Well, I made the adjustments to the router. UPnP was active, so I disabled that.<div><br></div><div>Karl, my setup was as you described. I would remote to her box via her outside IP address</div><div>via a given port number. That port was forwarded to her reserved internal IP address for her</div>
<div>machine on that port.</div><div><br></div><div>I did have remote desk-top enabled on her machine, but it required a password of eight</div><div>characters (alpha/numeric, random, not "dictionary" stuff). It seems to me that I changed</div>
<div>the default port used for that too; the one that forwarded to her machine via the router.</div><div><br></div><div>That's why I was confused as to how someone could remote to her machine on a port</div><div>that was not forwarded through the router to her machine specifically.</div>
<div><br></div><div>But, like I said, I'm self-taught and sort of new to this networking stuff. VERY green behind</div><div>the ears! Being that I cut my teeth on the linux boxes, I try to think "security" as much</div>
<div>as my amount of knowledge allows.</div><div><br></div><div>Thanks for the help and your patience in my lack of knowledge!! I'll check her router log</div><div>tonight and see of the "shinnanigans" are still there.</div>
<div><br></div><div>Cheers!</div><div><br></div><div>J.Neveau</div><div><br></div><div><br><br><div class="gmail_quote">On Fri, Mar 2, 2012 at 1:59 AM, Richard Houser <span dir="ltr"><<a href="mailto:rick@divinesymphony.net">rick@divinesymphony.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">J,<br>
<br>
As long as the connection isn't established and the attempts aren't<br>
enough to cause a DOS effect, you shouldn't be concerned.<br>
<br>
Many home routers will just let you brute force password attempts<br>
until you get it. Those that implement meager IP-based blackout<br>
periods are still vulnerable to anyone with access to many IPs. I<br>
recommend you keep the remote access disabled on the router unless you<br>
can restrict the access using a strong key. For example, I run<br>
OpenWRT and just disable password logins to dropbear.<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
On Thu, Mar 1, 2012 at 11:47 PM, STeve Andre' <<a href="mailto:andres@msu.edu">andres@msu.edu</a>> wrote:<br>
> It's important to understand that people get scanned by "script<br>
> kiddies" all the time, on public networks. ALL THE TIME. My<br>
> boss had something like Zone Alarm on his Windows machine<br>
> and was equally fascinated and horrified at the number of<br>
> things his machine was exposed to.<br>
><br>
> The few times I've looked at my own Comcast connection I<br>
> saw at least 5 an hour, and sometimes some little twerp<br>
> would develop an inordinate fondness for me, and bombard<br>
> me with useless logins, malformed http GETS and so on.<br>
><br>
> While its not good to let your guard down, log file entries<br>
> quickly start looking like noise, which 99.8%+, they are.<br>
><br>
> --STeve Andre'<br>
><br>
><br>
> On 03/01/12 17:38, Karl Schuttler wrote:<br>
>><br>
>> Port 5900 is vnc (remote access, as you noticed). The 70.x.x.x ip you<br>
>> mentioned is registered to <a href="http://THEPLANET.COM" target="_blank">THEPLANET.COM</a> INTERNET SERVICES in Dallas,<br>
>> TX. Feel free to send me the log and i'll take a look. You might<br>
>> consider reaching out to ThePlanet.com and asking them about the<br>
>> incident; they might have a security breach. I would call them over<br>
>> the phone, but you could certainly email. The 140.x.x.x address<br>
>> belongs to National Chung Cheng University in Taiwan.<br>
>><br>
>> It would seem that they shouldn't be able to access her computer, from<br>
>> your description of the network setup; perhaps it isnt functioning as<br>
>> you intended.<br>
>><br>
>><br>
>> On Thu, Mar 1, 2012 at 5:16 PM, J Neveau<<a href="mailto:neveauj@gmail.com">neveauj@gmail.com</a>> wrote:<br>
>>><br>
>>> Could someone in the group with network guru skills help me out? I was<br>
>>> perusing my Mom's router log today and saw something that concerned me.<br>
>>><br>
>>> The log shows:<br>
>>><br>
>>> [LAN access from remote] from <a href="http://70.86.214.138:48659" target="_blank">70.86.214.138:48659</a> to <a href="http://192.168.1.3:5900" target="_blank">192.168.1.3:5900</a><br>
>>> Thursday, Mar 01,2012 08:06:39<br>
>>><br>
>>> and<br>
>>><br>
>>> [LAN access from remote] from <a href="http://140.123.103.148:45214" target="_blank">140.123.103.148:45214</a> to <a href="http://192.168.1.3:5900" target="_blank">192.168.1.3:5900</a><br>
>>> Wednesday, Feb 29,2012 6:31:46<br>
>>><br>
>>> Both of those lines show up a number of times over the past couple weeks.<br>
>>><br>
>>> I'm concerned, as my Mom is 80 years old and (hopefully) didn't download<br>
>>> anything malicious that is allowing port 5900 to be used on her OS. She<br>
>>> is<br>
>>> using Linux Mint and I've been keeping it up to date on updates through<br>
>>> it's<br>
>>> synaptic application. (version 10.something if I recall correctly)<br>
>>><br>
>>> I have a PDF file of the entire log if anyone would be kind enough to<br>
>>> look<br>
>>> at it.<br>
>>><br>
>>> I had her router set up for remote management so that I could log in to<br>
>>> deal<br>
>>> with issues. I had it assigned to a selected port number for admin of<br>
>>> the<br>
>>> router. I also had the DHCP reserve that IP address to her machine so I<br>
>>> could remote admin her operating system if she had any issues; it was<br>
>>> port<br>
>>> forwarded to a selected port (different than the router log-in; NOT port<br>
>>> 5900) for that purpose as well.<br>
>>><br>
>>> For the time being, I've disabled the remote log-in function until I can<br>
>>> get<br>
>>> this surveyed by those more knowledgeable. I will have physical access<br>
>>> to<br>
>>> her machine for the next week, so if any additional diagnoses is needed,<br>
>>> I'll be happy to forward that information to the group.<br>
>>><br>
>>> Any help is greatly appreciated!<br>
>>><br>
>>> J.Neveau<br>
>>><br>
><br>
> _______________________________________________<br>
> linux-user mailing list<br>
> <a href="mailto:linux-user@egr.msu.edu">linux-user@egr.msu.edu</a><br>
> <a href="http://mailman.egr.msu.edu/mailman/listinfo/linux-user" target="_blank">http://mailman.egr.msu.edu/mailman/listinfo/linux-user</a><br>
_______________________________________________<br>
linux-user mailing list<br>
<a href="mailto:linux-user@egr.msu.edu">linux-user@egr.msu.edu</a><br>
<a href="http://mailman.egr.msu.edu/mailman/listinfo/linux-user" target="_blank">http://mailman.egr.msu.edu/mailman/listinfo/linux-user</a><br>
</div></div></blockquote></div><br></div>