent
No, sir, it is you who is full of shit of a bull. (Score:5, Informative)
1) Firewall defaults to ON out of the box on a default install UNLESS you're installing it into an existing domain with a DC GPO that forces it to off. (read: if so, you set it up that way, stfu)
2) Machine does not allow incoming connections until you close the Manage Your Server dialog. It brings this fact to your attention no less than 3 times during the initial setup. (read: after first boot, OS configuration, server type setup, domain creation, role assignment, windows update -- unless you close the dialog without doing that, in which case, again, your fault, stfu)
3) Machine really does not want to allow incoming connections until you complete a Windows Update and does make you click OK about 3 times to enable incoming connections.
4) Did I yet mention that you have to explicitly close a dialog that says 'No Incoming Connections are allowed until you close this dialog.' before it will allow incoming connections? I wanted to make sure I mentioned that.
So, no. I've never, ever installed Windows 2003 Server and 'accidentally' had a network cable installed, only to find that within 45 seconds it was crippled, and neither have you, because it's not possible unless you personally clicked 'yes, allow incoming connections to my unpatched, non-updated machine, and hey, while you're at it, let me open firewall.cpl (or the firewall control panel applet for you non command-line users) and disable the firewall'. See, because that's what you would have had to have done to create a situation that could exhibit those results, in case you weren't aware. I am, because I've installed Windows Server 2003, and all flavors thereof, no less than 100 times.
Thanks for playing, game over.
Parent
Re:No, sir, it is you who is full of shit of a bul (Score:5, Informative)
http://www.microsoft.com/technet/community/column
Parent
Re:I call bullshit. (Score:5, Informative)
Parent
Re: (Score:3, Insightful)
If this guy is doing this internally, why is the remote desktop session showing 192.168.0.1, and the PeerGuardian logs showing a destination of 24.
Re:I call bullshit. (Score:5, Insightful)
PeerGuardian is for blocking *incoming* connections, this has nothing to do with Vista *AT ALL*.
The names that show up against the IP are taken from user submitted rule files(In case you didn't know this is so that IP's from RIAA/MPAA employed companies can be blocked-who log all ip's connected to any torrent as seeds/leeches). There is no validation on the name corresponding to the IP. Complete and utter FUD.
Even the IPs DID correspond to DoD etc.. there is a completely plausible reason for that.
Bit torrent clients cache IP addresses so that they can connect to all the seeds/leeches in case the torrent managing host goes down. All this has proven is that the US Government uses Bit torrent.
Parent
Re:think again (Score:5, Insightful)
Kuwait Ministry of Communications
AAFES/Barracks
Military Medical Academy
And a host of other weird entries. I know I've seen DoD on there before... let's check my older logs:
Federal Electric and Water Authority (WTF?)
Saudi ARAMCO (oil company)
OK, no DoD now, but the point is that weird crap shows up in Peerguardian all the time. DoD entries appear fairly frequently. If this guy's run any P2P software in the last, oh, week or two, that'll cause this to happen.
Parent
Re:I call bullshit. (Score:5, Insightful)
Maybe he's got multiple machines hooked up to a hub, with the XP machine sniffing in promiscuous mode. Maybe he's tunneling the connection through the XP machine. Who knows. While I too am inclined to call BS, the XP argument doesn't fly.
Parent
Re:I call bullshit. (Score:5, Informative)
Or P2P. But, the important part is that he is showing nothing more than incoming frames, and conveniently obscures the destination port(s).
And to even get to the point where PeerGuardian (or whatever) can see the frame, it has to pass through his firewall -- presuming that he has one. And that means he either is explicitly allowing that port through or he made the connection himself.
I wonder what Task Manager would show running?
Parent
Re:I call bullshit. (Score:5, Interesting)
If you look at the screenshots, you can see he's connecting RDP to 192.168.0.1, which is the typical gateway address on most NATs. I think he might actually be running a WinXP box as a firewall. This would explain how he is seeing all of the packets, with the external destination IP. Therefore I wonder if his XP box has just been rooted.
Parent
Re:I call bullshit. (Score:5, Insightful)
Blah how does this make the front page? There are million of reasons for these connections.
Maybe he is using a dynamic ip based isp and he just got a new ip? Maybe the last person who used that ip was using bittorrent? Botnets trying to reconnect to this ip?
Aside from those "Remote Desktop" xp screenshots, I noticed there are Hei Long Jiang education committee, UN Development program, China Edu and Research Network, and whatever.
I guess the DoD and the "Chinese intelligence agency" are both attacking his computer.
UN probably sent some people to infiltrate his computer as well.
Wait, Hei Long Jiang is right next to Russia? Maybe the KGB is using China's network to go after him as well!*roll eyes*
Even if they are not bt, they might just as well be port scans.
News for nerds, indeed.
Parent
Re:I call bullshit. (Score:5, Insightful)
P2P and fast-flux networks is the current cutting edge of botnets, and that fits with all the inbound connections he's seeing.
The explanation that fits best with his experience is that his Vista box has already been owned and has become part of a botnet.
While his conspiracy theory that Microsoft is in bed with DoD, DOHS, and Haliburton (gimme a break!) is clearly anti-MS FUD, there is good reason to draw a bad conclusion about Vista from this. One of Vista's big selling points was better security, yet here we have somebody stepping up front and center with an apparently freshly installed and freshly owned Vista box.
The article doesn't speak well of Vista, but not for the tinfoil hat theory advanced by its author.
The other leading theory, which has been advanced by a number of others, is that he's running bit torrent or another P2P app. This is also plausible, and if the zombie theory is wrong, then the P2P app theory still holds. Bhy far the least likely explanation is the conspiracy theory advanced by the author.
Parent
Re: (Score:3, Insightful)
However, we don't know how much user error was involved.There's always the chance that he was running admin and clicked yes when it asked him whether vista_activation_keygen.exe should be allowed to run with full admin rights...
Re:I call bullshit. (Score:4, Insightful)
I'm afraid I have to agree. The misleading article summaries are bad enough, ranging from being irrelevant to actually implying the opposite of what the articles in question say, but I find it hard to believe the Slashdot editors would really believe the sort of claptrap written in this article. I think the sad reality is that they know it's drivel, but also that it will generate traffic, especially from the nutter contingent, and this, in my view, reflects poorly on their integrity.
Parent
Re:I call bullshit. (Score:5, Insightful)
Actually, my first reaction to this article was "What! The US doesn't need to make connections to spy on me!" With AT&T's big fat pipe to the NSA, the government get's all the data it wants about me, even though I run Ubuntu.
Parent
I'm confused (Score:4, Informative)
Parent
I was going to mod you down... (Score:5, Insightful)
As you'll see in one of the follow-up posts to this parent the software is being run on a second systems (since as you point out Vista isn't supported the listener is XP).
As to the credibility of the rest of the story I suppose that's up for grabs. Or rather reproducibility. Sniffing software is easy enough to install/use. Maybe the poster of the original story is being watched via a government trojan. Maybe there is a backdoor for the government to use to monitor potential criminal. I imagine if ALL Vista systems phoned home like this they'd be drown in data so it's either addition software, activated existing feature or hoax/fluke.
Parent
Re:I call bullshit. (Score:4, Funny)
Parent
Re:I call bullshit. - About Lame Screen Shots (Score:5, Funny)
Parent
Re: (Score:3, Insightful)
If there's no outgoing requests, but just incoming, this is more likely to be cached P2P entries, where the outside hosts are trying to reach a (now gone) peer, be it bittorrent, edonkey, kademlia or whatever.
It would have been very interesting to see
Re: (Score:3, Interesting)
Nah, MS is a typical corporate whore that gives bribe money where ever they can to maximize profits. If you look at their SOFT MONEY DONATIONS [opensecrets.org] from 1998, 81% went to the Republicans.
With the current Democrat control, MS will obviously send more bribe money their way.
PeerGurdian is not a legitimate investigative tool (Score:5, Informative)
Re:PeerGurdian is not a legitimate investigative t (Score:5, Insightful)
Parent
Re:PeerGurdian is not a legitimate investigative t (Score:5, Informative)
Parent
Re:PeerGurdian is not a legitimate investigative t (Score:3, Interesting)
Highly Suspicious to me... (Score:5, Insightful)
Also, "Halliburton"? Give me a break.... First, what type of tool is going to return a text output so blunt... Not is not "HA-39214", but instead is just "Haliburton" the evil company.... Also, I am certainly not a fan of the company and its former involvement with the vice president which just smells bad to begin with, but what in the world would a military contracting company that fufills soft drinks, food, oil, and other supplies to military groups want to monitor computers... This is just unrealistic...
Re: (Score:3, Insightful)
[Querying whois.arin.net]
[whois.arin.net]
OrgName: Halliburton Company
OrgID: HALLIB-1
Address: 10200 Bellaire Blvd
City: Houston
StateProv: TX
PostalCode: 77072-5299
Country: US
NetRange: 34.0.0.0 - 34.255.255.255
CIDR: 34.0.0.0/8
NetName: HALLIBURTON
NetHandle: NET-34-0-0-0-1
and so on. So, yes, it's in Halliburton's IP range. That still does not mean anything, though. PG as a traffic analysis tool is a joke, as others pointed out already. At least he could have dis
Just Vista? (Score:5, Interesting)
I'd like to see a bare install of Vista (legit), with no other programs running, and connection monitoring being done on a router in between the Vista box and the internet, before I will believe this. And I say this as a die-hard Linux user who has barely touched XP.
Connection to or from? (Score:5, Insightful)
Because those are trying to connect TO his computer from the outside, not the other way around.
What a load of bullcrap. Where does
Statistics (Score:5, Insightful)
Re:Statistics (Score:5, Insightful)
As I see it, there are two possibilities:
The first is that the story actually had credibility with Zonk and he was more than happy to put it up. Put Halliburton in a story and the truthers soil themselves. The second; Zonk saw through it like any other technically savy grownup and knew it would be ridiculed. In that case it is a sort of April Fools joke.
Anyhow, there are plenty of reasonable explanations already posted for the 'evidence' provided. Here is one I didn't notice; why would 'they' use easily identified domains to spy on people? 'They' run the world so clearly 'they' could arrange for something less obvious, no?
Finally, is there any recourse for a business that has had it's products publicly slandered? I'd hate to see Microsoft get a piece of
Parent
Halliburton? (Score:3, Insightful)
He's really grasping, isn't he.
You call that a conspiracy? (Score:4, Interesting)
Seriously, though. Worms and botnets are endemic and every organization has boxes probing the internet without their knowledge. Doesn't mean they're out to get you.
I always hated people who would whine about Slashdot story selection, but come on, editors, use a little discretion. You're just helping spread paranoid stupidity.
No Destination Ports (Score:5, Insightful)
My guess is that he's running some P2P software. Guess what? The U.S. Government does get 0w3nD and does have problems with viruses, trojans, and P2P software.
Nothing to see here. Move along....
Worst /. Story Ever? (Score:3, Insightful)
One, he is sniffing with a crappy piece of software that is barely a sniffer. Secondly, unless he has that XP system he claims is a Vista system, monitoring a HUB, not a switch, that the Vista machine's traffic has to go thru, he isn't sniffing anything relevant. Last, this is pointless paranoia.
You want to see more of your "government conspiracy traffic?" Find someone at an ISP to help you, as you will need a piece of public IP address space. Route it to someplace where you can monitor all the traffic destined to it, and plug nothing into that segment of your network. It just has to exist, and be publicly accessible. It goes nowhere, has no devices in it, it just exists. Then turn your sniffer on, and watch the botnet traffic fly by. Yeah, you will see attacks coming from everywhere, nowhere to go, and still they scan like crazy. And yes, you will see it come from DoD address space too, heaven for-fucking-bid.
Oh, and when do your sniffing, use a real sniffing tool. Then you can tell us what kind attacks the scary US government is mounting against its most paranoid citizens.
Linux and Amiga users can be safe... (Score:3, Interesting)
Yawn! (Score:3, Insightful)
Since Windows XP, info from your XP computer is sent out to Microsoft.com - I don't have it, so I can't report much about it, but with a decent firewall installed, many software packages "call home", repeatedly and totally without justification. One does not need to check daily for updates! Adobe on my top list.
And - with the recent court approved installing of a sniffer on a potential suspect's computer - doing non-approved sniffer installs is probably more frequent, not even considering botnets.
It furthers an atmosphere of fear, is not empowering and in short - sucks!
Laughable. (Score:3, Informative)
So I ran its networking through a seperate machine that ran ethereal, and studied the logs in great detail. I also watched for any 'privacy issues'. Basically, anytime Vista 'phones home' it's required to be by the user Opt-In, and never as a default. If you didn't read the EULA/Privacy Policy, etc. and just kept hitting 'I Agree', 'Accept' and 'Next' every dialog... you might get some things you didn't expect
say you visit a HTTPS url... aside from what actually appears on the page (content + ads) you may need: the digital certificates for the signing authority, revocation lists, accurate time, to check for expiration, DNS, Sytle Sheets, DTDs... a lot of that can be cached, but at some point they may be automatically downloaded.
Playing a (non-DRM) song?, you may get the album information automatically.
Plus all the non-MS software 'phoning home', Adobe Acrobat reader, Quicktime Updater, HP printer drivers, anti-virus updates, *Peer Guardian blocklist updates*
As for the incoming connections mentioned in the article, it seems well within Homeland Securities domain to scan for botnet and such infected machines, in order to defend against DOS attacks on critical infrastructure (like root DNS servers).
I once did a Google search for 'attrs' using Firefox on a Linux box. What popped up was a box asking me to accept a Department of Defense digital signature, served from a DOD server.
why? Google had suggested I was looking for 'atrrs' which was a DOD term, and Firefox tried to pre-load the first result, which was a DOD run website, which popped up the certificate from a site I did not intend to visit! If there is a conspiracy, then Google, Mozilla, and Slackware are in on it.
Quality research... (Score:4, Funny)
I'm from a similar underground organization, and have been monitoring Vista for some time. Notable connections we have so far made are:
Dinosauroid-like Alien Reptiles using Vista UMPCs are dominating the World
Apollo 11 Moon Landings were faked by Vista
September 11 was orchestrated by the U. S. government using Vista and Workflow Foundation
etc.
It's pretty conclusive stuff, people.
(Conspiracies kindly provided by http://www.2spare.com/item_43133.aspx [2spare.com] - note it's on an IIS server - don't trust it. The truth is out there!)
Re: (Score:3, Funny)
That's because the FBI installed XP in the middle of the night.
Re:Simple solution (Score:5, Funny)
Parent
Re:I can confirm this (Score:5, Funny)
I work in one of the extraterrestial government agencies not in question, and I can confirm that we have been doing this. To be fair to United States government, they had no choice to let us in. It's been going on for years now. Right here, directly out of our own network, so that any retard with a freeware tcpdump/traceroute frontend can see exactly what they're up to.
PS: this isn't real.
Parent
Mods on crack again. (Score:3, Insightful)
Who modded this dweeb insightful.
Metamoderators please spank these mods.
Not plausible at all (Score:3, Insightful)
Should you trust Vista crypto totally, if you really have something to hide? Probably not.
Would they be as stupid as to let every computer send traffic to DOD computers? Obviously not. Even if most don't know how to monitor traffic, enough do that there would be an immediate uproar.
Possible "hidden features" would either need the system in question (secret keys....) or would be dormant. If turned on by some events, I'