Community discussions

MikroTik App
 
dsgreen
just joined
Topic Author
Posts: 2
Joined: Tue Jul 24, 2007 11:37 pm

Possible Dude 2.2 security issues...

Wed Jul 25, 2007 12:14 am

When running Dude 2.2 on our network this morning, I ran into a couple of problems.

First, when the Dude polls a particular computer, that computer reports a serious error, "COM Surrogate - Error signature szAppName: dllhost.exe szAppVer: 5.1.2600.2180 sz.ModName: unknown". Near as I can tell, Dude is either triggering a process start, or is actively instigating a process start.

Second, the Dude is apparently pinging (or otherwise contacting) Amazon.com, not just once during the discovery process, but many, many times. This is reported by Ethereal.

Both of these issues clear up as soon as I shut the Dude down.

I've downloaded and reinstalled a fresh copy, on the off-chance that the installer that I had (for quite a while now) might have been compromised. I've also done full virus scans with Avast and Kaspersky, which found nothing.

Anyone know anything about this..?
 
VTWifiGuy
Frequent Visitor
Frequent Visitor
Posts: 53
Joined: Wed May 23, 2007 10:19 pm

Re: Possible Dude 2.2 security issues...

Sat Jul 28, 2007 2:00 am

I'd like to know what you mean by contacting amazon is it possible your dns probe is set to try and resolve amazon?
 
winkelman
Member Candidate
Member Candidate
Posts: 231
Joined: Wed Aug 16, 2006 5:00 pm
Location: Amsterdam, The Netherlands

Re: Possible Dude 2.2 security issues...

Mon Jul 30, 2007 12:57 pm

I'd like to know what you mean by contacting amazon is it possible your dns probe is set to try and resolve amazon?
Then still it would be The Dude connecting to the DNS server and the DNS server (not the Dude) contacting (possibly) Amazon. (More likely, the DNS server will contact another hier-level DNS server and still not Amazon.) Right?
 
dsgreen
just joined
Topic Author
Posts: 2
Joined: Tue Jul 24, 2007 11:37 pm

Re: Possible Dude 2.2 security issues...

Thu Aug 02, 2007 12:27 am

I'd like to know what you mean by contacting amazon is it possible your dns probe is set to try and resolve amazon?
I'll need to try and get some Wireshark logs from our security guy...he's the one that first noticed the goings-on.

Who is online

Users browsing this forum: No registered users and 20 guests