Strange TCP traffic on Mac OS X from 'rdmd'

Question

I noticed some curious traffic today on my MBP after running lsof. It seemed that a process called rdmd had begun 3 TCP sessions:

rdmd      85842        0    9u  IPv4 0xca0e547f0a118fdb      0t0  TCP *:6103 (LISTEN)
rdmd      85842        0   10u  IPv4 0xca0e547f0bc57fdb      0t0  TCP *:6102 (LISTEN)
rdmd      85842        0   11u  IPv4 0xca0e547f09fae7c3      0t0  TCP <my IP>:53854->87.106.252.92:80 (ESTABLISHED)

So I did a trace on this, and it turned up a server in Germany, with the domain name onlinehome-server.info. Being a *.info domain, I was immediately curious and a little suspicious.

I could find very little on rdmd other than that it seems to be a remote desktop daemon from http://www.rdmplus.com. Seeing that I use SSH and VNC to connect in, and Microsoft Remote Desktop to connect out (to my work computer), I was more suspicious. I used ipfw to block the destination IP.

Once I had blocked that IP, it jumped to another:

rdmd      85842        0    9u  IPv4 0xca0e547f0a118fdb      0t0  TCP *:6103 (LISTEN)
rdmd      85842        0   10u  IPv4 0xca0e547f0bc57fdb      0t0  TCP *:6102 (LISTEN)
rdmd      85842        0   11u  IPv4 0xca0e547f09fae7c3      0t0  TCP <my IP>:61160->174.142.192.238:80 (ESTABLISHED)

This connected to http://gate0.rdmplus.com. My final step was to mv the rdm.plist from the LaunchDaemons and reboot. This stopped the service altogether, but I'm still curious to see what the heck is going on here. Is it part of something sinister like a botnet? Or is it a harmless daemon with a suspicious IP?

Here's a simple tcpdump of some of the traffic:

tcpdump: listening on en0, link-type EN10MB (Ethernet), capture size 65535 bytes
12:51:17.538318 IP (tos 0x0, ttl 47, id 30095, offset 0, flags [DF], proto TCP (6), length 128)
    gate0.rdmplus.com.http > IP.61160: Flags [P.], cksum 0x9779 (correct), seq 1022260935:1022261011, ack 3551030806, win  [nop,nop,TS val 1218571792 ecr 694294462], length 76
12:51:17.538503 IP (tos 0x0, ttl 64, id 27262, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 0 (->9cff)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [.], cksum 0x336d (incorrect -> 0x522e), seq 1, ack 76, win 8187, options [nol 694324287 ecr 1218571792], length 0
12:51:17.538843 IP (tos 0x0, ttl 64, id 39635, offset 0, flags [DF], proto TCP (6), length 144, bad cksum 0 (->6c4e)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [P.], cksum 0x33c9 (incorrect -> 0xe2de), seq 1:93, ack 76, win 8192, optionsS val 694324287 ecr 1218571792], length 92
12:51:17.685359 IP (tos 0x0, ttl 47, id 30096, offset 0, flags [DF], proto TCP (6), length 52)
    gate0.rdmplus.com.http > IP.61160: Flags [.], cksum 0x716b (correct), seq 76, ack 93, win 62, options [nop,nop,TS val ecr 694324287], length 0
12:51:47.611136 IP (tos 0x0, ttl 47, id 30097, offset 0, flags [DF], proto TCP (6), length 128)
    gate0.rdmplus.com.http > IP.61160: Flags [P.], cksum 0x4049 (correct), seq 76:152, ack 93, win 62, options [nop,nop,TS9310 ecr 694324287], length 76
12:51:47.611334 IP (tos 0x0, ttl 64, id 41442, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 0 (->659b)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [.], cksum 0x336d (incorrect -> 0xbf4a), seq 93, ack 152, win 8187, options [val 694354204 ecr 1218579310], length 0
12:51:47.611677 IP (tos 0x0, ttl 64, id 55520, offset 0, flags [DF], proto TCP (6), length 145, bad cksum 0 (->2e40)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [P.], cksum 0x33ca (incorrect -> 0x8596), seq 93:186, ack 152, win 8192, optip,TS val 694354204 ecr 1218579310], length 93
12:51:47.731531 IP (tos 0x0, ttl 47, id 30098, offset 0, flags [DF], proto TCP (6), length 52)
    gate0.rdmplus.com.http > IP.61160: Flags [.], cksum 0xde8c (correct), seq 152, ack 186, win 62, options [nop,nop,TS va0 ecr 694354204], length 0
12:52:17.681946 IP (tos 0x0, ttl 47, id 30099, offset 0, flags [DF], proto TCP (6), length 128)
    gate0.rdmplus.com.http > IP.61160: Flags [P.], cksum 0xabfb (correct), seq 152:228, ack 186, win 62, options [nop,nop,586827 ecr 694354204], length 76
12:52:17.682142 IP (tos 0x0, ttl 64, id 24008, offset 0, flags [DF], proto TCP (6), length 52, bad cksum 0 (->a9b5)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [.], cksum 0x336d (incorrect -> 0x2c7a), seq 186, ack 228, win 8187, options  val 694384102 ecr 1218586827], length 0
12:52:17.682487 IP (tos 0x0, ttl 64, id 39886, offset 0, flags [DF], proto TCP (6), length 145, bad cksum 0 (->6b52)!)
    IP.61160 > gate0.rdmplus.com.http: Flags [P.], cksum 0x33ca (incorrect -> 0xecca), seq 186:279, ack 228, win 8192, optop,TS val 694384102 ecr 1218586827], length 93
12:52:17.806169 IP (tos 0x0, ttl 47, id 30100, offset 0, flags [DF], proto TCP (6), length 52)
    gate0.rdmplus.com.http > IP.61160: Flags [.], cksum 0x4bbb (correct), seq 228, ack 279, win 62, options [nop,nop,TS va8 ecr 694384102], length 0

Maybe I'm being completely paranoid. I have the startup daemon script saved, so if it turns out to be something harmless I can put it back. I'd just prefer to know where this came from and where it's going to! Any help is much appreciated!

Answer 1

Question I have for you is, did you install it (RDMPlus) anywhere (your phone, work, etc)? Normally, with applications like this, when you connect, most applications are mere proxies between your two locations. For example, TeamViewer, whenever you install it, your logs will show what may appear to be strange connections to be interpreted. This is because the connection actually works like this:

YourMachine --> Team Viewer Resources (IPs teamviewer uses) --> YourDestination

As opposed to:

YourMachine --> Direct connection to machine running TeamViewer

The BIGGER question I have that you either skipped on, or didn't clarify is/was: "How did rdmplus get on your machine?" When you state that you use SSH, VNC, and Remote Desktop to get in and out of your machines, did you install rdmplus at all? If not, then begin with determining WHEN it was installed, and HOW it was installed.

ls -ltha `which rdmd`

Now, your tcpdump output shows that this rdmd is connecting to to a webserver via HTTP so technically, if it is http based traffic, then it is not encrypted. Open the capture up in Wireshark, follow TCP stream to see WHAT is leaving your machine:

0   11u  IPv4 0xca0e547f09fae7c3      0t0  TCP <my IP>:53854->87.106.252.92:80 (ESTABLISHED)