Planetarion Forums

Eidron · 30 Mar 2004, 15:00

I was sitting at my comp yesterday...playing music...when suddenly my firewall informed me that someone had tried to run a port scan on me. Annoyed at people touching my stuff I did a traceroute, and the trail ended at webwall.dstl.gov.uk.

dstl is the Defence Science and Technology Laboratory, part of the UK MoD. Hmmmm. Thoughts?

NEWSBOT3 · 30 Mar 2004, 16:35

thoughts is

a) how do you know it was a port scan ? do you trust your firewall to identify them correctly ?

b) how do you know it even came from there ? do several whois's match ?

c) the ip/host could easily be faked.

d) trojan/virus on a government machine

e) MI5 is spying on you. (although comms intercepts/intrusions are more likely to be carried out by GCHQ which wouldnt have a real reverse dns lookup anyway so you'd never match the IP to anything). Also any government dept with sense would get their reverse dns annulled. (we got requests for it when i was working at an ISP from various law enforcement agencies etc), so that their IP's dont show up as peadohunters.yorkshire.police.gov.uk or whatever.

f) dirty terrorist scum

g) oh.

h) if it was the government, thats interesting, but only || that much.

i) wouldn't think it'd be a live test of anything , since even that would be hidden well enough. Most likely d) tbh.

j) i've run out of thoughts now.

Eidron · 30 Mar 2004, 17:57

Firewall said it was a port scan lol, and I semi-trust it (I dont fully trust any of my software).

It dont come up with anything dns wise. All I did was a tracert and it ended at what I assume to be their firewall. Could have been faked I spose. If it was the police why would the trail lead me to part of the MoD lol...wouldnt that cause criminals to worry?

Of course these days nothing is for certain.

Luckeh!!!! · 30 Mar 2004, 18:46

expect the blacked out van treatment and mysterious phone calls.

Infact they probably know you come here aswell.

I don't know you, I didn't see you, I was just walking by.

w2k · 30 Mar 2004, 18:50

there gonna come get you

Intrepid00 · 30 Mar 2004, 19:24

Port scan source can be faked, it proably didn't actually come from the goverment. If it did, then maybe the goverment got a port scan where the source was faked to your IP.

Weeks · 9 Apr 2004, 13:12

Delete your mp3s they're coming!

Vodka · 15 Apr 2004, 02:32

It's probably just a gov't router. Since, by the nature of TCP/IP, your packets automatically find the quickest way to get to you, they probably were routed through one to get to you.

w2k · 15 Apr 2004, 02:51

dstl isnt really into finding illegal internet goings on. its not a pubic facing agency. its MI5 u need to look out for

Vodka · 15 Apr 2004, 03:01

Quote:

Originally Posted by w2k

dstl isnt really into finding illegal internet goings on. its not a pubic facing agency. its MI5 u need to look out for

Not if you use StegFS, always use an anonymous SSL proxy system for net usage, and prevent against TEMPEST attacks.

Mong · 21 Apr 2004, 14:30

Quote:

Originally Posted by w2k

its not a pubic facing agency.

What is then? Gynecology?

M.

Weeks · 27 Apr 2004, 13:03

he hasnt posted for a while.
odds on he's been taken out by mi6.

Eidron · 27 Apr 2004, 22:25

Lol. After an attempt to view the army website I realised that was the actual IP I had blocked...someone must be playing tricks methinks.