Snort logs showing bad traffic orig. from localhost

**Outlaw** · 08-17-2003, 08:59 PM

Not sure what this means. Been happening for couple days non stop. I know that sometimes you can scan someone and make it look like its from their own box in the logs. But this happens every three to 15 min +. This is the latest version of IPCop with latest patches. Can someone shed some light?

Code:

Date:   08/17 00:34:10    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1097
References:   none found   SID:    528
Date:   08/17 00:34:43    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1857
References:   none found   SID:    528
Date:   08/17 00:37:13    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1204
References:   none found   SID:    528
Date:   08/17 00:56:38    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1178
References:   none found   SID:    528
Date:   08/17 00:56:54    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1674
References:   none found   SID:    528
Date:   08/17 00:58:38    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1910
References:   none found   SID:    528
Date:   08/17 00:58:55    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1174
References:   none found   SID:    528
Date:   08/17 00:59:28    Name:   BAD TRAFFIC loopback traffic
Priority:   2    Type:   Potentially Bad Traffic
IP info:    127.0.0.1:80 -&gt; 68.0.29.39:1934
References:   none found   SID:    528

**10Dedfish** · 08-18-2003, 12:15 PM

Radar,
I found this by doing a google on SID 528. This is an excerpt from geocrawler that came up.

FROM: WarchildDATE: 02/15/2002 17:46:10SUBJECT: [Snort-sigs] SID 528
Rule:
alert ip any any <> 127.0.0.0/8 any (msg:"BAD TRAFFIC loopback
traffic"; classtype:bad-unknown; sid:528; rev:2

--
Sid:
528

--
Summary:
Loopback (aka, "localhost&quot

traffic was detected on your listening
interface.

--
Impact:
Possible ACL bypass, DOS attempt, system recon.

--
Detailed Information:
Traffic destined-to/coming-from the loopback interface (127.0.0.1/8)
was detected.

--
Attack Scenarios:
As part of a possibly more intense attack, an attacker may attempt to
deny a legitimate system of service by spoofing loopback traffic.
This may give an attacker more information about system
(mis)configurations. This loopback traffic may appear as semi-legit
traffic, whereas other cases may bring fragmented, out-of-band, and
malformed traffic.

In the best case, this may simply be a system misconfiguration as
opposed to a potential hostile attack.

--
Ease of Attack:
Fairly trivial if elevated system privledges are obtained. Packets
can easily be crafted to have a source/destination IP resembling the
loopback. The difficulty is finding situations where loopback traffic
is not properly filtered.

--
False Positives:
None, so long as you are not running snort on the loopback interface.

--
False Negatives:
None.

--
Corrective Action:
Apply proper ingress/egress filtering at all areas of your network.

Hope this helps,
10ded

**Outlaw** · 08-18-2003, 02:41 PM

Thanks 10Dedfish, yeah in IPCop that 528 you see is a link to a similar explanation as you found on Snort's website. I just don't know how to determine if its a misconfigured network device or is someone probing me and spoofing the ip. It seems to try different ports. I shall keep searching.

**10Dedfish** · 08-18-2003, 10:24 PM

I would keep track of the different ports that its trying. If it is the same ones again and again then I wouldnt worry about it. If it isnt then i would start to worry.

10ded