[northeast] Log From My Router - I'm Curious and Concerned in Verizon Fiber Optics

[northeast] Log From My Router - I'm Curious and Concerned in Verizon Fiber Optics http://www.dslreports.com/forum/r18394416 en Tue, 09 Feb 2010 13:55:55 EDT Tue, 09 Feb 2010 13:55:55 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18415919 somebodeez :

said by jvanbrecht

:

I stand corrected, I just logged into my router.. and it was updated.. I did not initiate it, and actually, I have a number of explicit firewall rules denying all inbound traffic.. time to start poking through the firmware code.....

This is rather disconcerting....

Wow :o

Mine still says FW version 4.0.16.1.45.160.
I wonder why some have been changed and others have not?

Disconcerting indeed!]]> http://www.dslreports.com/forum/remark,18415919 Tue, 29 May 2007 19:21:43 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18415474 jvanbrecht : I stand corrected, I just logged into my router.. and it was updated.. I did not initiate it, and actually, I have a number of explicit firewall rules denying all inbound traffic.. time to start poking through the firmware code.....

This is rather disconcerting....]]> http://www.dslreports.com/forum/remark,18415474 Tue, 29 May 2007 17:50:41 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18414209 somebodeez :

said by ProFiOSDude

:

That's you...Web-Based Management. The reason for 0.0.0.0 is that the change did not occur from a WAN-based IP.

PFD

Thanks again, ProFiOSDude! You've been right here with me through this whole thing. :)
I'm afraid I'm still some what confused about this.

When I do change something, the logs show that I'm the one who did (admin).
If 0.0.0.0 means that the change didn't come from a WAN-based IP, and if *I* didn't do it - who did and what and how?]]> http://www.dslreports.com/forum/remark,18414209 Tue, 29 May 2007 14:10:36 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18414192 somebodeez : Thanks, jvanbrecht. I'm always grateful for any wisdom & advice I can get. :)

There's a couple of threads discussing whether Verizon is pushing updates to the Ationtec routers. Here's one:
»Actiontec 4.0.16.1.45.160
and here's a post in another thread about it:
»Re: .160 Change summary

A note about that - mine doesn't appear to have been changed.

Back to my router logs - it sure would be nice if they quit with the cryptic code stuff and just show what the heck it all means. If it's just a ping - can't they just have the router logs say so ? :p ;)]]> http://www.dslreports.com/forum/remark,18414192 Tue, 29 May 2007 14:05:42 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18414069 ProFiOSDude : That's you...Web-Based Management. The reason for 0.0.0.0 is that the change did not occur from a WAN-based IP.

PFD]]> http://www.dslreports.com/forum/remark,18414069 Tue, 29 May 2007 13:39:38 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18414050 ProFiOSDude : That's you...Web-Based Menu

PFD]]> http://www.dslreports.com/forum/remark,18414050 Tue, 29 May 2007 13:36:11 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18413964 jvanbrecht : As far as I know, Verizon does not push any updates to the actiontec routers. However, I believe the default config for the router is to query for updated firmware at specified intervals. As for the ICMP you are seeing.. welcome to the internet, you will find that there is alot of traffic that is automated by worms and other malicious traffic, scanning for vulnerable hosts (I am a snr network security engineer, I deal with this crap all the time), keep your systems patched, deny all inbound traffic and you should be fine. Do not use remote admin services like gotomypc.com. Do not setup VNC or other remote admin applications and use port forwarding. And you should be fine. If you have a requirement to connect back to any of your hosts within your network, setup the actiontec as a bridge (there is a how to here on that), and utilize a real firewall. ]]> http://www.dslreports.com/forum/remark,18413964 Tue, 29 May 2007 13:20:35 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18413911 somebodeez :

said by cmthru

:

I'd also like to know about this mysterious WBM user unknown business. The log shows changes being made when I know that I'm not using the PC or anyone else is connected. A number of the entries are being recorded overnight.

Well, at least I'm not the only one with this!

I did some searches but was only able to find this and it wasn't very helpful to me:
»tinyurl.com/2vomwj
Cisco says WBM stands for "Web-Based Management".
I'm assuming that means how we access the router through a web browser.
That doesn't help me understand about Unknown though and how is he able to change security settings.

I went all through my settings and couldn't detect anything different from what I have specified myself. I wonder if it could have anything to do with Verizon being able to push the router's firmware (as reported by some)?]]> http://www.dslreports.com/forum/remark,18413911 Tue, 29 May 2007 13:08:40 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18413602 cmthru : I'd also like to know about this mysterious WBM user unknown business. The log shows changes being made when I know that I'm not using the PC or anyone else is connected. A number of the entries are being recorded overnight.

I though I had blocked all remote access yet I can still easily access the router from my wireless laptop.]]> http://www.dslreports.com/forum/remark,18413602 Tue, 29 May 2007 12:05:15 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18413126 somebodeez : Thanks, cdru :)

Now can anyone tell me about this "Configuration change - WBM user unknown has changed security settings" entry?]]> http://www.dslreports.com/forum/remark,18413126 Tue, 29 May 2007 10:33:28 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18412827 cdru :

said by somebodeez

:

Thanks for your reply. :)
Sorry for being a dense-head but what indicates that those are just ping requests?

Your not being dense. You just don't know. Where it says "ICMP Type 8". Type 8 indicates a ICMP echo request. This is some other computer saying "knock knock anyone home". If your computer was listening and wanted to reply, it would send a Type 0 response that would say "Yeah, I'm here".
--
Go Colts]]> http://www.dslreports.com/forum/remark,18412827 Tue, 29 May 2007 09:12:48 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18412758 somebodeez :

said by cdru

said by somebodeez

:

No more green Remote Admin entries though. :)

In case you didn't know, it looks like the majority of the blocked "remote admin" entires were just ping requests. Not exactly remote admin.

Thanks for your reply. :)
Sorry for being a dense-head but what indicates that those are just ping requests?]]> http://www.dslreports.com/forum/remark,18412758 Tue, 29 May 2007 08:45:13 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18412628 cdru :

said by somebodeez

:

No more green Remote Admin entries though. :)

In case you didn't know, it looks like the majority of the blocked "remote admin" entires were just ping requests. Not exactly remote admin.
--
Go Colts]]> http://www.dslreports.com/forum/remark,18412628 Tue, 29 May 2007 08:05:41 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18412572 somebodeez :

said by ProFiOSDude

:

That was before he reset the router...didn't see any followup regarding that...

PFD

Sorry for taking so long to follow up. I reset the logs and wanted to wait a day or 2 and see what the entries would be like now.

The dates are still sometimes screwy I see. I don't know what's up with that.

In this screen shot, you can see that entry about the user unknown.
No more green Remote Admin entries though. :)

BTW, Level 3 responded to my email the same day saying
"This message is to inform you that
the information you have provided us is being used to investigate this matter
and we will address the issue according to our Acceptable Use Policy."

I sure appreciate your time, analysis and advice!

]]> http://www.dslreports.com/forum/remark,18412572 Tue, 29 May 2007 07:44:59 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18412520 somebodeez :

said by rtcy

:

he did say there's a entry about new settings accepted, does it show a address as who did the change? it should and I hope it's within his house or else......something is open

Yes, in the first screen shot you can see 2 green colored "Accepted Remote Administration" entries w/IP 166.68.134.174 using the 4567 port that's open by default.

I've got that port closed now and I don't see any more green "Accepted Remote Administration" entries.

However I do still see one (not colored green or red)that I'm curious about. It says:

"Firewall Setup Configuration change WBM user Unknown (0.0.0.0) has changed security settings". (doesn't list an IP)

When I log into the router, it says "WBM Login User authentication success Username: admin" and I know (hopefully!) that's me.

]]> http://www.dslreports.com/forum/remark,18412520 Tue, 29 May 2007 07:08:44 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18409453 ProFiOSDude : That was before he reset the router...didn't see any followup regarding that...

PFD]]> http://www.dslreports.com/forum/remark,18409453 Mon, 28 May 2007 15:36:59 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18409002 rtcy :

said by ProFiOSDude

:

Same thing that happens to all of us...general curiosity. People go fishing for all kinds of stuff. If most people looked at their logs they'd see their routers firewall doing what it's supposed to be doing...just like yours.

PFD

he did say there's a entry about new settings accepted, does it show a address as who did the change? it should and I hope it's within his house or else......something is open]]> http://www.dslreports.com/forum/remark,18409002 Mon, 28 May 2007 14:14:07 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18408995 rtcy :

said by ProFiOSDude

:

I'd email that to abuse@level3.com

PFD

I;m glad you noticed that the 4.x block was sold to level 3 and NOT a chinese location]]> http://www.dslreports.com/forum/remark,18408995 Mon, 28 May 2007 14:12:08 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18398952 ProFiOSDude : Same thing that happens to all of us...general curiosity. People go fishing for all kinds of stuff. If most people looked at their logs they'd see their routers firewall doing what it's supposed to be doing...just like yours.

PFD]]> http://www.dslreports.com/forum/remark,18398952 Sat, 26 May 2007 11:33:33 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18398707 somebodeez :

said by ProFiOSDude

:

I'd email that to abuse@level3.com

PFD

Thank you for your help! I have sent them an email and attached the screenshot.

There's more entries today from other IPs - even Verizon.

What's going on?]]> http://www.dslreports.com/forum/remark,18398707 Sat, 26 May 2007 10:29:08 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18398586 ProFiOSDude : I'd email that to abuse@level3.com

PFD]]> http://www.dslreports.com/forum/remark,18398586 Sat, 26 May 2007 09:48:00 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394841 somebodeez :

said by ProFiOSDude

:

First off, you are blocking traffic that has not yet occurred. It's May 25th throughout the FiOS footprint and the latest possible time as of my post is 14:40:05 Those entries are from tomorrow. Reset your router and get you clock straight first.

PFD

Whoa I didn't even notice that.
I logged back in and took another look at the security log. Latest entry now dated May 25 13:46:48 2007 ect.
The only thing I did after posting was to close that port that's open by default.

That's odd.

]]> http://www.dslreports.com/forum/remark,18394841 Fri, 25 May 2007 13:55:44 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394815 ProFiOSDude : The majority of those attempts were from China, or have IP's that ARIN says are from China. The successful one (socket-designated) points to your ISP.

PFD]]> http://www.dslreports.com/forum/remark,18394815 Fri, 25 May 2007 13:49:39 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394762 ProFiOSDude : First off, you are blocking traffic that has not yet occurred. It's May 25th throughout the FiOS footprint and the latest possible time as of my post is 14:40:05 Those entries are from tomorrow. Reset your router and get you clock straight first.

PFD]]> http://www.dslreports.com/forum/remark,18394762 Fri, 25 May 2007 13:40:12 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394609 somebodeez : This is a screen of my router's Remote Administration page. I don't have anything selected. This means that Remote Administration isn't activated, yes? (fingers crossed)

]]> http://www.dslreports.com/forum/remark,18394609 Fri, 25 May 2007 13:10:13 EDT Re: [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394502 WileEC : nevermind]]> http://www.dslreports.com/forum/remark,18394502 Fri, 25 May 2007 12:47:52 EDT [northeast] Log From My Router - I'm Curious and Concerned http://www.dslreports.com/forum/remark,18394416 somebodeez : There are a lot of red "Blocked - Remote Administration" entries (a lot more than what is visible in my screen shot), 2 green "Accepted Remote Administration" entries :o and 1 "WBM unknown has changed security settings" :o.

I'm curious about what all of these entries may mean and concerned that there may be something going on that's not good and wondering if there are some security settings I should take care of?

Edit:
I have that default open port closed now.

]]> http://www.dslreports.com/forum/remark,18394416 Fri, 25 May 2007 12:34:33 EDT