AC5300 & AC87U are phoning home?

[West]

Hey Merlin,


I intend this message for you or if someone else has notice with a firewall log. I look at my logs every morning and this morning something odd show up on my IPS logs. I don't know if I over look it before but surely not since seems like my ac5300 and ac87u are phoning home. I am not sure if this is part of your firmware but both of them are phoning home via UDP port (42726 on my ac5300 and 34257 on my 87U) to 146.0.32.144:123 (tor.epow0.org) (location: Germany) exactly at 5:59:47 AM. I wasn't sure if this was the path that it's taking to check on firmware updates since my IPS blocked the outbound. I had log into those devices and check their logs but no indication of anyone tampering with them. Their also set to AP and isolated via different vlan through my firewall and also set to only allow 1 certain ip address to access it via https with no ssh or telnet. If you can let me know I would appreciate it.

Thanks,

W

 

[Logi]

Hey Merlin,


I intend this message for you or if someone else has notice with a firewall log. I look at my logs every morning and this morning something odd show up on my IPS logs. I don't know if I over look it before but surely not since seems like my ac5300 and ac87u are phoning home. I am not sure if this is part of your firmware but both of them are phoning home via UDP port (42726 on my ac5300 and 34257 on my 87U) to 146.0.32.144:123 (tor.epow0.org) (location: Germany) exactly at 5:59:47 AM. I wasn't sure if this was the path that it's taking to check on firmware updates since my IPS blocked the outbound. I had log into those devices and check their logs but no indication of anyone tampering with them. Their also set to AP and isolated via different vlan through my firewall and also set to only allow 1 certain ip address to access it via https with no ssh or telnet. If you can let me know I would appreciate it.

Thanks,

W

Where do you check for the firewall log?

 

[West]

Where do you check for the firewall log?

I have a hardware firewall so I check it through there since everything else sits behind that. I guess if you use asus as a wireless router and enable the firewall then you would check it through the system logs.

 

[Logi]

I have a hardware firewall so I check it through there since everything else sits behind that. I guess if you use asus as a wireless router and enable the firewall then you would check it through the system logs.

Interesting, what brand model do you have?

 

[West]

netgate sg-4860 running pfsense

 

[RMerlin]

This host is a Tor exit node. Something on your network is running Tor.

 

[West]

This host is a Tor exit node. Something on your network is running Tor.

Thanks for the reply. I assure you I am not running any tor, but if it's not your firmware than I will just keep blocking it and keep an eye on.

 

[sfx2000]

This host is a Tor exit node. Something on your network is running Tor.

Something on the network is running TOR - intentional or not...

check devices...

 

[martywd]

idk, simply a time server? Here's what I get...

# ntpdate -q tor.epow0.org
server 146.0.32.144, stratum 3, offset -0.043523, delay 0.16756
29 Jan 21:58:04 ntpdate[22757]: adjust time server 146.0.32.144 offset -0.043523 sec

.

 

[RMerlin]

The fact that the connection was on port 123 does indeed seem to indicate it was an NTP sync event. Odd that anything would use the IP of a Tor node as an ntp server tho.

In any case, no, this address isn't hardcoded anywhere in the firmware code.

 

[AndreiV]

I saw this mentioned elsewhere a while ago. Maybe nothing to do with this situation but .........

https://www.threatcrowd.org/domain.php?domain=tor.epow0.org shows a connection to an ntp pool

https://www.reverse.it/sample/c6b97...7cb288a509b21b0b0508656ea9d?environmentId=100

shows the IP address has been used in malicious connections.