Possible Airport Hack:

Question

Possible Airport Hack:

A few nights ago, my little snitch app prompted me to let me know my apple airport extreme 802.11n base station was trying to connect to:

64.212.198.115
OrgName: Global Crossing
OrgID: GBLX
Address: 14605 South 50th Street
City: Phoenix
StateProv: AZ
PostalCode: 85044-6471
Country: US

If you need more info about the little snitch application:

http://www.obdev.at/products/littlesnitch/index.html

I created a rule in little snitch to deny access on this IP for any port, forever. Naturally, this made me a little paranoid since that has never happened before, even though I've been using little snitch for years. The next night, I went out to dinner and when I came back my airport utility app was open and said it was successful at reconfiguring something. I yanked the power plug for the router and airport...which was probably stupid because I probably should have investigated further before doing something so severe. At this point I plugged everything back in and reset the airport to it's default factory settings & all of a sudden it's trying to connect to several more IP's:

204.2.160.113
OrgName: NTT America, Inc.
OrgID: NTTAM-1
Address: 8005 South Chester Street
Address: Suite 200
City: Centennial
StateProv: CO
PostalCode: 80112
Country: US

205.177.95.62
OrgName: Beyond The Network America, Inc.
OrgID: BNA-42
Address: 520 Herndon Parkway
Address: Suite E
City: Herndon
StateProv: VA
PostalCode: 20170
Country: US

I ruled to deny access on all ports, forever, then reset the airport and little snitch several times to factory default settings. (to see if it would try again) The airport utility app still repeatedly tried to connect to these IPs and I denied each one forever. This would happen every time I did a factory reset of little snitch and the airport base station. After that, I unplugged my comcast router and reconfigured my apple g5 with a new password and extra firewall measures. Then I configured the airport with a new wpa/wpa2 password, a closed network and mac addresses. Nothing has happened since...it's been 24 hours as I write this.

So, what is your opinion of this? Shady comcast activity? Random hack? NSA? Your guess is as good as mine. I have a feeling any one of those 3 IPs could be a proxy of some sort.

G5 Quad 4x2.5 ghz 4 gb ram, Mac OS X (10.4.5)

Posted on Oct 20, 2007 10:55 PM

Reply

Answer 1

Oct 21, 2007 6:09 AM in response to Johnny Random

Hi Johnny Random-

I used that program for a short while, but it made me even more paranoid than I already am so I had to stop (:>)

It isn't your AEBS, rather your Mac that is initiating those connections. Otherwise, you would not see anything on the Mac. If I remember correctly, little snitch only reports on outgoing traffic as initiated by the Mac. Have you installed any new software lately?

Was the Mac updating the AEBS firmware? It shouldn't have without your consent.

Did you Google those companies to see what they were about?My gut tells me that it is something fairly benign.

Have you taken a look at the configuration of the FireWall in the AEBS itself? That should be plenty robust enough without adding extra measures.

Luck-

-DaddyPaycheck

Reply

Answer 2

Oct 21, 2007 10:40 AM in response to DaddyPaycheck

*Global Crossings* and *NTT America* both operate high speed/long haul fiber optic networks that are part of the internet backbone.

Reply

Answer 3

Oct 21, 2007 10:51 AM in response to Johnny Random

Is it possible you've installed a couple of extra dashboard widgets that are sending out requests for information? Perhaps you've got one that shows flight times or currency exchange rates etc.

Reply

Answer 4

Oct 21, 2007 11:34 AM in response to DaddyPaycheck

I'm not sure if it was something on my g5 trying to bust out or someone from the outside trying to bust in and reconfigure something to send out. All of my software is up to date, so it wasn't that. I did google the companies, but they seem like dead ends. I'm actually wondering if the answer is in my logs somewhere. Do you know a good place to look for this info? The configuration before was pretty robust...it was wpa/wpa2. I only added the other measures once the strange IPs started trying to bust out.

Reply

Answer 5

Oct 21, 2007 11:41 AM in response to Rodney Culling

Hi Rodney...

It wasn't widgets. They all have specific rules I've set under little snitch + none of them were activated over the past week since I haven't initiated the dashboard to pop up. When little snitch detects these, it's very clear: "such and such widget wants to connect to such and such IP". This started out as "Airport utility wants to connect to such and such IP"...without that app being opened. Btw, I got Symantec Virus Scan 10 last night and ran a scan on all 2 tb of my internal hard drives: Not a single thing. Zippo on software trying to phone home too, since little snitch identifies the app immediately + the only thing I've installed recently was Logic 8 Studio.

Reply