Re: Interactive/Content Filling Email - Port 8200

--- Michael Clark <[email protected]> wrote:

> We have recieved a couple of emails where content is
> filled in after the email is opened. The original
> content is filled in using 8200/TCP (from
> 66.151.158.177). Any ideas? 

Michael;

First, a simple 'host' lookup reveals:

   host 66.151.158.177
   177.158.151.66.in-addr.arpa domain name pointer
   poll.gotomypc.com.

Now we know this hostname belongs to 'gotomypc.com'.
This is essentially a way for users to totally
avoid the firewall and reach their PC from outside.

Many corporate/government IT policies forbid such
techniques and actually block gotomypc addresses
at the firewall, but some believe this is a secure
way for smaller organizations to provide outside
access to internal systems.

Then we find they have at least one class-C network:

   whois -h whois.arin.net 66.151.158.177
   Internap Network Services PNAP-06-2001
   (NET-66-150-0-0-1) 66.150.0.0-66.151.255.255
   Expertcity PNAP-SJE-EXPERT-RM-02
   (NET-66-151-158-0-1)
   66.151.158.0-66.151.158.255

The emails you mentioned are quite likely part of
the connection registration process for the PC's
of the users who got them.

It's up to your organization to decide on whether
to regulate or allow such traffic from gotomypc.

=====



		
__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Easier than ever with enhanced search. Learn more.
http://info.mail.yahoo.com/mail_250
_______________________________________________
Intrusions mailing list
[email protected]
http://www.dshield.org/mailman/listinfo/intrusions