|
User #309341 47 posts
Participant
|
So, I ring BigPond Tech Support [who are currently experiencing several outages] & request transfer to BigPonD Security... After a short wait, my consultant Alex tells me that due to "storms", the Security Centre is unavailable...WTF? And I had to ask, where are the storms? All she says is that there are some "overseas" centres & they're currently experiencing severe weather, with "flooding up to the tops of the houses". Vague & detailed. Impressive. "You mean the Phillipines?" I questioned further. I already knew this, I just wanted to hear it again... Unable to advise when the Security Centre would be contactable again, Alex has "promised" to record a note on my account stating that I called to speak with the Security Centre & that my enquiry relates to a possible worm in the network... I'll keep calling every few hours & see if I can get through... R.K. |
posted 2009-Sep-29, 2pm AEST
|
|
User #33281 511 posts
Whirlpool Enthusiast
|
The IP address, goes to what "looks like" a Google page... http://ip-lookup.net/?ip=74.125.5.17 Comes back with it being in the US whois on that page says – Google Inc. as the owner. |
posted 2009-Sep-29, 3pm AEST
|
|
User #309341 47 posts
Participant
|
Thanks MiracleMuz...I appreciate your efforts. A friend emailed me that too & I've checked it all out myself as well, but also said to be extremely wary of the traffic... I've set all my software permissions/safe sites, including Google Updater etc. My firewall always manages to resolve the host name for Google access... I could just be over-paranoid. The other forums really freaked me out. R.K. |
posted 2009-Sep-29, 5pm AEST
|
|
User #85007 1982 posts
Whirlpool Enthusiast
|
whois 74.125.5.17 OrgName: Google Inc. NetRange: 74.125.0.0 – 74.125.255.255 OrgTechHandle: ZG39-ARIN Looks ok! |
posted 2009-Sep-29, 5pm AEST
|
|
User #309341 47 posts
Participant
|
Cheers, tbw! I know, it ALL looks fine... I thought it might of been a Dell thing, I drive an Inspiron, but it has also occurred on a HP that I know of...still unresolved the on HP. If I could find a "reputable" site that said the traffic was ok, I would relax...a bit. The address might be ok. But, could that be faked? Masked? |
posted 2009-Sep-29, 5pm AEST
|
|
User #309341 47 posts
Participant
|
Trawling & I found this on PChelpforum.com; http://www.pchelpforum.com/f =S |
posted 2009-Sep-29, 6pm AEST
|
|
User #309341 47 posts
Participant
|
Still trawling; http://ask-leo.com/what_is_l This seems to be a reasonable explanation. As even in the U.S. users like Leo, have the export version too. *I should also add, the firewall alert was only a green/low-level alert. However, after reviewing the links I have submitted above, what the heck does the IP address for Google.Inc have to do with LSA, an apparently legitimate Windows component?? R.K. |
posted 2009-Sep-29, 6pm AEST
|
|
User #309341 47 posts
Participant
|
After the comments so far, thanks to those that have contributed, I was beginning to feel a bit more at ease. I was thinking about allowing the initial firewall request & thought that this paranoid episode was finally over. So, today I have another alert on my firewall... ----------------------------- Description; Traffic Type; Target Computer; ----------------------------- I understand what LSA does, that part is all cool. I don't really understand why I have never seen these type of alerts before...I've been on the net & using Google for 10years & have used a host of different security suites, I have never seen these before. Back to the initial alert, for a moment... Then today, LSA itself has tried to connect via HTTP with that same IP address? Why? Is it checking up on me? R.K. Slighly Off-Topic, I had to give search.encarta.com permission to update via FTP this arvo, so my firewall is definitely very active & that makes me very happy. I'm a bit of a security freak. lol |
posted 2009-Oct-1, 10pm AEST
|
|
User #309341 47 posts
Participant
|
Is it in any way possible & I'm talking absolute worst case scenario, that the IP address was spoofed & that responding to the incoming TCP request would launch some sort of SYN flood* against Google? [Assuming I was NOT the only one who received such a request, of course!] I only ask because I do try to stay up to date with the goings on in the cyber-community & I am aware of the recent large-scale attacks on many popular sites like Google, Facebook, Twitter etc. I've been back through my firewall settings & I already have already allowed Google Installer [GoogleUpdate.exe]... |
posted 2009-Oct-1, 11pm AEST
|
|
User #218381 84 posts
Forum Regular
|
I would find that highly doubtful since to start a TCP connection there needs to be a three way handshake between the client and server (IIRC it goes: SYN-SENT, SYN-ACK (From Your Computer), SYN-ACK (From the server)) If say the attacker wants to attach google in this fashon, they would send a TCP packet to you SYN-SENT. They would mask their IP with the google IP. When your computer recieves the first packet (SYN-SENT), it will send back a SYN-ACK pack packet, but since the google server has no record of sending the SYN-SENT packet to your IP, they it would just disreguard the SYN-ACK packet |
posted 2009-Oct-1, 11pm AEST
edited 2009-Oct-1, 11pm AEST
|