1

I had a security engineer analyze a packet capture from my machine.

About five IPs were used in an attack. It was the only IP (6) that was detected multiple times by VirusTotal.

The IP is 209.197.3.8. Four months ago, this IP was a Microsoft update site. This engineer said this is a fake Microsoft site. Of course, he also knows that the IP is CDN.

Another engineer says this is the official Microsoft site. When I run Windows Update, the packet capture showed the 209.197.3.8.

Is it possible for a hacker to hide behind a CDN called 209.197.3.8, spoof and attack?

Improve this question
2
  • What do you mean "attack?" Can you be more specific? There are many kinds of attacks.
    – John Wu
    May 22 at 6:41
  • the attack mean Unauthorized access. A type of malware is a Trojan horse.
    – john-trmb
    May 22 at 7:13

1 Answer 1

Reset to default
1

Yes, anyone can set up a malicous website, use a CDN, and wait for incoming connections from whatever malware they have configured to reach out to this website.

If someone knew that Windows Update used the CDN and used the same IP in the past, they could set it up to use the same IP and the malware to coincide with updates, and doing so could look like the traffic was Update traffic.

But none of this is "spoofing" and none of this is an "attack". The trojan has already been installed and it's just connected "home" using a known IP for resources and instructions. The "attack" happened when you got the trojan. All this focus (across your 2 questions) on this one IP is like analysing the paint colour of a missile. The paint isn't the important part. The part that goes "boom" (i.e. the trojan) is the important part.

And all of this assumes that this IP is part of a trojan and not just normal traffic. I think you are trying to prove you have a trojan by trying to prove that this IP is malicious. That's backwards. You can't prove something is a missile by its colour.

Improve this answer
2
  • Are you saying the Trojan is on my computer because I said I have it, not because 209.197.3.8 is there? How can I see the hacker's IP address hidden by the CDN?
    – john-trmb
    May 23 at 7:31
  • You said you have a trojan. I can only go by the facts you provided. If you don't know that you have a trojan then both of these questions are utterly meaningless. I explained about the attacker's IP in the other question... Remember the whole thing about a "chain"? Look, if this IP is a CDN, then you can't determine anything from the IP alone.
    – schroeder ♦
    May 23 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .