Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com
To: cygwin AT cygwin DOT com
From: =?ISO-8859-1?Q?Ren=E9_Berber?= <rberber AT prodigy DOT net DOT mx>
Subject:  Re: Someone was banging on my sshd despite NAT
Date:  Thu, 22 Sep 2005 19:14:30 -0500
Lines: 32
Message-ID: <dgvhd6$vlj$1@sea.gmane.org>
References:  <f5b3bnw3cub DOT fsf AT erasmus DOT inf DOT ed DOT ac DOT uk>
Mime-Version:  1.0
Content-Type:  text/plain; charset=ISO-8859-1
Content-Transfer-Encoding:  quoted-printable
User-Agent: Mozilla Thunderbird 1.0.2 (Windows/20050317)
In-Reply-To: <f5b3bnw3cub.fsf@erasmus.inf.ed.ac.uk>
OpenPGP: url=ldap://keyserver.pgp.com
X-IsSubscribed: yes

Henry S. Thompson wrote:

> This evening I noticed my network load was sky-high even though I
> wasn't doing anything.  Turns out IP address 62.65.180.243 was banging
> on port 22, causing a new sshd process every few seconds.  Bizarre
> thing is that the machine in question, running cygwin on top of XP
> SP2, is on a local net which is only NATed out to the internet via my
> broadband modem and ISP.
>=20
> A) How could this happen at all?
> B) Anyone else heard of/seen anything like this?

A very common event.

> I'm asking on this list because as far as my tired brain can tell,
> this must be a complicated Windows+cygwin exploit. . .

There is no such exploit.

Your question is how did they get to your firewalled PC, the answer is that=
 you
must have port forwarding enabled on your firewall and port 22 is one of the
forwarded ports.  Check your modem and Windows firewall, both are allowing =
this
to happen... well, if you have sshd running you probably configured Windows=
 XP
firewall to allow that connection, so you should only check your modem.

HTH
--=20
Ren=E9 Berber


--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/