Mac OS X Kernel communication with strange IP address

Question

Level 1

0 points

Mac OS X Kernel communication with strange IP address

I use Little Snitch, and noticed that Mac OS X Kernel was communicating with a bunch of IP addresses. I don't usually have Little Snitch network monitor open and therefore don't look at it that often, but this is the first time that I've seen Mac OS X Kernel appear in the list of programmes sending data out over the internet.

All the IP addresses look very odd; when I use lookup several are returned as "fred.stockton.edu" and for others there is either no information or its nobody recognisable eg, "static-105-44.blueline.mg".

Is this normal, or do I have a virus or some other serious problem that will require major cleaning.

Thanks

iMac G5 (ALS), Mac OS X (10.5.6)

Posted on Apr 23, 2009 9:08 AM

Reply

Answer 1

nerowolfe

Level 6

13,090 points

Apr 23, 2009 10:02 AM in response to groovytrain

Do you use LimeWire or any other bit-torrent file-sharing stuff?

Reply

Answer 2

groovytrain Author

Level 1

0 points

Apr 23, 2009 10:09 AM in response to nerowolfe

No I don't use or have any file sharing software on my computer at all

Reply

Answer 3

Apr 23, 2009 11:04 AM in response to groovytrain

groovytrain,

I've forwarded your post to the sysadmin at Stockton College so he can check out issues from his end.

The blueline.mg domain is greylisted for spam and pr0n.

It is quite possible that your G5 has been either hacked or zombied. There is an active botnet of Macs infected by a Trojan in bittorrent downloaded versions of Adobe CS4 and iLife of, ahem, dubious legality.

Could you post your firewall log so I can see both the domains and ports used?

-Wayne

Reply

Answer 4

groovytrain Author

Level 1

0 points

Apr 23, 2009 12:45 PM in response to ParentalUnit

Thanks Wayne:

Sounds a bit serious that.
How do I post a log file - just paste it into the response?
But I'm not sure it will show much anyway because it's very short, the first line says:

Apr 23 11:00:00 r11hz81 newsyslog[894]: logfile turned over due to size>100K

which I suppose means that it got too big and got cleaned out (this morning), which was just after I noticed the kernel activity, and after which I immediately put a stop on it with Little Snitch. 90% of the entries after that relate to Skype. Apart from that I have no Adobe CS4 or iLife, dubious or otherwise on my system.

Reply

Answer 5

Apr 23, 2009 1:45 PM in response to groovytrain

groovytrain,

Yes. Skype itself makes a huge number of TCP connections.

If you stopped it, then 'Snitch should have a record of the blocked processes and the ports used. Could you post that record instead?

-Wayne

Reply

Answer 6

groovytrain Author

Level 1

0 points

Apr 25, 2009 1:25 AM in response to ParentalUnit

Wayne:

Sorry I didn't get back to you yesterday (got a little busy). However,

(1) I checked the little snitch logs and although there are about 4 logs there is actually nothing in them ?
(2) This morning I tuned LS network monitor on so that it stayed visible and after a while Mac OS X Kernel started communicating again (this is despite the fact that in LS I blocked all outgoing connections)
(3) I checked the firewall log for the IP addresses and all the connections relate to Skype. They are all the same as follows:
Apr 25 08:46:56 r6bl33 Firewall[40]: Allow Skype connecting from 78.105.46.149:50088 uid = 0 proto=6
(only the port number, which I guess are the digits following the colon changes - but they all begin with a 4, 5 or 6)
(4) I restarted the Mac and started LS network monitor. Nothing happened until I started Skype and after a few seconds Mac OS X Kernel appeared in the network monitor. THe IP address that Mac OS X communicated with was: 88.222.69.119. This IP address was also in the list of connections that Skype made. I think the Skype connection came first because I saw the same IP address flash up twice and in between Mac OSX Kernel became active.
(5) Just went through the restart exercise again. This time it took a lot longer for Mac OS X Kernel to appear in the LS network monitor but again the same thing happened. This time the Skype connection was to: p5B114A44.dip.t-dialin.net, (which when I paste it into whois or lookup is pasted as an IP address: 91.17.74.68). And then immediately after Mac OSX Kernel appears in network monitor communicating with the same address.

Does that clarify anything? An infected Skype app?

Reply

Answer 7

Apr 26, 2009 10:53 AM in response to groovytrain

groovytrain,

Yes, it does clarify the issue for me.
1. As long as you don't consider Skype itself an infection, *your computer is probably not infected*.
2. Skype is a P2P application. It works by making a lot of connections to an ad-hoc network of computers.
3. Under Skype's EULA, you agreed to this:
"Utilization of Your Computer:Skype Software may utilize the processor and bandwidth of the computer (or other applicable device) You are utilizing, for the limited purpose of facilitating the communication between You and third parties. Skype will use its commercially reasonable efforts to protect the privacy and integrity of the computer resources (or other applicable device) You are utilizing and of Your communication, however Skype cannot give any warranties in this respect."
4. As you can see from the above, "free" calls using Skype have a cost. There's an acronym for this economic fact of life: "TAANSTAAFL - There Absolutely Ain’t No Such Thing As A Free Lunch."
5. This means that you will continue to see strange connections in your logs until you kill Skype. This also means that your system will be vulnerable to attack via Skype until you kill it.

It's your choice whether to continue to use Skype. You can make your computer more secure by killing Skype processes when you're not making calls and by not connecting your Mac directly to the internet.

-Wayne

Reply

Answer 8

groovytrain Author

Level 1

0 points

Apr 27, 2009 10:35 AM in response to ParentalUnit

Wayne, many thanks for your help

Skype is clearly 'involved', and although I would like to know exactly what is going on, I just don't have the time to do that right now. It's good to know that my computer probably isn't infected --- unless of course you consider Google Desktop an infection (but that's a whole different story and the reason why I got LS in the first place)

However, if you're interested & very briefly: Once you've installed Google Desktop (and unfortunately I find the functionality very useful, more so than spotlight) you can set the preferences to 'no automatic software update' & no 'stats uploading'. Google ignores that and tries to call home anyway, through all the various processes it has installed every couple of minutes. Little Snitch took care of that. On top of that I was looking through a log the other day, I found a line saying something like: "Google Software update couldn't 'upload stats' because it couldn't find the server" (that's LS working). In other words, if you disabled stats uploading, but allowed automatic software update, Google would find a way to upload your stats to their HQ anyway (and incidentally the Google software update programme runs and trie to call home every several minutes despite the fact that I turned it off)

Finally: I was wondering what was eating space on my disk & I got a small programme called whatsize. Turns out that the google files which show up in the finder as no bigger that a few kb are actually several gigabytes.

For a company whose motto is "Don't do evil", I think they have some explaining to do.
On the other hand maybe that's why their motto is what is. I think most people would assume that companies in general 'don't do evil'. One wonders why Google have to tell us explicitly that they don't

Sorry, went slightly off-topic there

Again, thanks for your help

groovytrain

Reply

Answer 9

Apr 27, 2009 11:01 PM in response to groovytrain

groovytrain,

I consider Skype relatively benign, although my clients w/don't use it for security reasons.

From a privacy and control over your data and your own computer point-of-view, Google Desktop is pure evil. It's already been exploited. Unfortunately, it's also an integral part of a major accounting software company's business offerings. I'm fairly sure that you can find similar functionality without the evil if you look for it.

-Wayne

Reply

Answer 10

groovytrain Author

Level 1

0 points

Apr 27, 2009 11:20 PM in response to ParentalUnit

Thanks Wayne

Glad that you agree with me about Google Desktop

groovytrain

Reply

Answer 11

Apr 28, 2009 11:13 AM in response to groovytrain

Hey
sorry Guys you are all talking a bit over my head
I am having the exact same issue
did you figure out a way to connect to the internet?

I have skype LS ect... on my computers (macpro and a macbookpro)
all running 10.5.6 and all latest versions of skype

and my communications with my internet vanished. (except skype)
with that service provider
when I log on with another wireless system all is fine

what can I do to rectify this
do I delete skype
will that take care of the issue
or is it deeper than that.
thanks

Reply

Answer 12

Apr 28, 2009 2:18 PM in response to Shawn Convey

Shawn,

If you [ask your own question|http://discussions.apple.com/help.jspa#postquestion], you'll have better luck getting answers.

-Wayne

Reply