Detect Suspicious Incoming Connections lazarus / 38-Networking and Web Programming ---------------------------------------------------------------------- Aruna · 2024-12-19 04:19 Hello, I've recently observed a sudden and significant increase in my system's load average at random intervals. To ensure that no one is attempting unauthorized access, I would like to create a simple program that binds to port 80. Ideally, the program should also be expandable to check other common ports, such as 21, 22, 23, 25, 53, 443, and others. Does anyone have a simple code example that uses sockets? I prefer not to rely on external dependencies if possible. Thank you. ---------------------------------------------------------------------- vfclists · 2024-12-19 10:22 What operating system? ---------------------------------------------------------------------- Thaddy · 2024-12-19 10:27 Quote from: vfclists on December 19, 2024, 11:22:24 amWhat operating system? Unless you were living about 200+ years ago, you would know about: https://en.wikipedia.org/wiki/Berkeley_sockets I see what I can do. Quite simple actually.If you need to detect, that' s too late... ---------------------------------------------------------------------- Aruna · 2024-12-19 10:43 Quote from: vfclists on December 19, 2024, 11:22:24 amWhat operating system? Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i aruna@debian:~$ lsb_release -aNo LSB modules are available.Distributor ID: DebianDescription:    Debian GNU/Linux 11 (bullseye)Release:      11Codename:       bullseyeCode: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i aruna@debian:~$ uname -aLinux debian 6.11.5-lazarus #1 SMP PREEMPT_DYNAMIC Mon Oct 28 13:28:43 EDT 2024 x86_64 GNU/Linuxaruna@debian:~$ ---------------------------------------------------------------------- marcov · 2024-12-19 12:45 For ports under 1024, you would run the program with root rights probably. Do you really want your first programs open possible root vulnerabilities on the internet ? In short: use the Linux firewall, or an IDS like Snort ---------------------------------------------------------------------- MarkMLl · 2024-12-19 13:42 Quote from: marcov on December 19, 2024, 01:45:15 pmFor ports under 1024, you would run the program with root rights probably. Do you really want your first programs open possible root vulnerabilities on the internet ? In short: use the Linux firewall, or an IDS like Snort Broadly agreed, but the way to deal with this is to use tcpdump+BPF to log incoming traffic. If you really /do/ want to hook your own program onto a low-numbered port then give it the appropriate POSIX capability. MarkMLl ---------------------------------------------------------------------- Aruna · 2024-12-19 15:22 Quote from: marcov on December 19, 2024, 01:45:15 pmFor ports under 1024, you would run the program with root rights probably.I was thinking of using setcap? Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i sudo setcap 'cap_net_bind_service=+ep' /path/to/your_program Quote from: marcov on December 19, 2024, 01:45:15 pmDo you really want your first programs open possible root vulnerabilities on the internet ? No I do not and imho the only system out there that is not vulnerable is one that is not connected to the internet Quote from: marcov on December 19, 2024, 01:45:15 pmIn short: use the Linux firewall, or an IDS like Snort @marcov, that is a zillion rule-sets aargh! No thanks! ---------------------------------------------------------------------- Aruna · 2024-12-19 15:24 Quote from: MarkMLl on December 19, 2024, 02:42:45 pmQuote from: marcov on December 19, 2024, 01:45:15 pmFor ports under 1024, you would run the program with root rights probably. Do you really want your first programs open possible root vulnerabilities on the internet ? In short: use the Linux firewall, or an IDS like Snort Broadly agreed, but the way to deal with this is to use tcpdump+BPF to log incoming traffic. If you really /do/ want to hook your own program onto a low-numbered port then give it the appropriate POSIX capability. MarkMLl Hello @MarkMLI, pray teach me how one goes about doing that? I am somewhat familiar with tcpdump (no expert though) and am yet to use BPF. Would you have any code I can take a look at please? ---------------------------------------------------------------------- Aruna · 2024-12-19 16:29 Quote from: Thaddy on December 19, 2024, 11:27:46 amQuote from: vfclists on December 19, 2024, 11:22:24 amWhat operating system? Unless you were living about 200+ years ago, you would know about: https://en.wikipedia.org/wiki/Berkeley_sockets Hi @Thaddy, have a heart man that was a legit question the guy wanted to know which OS because both Windows and *nix have sockets as far as I know. Have you any idea how discouraging and demotivating that can be to someone who is simply trying to help? Not everyone has been around the block more than a couple of times like you have  Quote from: Thaddy on December 19, 2024, 11:27:46 amI see what I can do. Quite simple actually.If you need to detect, that' s too late...   I put together a little something and quite to my surprise it works (but not for port 80 yet, maybe you or someone else can fix that?) I am attaching a zip that has the full working source code. To test the zip. First unzip then compile and build using Lazarus. Once up and running open up a Terminal and run Code: Text  [Select][+][-]window.onload = function(){var x1 = document.getElementById("main_content_section"); if (x1) { var x = document.getElementsByClassName("geshi");for (var i = 0; i telnet 127.0.0.1 5000 and watch the view->debug windows->console in/out window. The attached screenshot shows the progress made so far. ---------------------------------------------------------------------- MarkMLl · 2024-12-19 17:39 Quote from: Aruna on December 19, 2024, 04:24:38 pm Hello @MarkMLI, pray teach me how one goes about doing that? I am somewhat familiar with tcpdump (no expert though) and am yet to use BPF. Would you have any code I can take a look at please? [/quote] See the manpage and note the reference to pcap-filter which explains the syntax which is passed to the BPF backend. There's /lots/ of examples in there, the only caveat is that offsets are relative to an index into the packet and some operations move it. MarkMLl ---------------------------------------------------------------------- Thaddy · 2024-12-20 14:38 To whom it is not clear, you detect on the handshake, not on the subsequent traffic. Then you are too late. Malware always chooses weak to strong. If you see weak (like ssl/tls 1.0), drop the connection. I explained that many times and for different scenario's. Proper handshakes goes from strongest to a reasonable fallback. ---------------------------------------------------------------------- Aruna · 2024-12-21 12:24 Quote from: Thaddy on December 20, 2024, 03:38:41 pmTo whom it is not clear, you detect on the handshake, not on the subsequent traffic. Then you are too late. Malware always chooses weak to strong. If you see weak (like ssl/tls 1.0), drop the connection. I explained that many times and for different scenario's. Proper handshakes goes from strongest to a reasonable fallback. Do you have any code that can show me how to do this, please? Or any links to guides and tutorials that show you what to do?