2

My office has two Sonicwall Routers each at a different physical location and with two different ISPs.

There is an SSL-VPN tunnel between the two.

Today I noticed that the same Chinese IP address attempted to connect to the External IP's of both of these devices on coming from the same port.

Source: 61.160.213.108 port 10000 Destination: Each External IP of our SonicWalls and different ports

Any idea's as to how they could know there was relation between the two routers?

1

You're assuming the attacker has knowledge of both devices. The particular address you've listed is no stranger to random attacks. SANS Internet Storm Center lists it, it has appeared on other watch lists as well. One can conclude that this is either part of a botnet or some other automated scanning/hacker/badguy machine.

Botnets, compromised machines, etc., have a tendency to fire off massive amounts of recon scans against numerous amounts of machines. Think about it, if you were an attacker, why wouldn't you leverage one machine to scan many? What these machines do, is scour random, and or defined network blocks, enumerate what is visible, what is not, and pass this at times to other machines to perform the exploitation.

Consider the following:

Attacker Botnet
Recon machine: 61.160.213.108
Exploit machine: 10.10.1.2

Recon machine goes out scours the net for potential victims. When/if it finds them, it usually passes it off to another machine to perform an exploit, or bruteforce attack. In the event you were vigilant and noticed a probe, you could block the Recon Machine, but the reality is, exploit machine will likely partake, or implement the attack.

While you perceive that the Recon Machine knows about your infrastructure, there is a high likelihood the initial probe was random. Then of course there is the alternative. Someone is targeting your network. In the event they were, it is not difficult to obtain information on companies, and the networks associated with them. Consider a random company: ACME, if I were targeting their network, I could use Arin and simply say: "Hey Arin, show me what networks might be associated with ACME" and with that information, I can target each network I find:

ACME WHOIS

There are plenty of ways someone can target you, but my guess is, each network of yours that was found, was likely random.

  • Thanks for your input, that calms my nerves a little bit. After looking at the logs again the first alert was earlier in the day on the lower IP address and the second was about 7 hours later on the higher IP. So this could very well be just a botnet scan. – e_hoog Dec 19 '14 at 14:01
0

One likely possibility is that they were simply scanning all IP addresses for that particular service and hit both of your systems. ZMap claims to be able to scan the entire IPv4 space in under 45 minutes.

  • It does appear that it was likely just a scan of IPs but the destination ports were different and some of the scanned ports in the alerts were slightly different from each other and were not ports I was familiar with any services running on. (First scan - TCP scanned port list, 9393, 8686, 8118, 8585, 9527) AND (Second scan - TCP scanned port list, 9527, 9393, 9797, 8585, 8686) – e_hoog Dec 19 '14 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.