Ai Cloud app and Ai Protection conflict? or Ai Cloud app compromised?

[eastavin]

384.3_alpha2-g5b8da38
Two inquiries:

1) Some odd behaviour from AI Cloud app on Android. Keeps logging in endlessly. One log in should be enough?

​

2)
Noticed an AI Protection 2-way IPS Alert on TrendMicro. Looks like the router or client on the router is attacking the NAS on the LAN. No mac address given or at least it shows as all zeros. Does the Ai Cloud Android app have an infection? How does one interpret this?

However this is the exact time I tried AI Cloud app on my Android Smartphone on the LAN Wifi to access an Ethernet wired NAS.

Jan 27 07:13:58 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:13:59 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:06 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:15 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:15 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:16 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:16 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:16 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: Download samba file /192.168.1.100/xxxxx/can-flag.gif from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: Download samba file /192.168.1.100/xxxxx/can-flag.gif from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: Download samba file /192.168.1.100/xxxxx/xxxxx.gif from ip 192.168.1.127
Jan 27 07:14:17 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:17 webdav: Download samba file /192.168.1.100/xxxxx/xxxxx.gif from ip 192.168.1.127
Jan 27 07:14:38 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:38 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:38 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:42 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:42 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:42 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:58 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:14:58 webdav: Download samba file /192.168.1.100/xxxxx/French stuff/xxxxx/ReadMe.txt from ip 192.168.1.127
Jan 27 07:15:08 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:08 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:08 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:08 webdav: Download samba file /192.168.1.100/xxxxx/trillium.gif from ip 192.168.1.127
Jan 27 07:15:08 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:08 webdav: Download samba file /192.168.1.100/xxxxx/trillium.gif from ip 192.168.1.127
Jan 27 07:15:09 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:09 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:09 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:09 webdav: Download samba file /192.168.1.100/xxxxx/xxxxx_00000.jpg from ip 192.168.1.127
Jan 27 07:15:09 webdav: User login 192.168.1.100 from ip 192.168.1.127
Jan 27 07:15:09 webdav: Download samba file /192.168.1.100/xxxxx/xxxxx_00000.jpg from ip 192.168.1.127
Jan 27 07:15:10 webdav: User admin login from ip 192.168.1.127
Jan 27 07:15:10 webdav: User admin login from ip 192.168.1.127
Jan 27 07:15:31 webdav: User admin login from ip 192.168.1.127
Jan 27 07:15:31 webdav: User admin login from ip 192.168.1.127

app terminated.

 

[ColinTaylor]

I don't know anything about AI Cloud or the app but the message about SMB brute force attempt sounds like "normal" Windows behaviour.

I see from your other posts that you were having problems setting up Samba user accounts. Note that if you point Windows Explorer at a Samba share it will "spam" the server with login attempts using the current Windows user name and password. Is 192.168.1.100 a Windows PC or the router?

To "fix" this create Samba accounts on the router with exactly the same name and password as the Windows local accounts. (Note that you need to be logged into the PC with local account, not a Microsoft account).

 

[eastavin]

Hi. Thanks for the reply. Well I suppose its not so much problems as I have never used the USB share feature or the AiCloud before on this router. So thats the cause of my dumb questions. I tried reading Asus documentation and faq but its not that helpful and the links to all 13 of their videos on AiCloud and other feature set up are broken.

To answer your other questions:

The flow chart here is an AI cloud app equipped Android phone passing through the ASUS router at 1.1 to access a public folder on a Linux NAS (equipped with Samba/FTP/WebDAV/afp, but both WebDAV and AFP are deactivated) at 1.100 and download a file.

Does the above add anything? No windows in this picture.

you wrote <<To "fix" this create Samba accounts on the router with exactly the same name and password as the Windows local accounts.>> I will have to give this some thought as there is no windows in the picture and the target file was public.

And why does Ai Protection report Ai Cloud as a dangerous app? Aren't both Asus features developed to stringent standards and fully tested by the manufacturer? Ideally they should work together?

 

[ColinTaylor]

Does the above add anything? No windows in this picture.

OK, you're not using the setup I had imagined so you can ignore everything I said . As for the error messages I can't offer any advice as I've never used Ai Cloud or Ai Protection .

 

[eastavin]

OK, you're not using the setup I had imagined so you can ignore everything I said . As for the error messages I can't offer any advice as I've never used Ai Cloud or Ai Protection .

Thank you for the thought. Much appreciated.