Topic: Intruder access XP workstations behind e-smith

[timb]

Hi,
I have just returned home from this one, not had long to look at it.

Scenario
E-smith server/gateway, XP Pro clients in various states of patch - please no flames - it will be all patched in the next 24 hours.

It's probably not an e-smith problem but...
The XP clients are being remotely controlled.

All I have had time for is a quick virus scan - none, and to check that the XP remote access is disabled and it IS.

This has only started today.

[gzartman]

First, I'd highly suggest that we discontinue this thread and you email your concerns here:

security@lists.contribs.org

Talking about security related issues in a public venue is typically not a good thing.

It's probably not an e-smith problem but...
The XP clients are being remotely controlled.

What makes you think that?  Having a client being "remotely controlled" is really a fairly rare thing to have happen, especially behind a firewall.

In event, it sounds like you have some strangeness going on.  Here what I'd do:

1. If you don't already have a GOOD AV scanner, then buy one.  Install it and update the definitions.

2. Download and install Ad-Aware from lavasoft: http://www.lavasoftusa.com/software/adaware/

3. Disconnect your sys from the network and run a system wide AV scan.

4. Run a system wide ad-aware scan.

5. Disable any apps that you might have installed that actively communicate across the internet (e.g, MSN messanger, Trillian, etc, etc,)

6. Hook your sys back up to the network, and reboot.

7. When the sys comes back up, don't open ANY apps.

8. Run the command "netstat" from a command prompt and look at the output.  Netstat reports all current network related connections, both LAN and WAN.  Look at ever line that netstat reports and try to determine where it's coming from.

Good luck.

Greg Zartman

[timb]

It turns out the intruder well....

40metres YES 40 METRES away in the same company building there was a blue M$ wireless mouse, it had a birthday on the morning the fault occured, and it recieved two new batteries.

It then proceeded to interfere with 2 other M$ mice of the 3 in the building. It seems that each time it was moved near the LCD power cable it would radiate into the mains building wiring and then effect the mice of workstations up to 40 Metres away.

I know you dont believe this. The client didnt either - I had to stage elaborate demos to prove it. I have about 5 witnesses.

The network was secure all along - I knew it would be. Thats why Greg Z I posted here to start with.

Trouble was that the mouse movements looked deliberate because all screens were running the same app (MYOB) and the actions on the offending workstation was being repeated on two others - depending on how near the mouse was to the power cable.

Dont I get some sort of prize for this?

[thedude]

I've been in the computer networking industry for over 10 years and I've never heard of anything like that before, and I've heard some strange sh*t