• Welcome to OS2World OLD-STATIC-BACKUP Forum.
 

News:

This is an old OS2World backup forum for reference only. IT IS READ ONLY!!!

If you need help with OS/2 - eComStation visit http://www.os2world.com/forum

Main Menu

OS/2 Vs. Windows... The Debate Rages On

Started by S.SubZero, 2007.11.02, 08:49:11

Previous topic - Next topic

RobertM

Quiet? Look again at all the NBNS packets that should be non-existant. That is "Not Installed - Oh Wait, It IS STILL Installed NetBEUI or NetBIOS over TCP/IP"



|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


Saijin_Naib

#121
No its not Robert. Its not coming from my machine. As I stated quite plainly before, they are coming from my sisters laptop.

RobertM

Quote from: Saijin_Naib on 2009.11.26, 06:36:36
No its not Robert. Its not coming from my machine. As I stated quite plainly before, they are coming from my sisters laptop.


Oops. Apologies. What about the other few hundred entries?


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


Saijin_Naib

#123
The keep alive packets? I assume that is fairly normal network traffic between a wireless router and a wireless network card.
But, I'm not a Networking major so...

RobertM

Quote from: Saijin_Naib on 2009.11.26, 06:42:34
The keep alive packets? I assume that is fairly normal network traffic between a wireless router and a wireless network card...

No... the ones off screen. Anyway, give it time. And of course, use the machine. Maybe you'll have better luck than me. Either that or check the eCS Firewall logs.

I can post my firewall logs if it will help.


|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


Saijin_Naib

The ones off screen are more of the same. I identified the pattern as best I could and the stand outs (the packet to Microsoft Spynet).

If I output the whole log as plain text, all you get are the frame numbers and Hex code of the contents of the packet. Kind of useless to read over to see what was going on.

I'll compare the eCS box and my XP box back at school seeing as they both are on the same subnet (hardwire router) and should be communicating about the same.

However, its not a fair comparison because the eCS box does not have Samba functioning very well so its going to be missing a ton of traffic right there.

ddan

If my grasp of your procedure and WireShark is correct, you're "begging the question".

Since Windows itself is being tested, you can't believe what a mere program running on it tells you of its network traffic. It's well established that it hides certain files from mere apps (when Sony uses that built-in feature, it's called a rootkit);  reasonable suspicion that it's hiding whatever it wants to most certainly applies equally to network traffic. You need external hardware to check this.

Saijin_Naib

#127
Wireshark is a well known tool that comes from the Unix world. I don' think this "mere program" is fooled by any OS it runs atop, and seeing as it is used in Universities as a research tool I would hope it is more robust than you are suggesting.

It does not rely upon any of the Windows monitors or services to get its usage statistics, it installs a system-level service that runs independently of the core Windows networking services and sort of "wraps" over them, encompassing all traffic (from what I understand).

My usage may be incomplete seeing, as I mentioned before, I am not an IT or Network Security major, but to the best of my knowledge and the brief walk-through my IT friend gave me via AIM, I performed the test accurately.

ddan

#128
STILL BEGGING. So who knows whether the "core" services are all there is? ONLY CRIMOSOFT, far as the software goes.

It's not even beyond question that otherwise ordinary packets are encoded and only fully interpreted by special receivers, NOR that the real spyware only starts up in response to "back door" packets that they claim don't exist.

Anything _I_ can think, someone is already doing.

(I'm adding, because I see now that you think you covered "all". -- Er, anything that's wrapped can be unwrapped, selectively. Any service running may SEEM to own the hardware, but the OS can know that, and simply suspend the service when it wants. There's no software that could possibly cover those possibilities when Crimosoft probably knows of WireShark and can specifically handle it, somewhere in their gigabytes.

SO, only hardware can truly work, and would require lengthy monitor and test. They only have to hide a few bytes somewhere that are interpreted only by their own remote server, which then can send requests back IF desired.

They may even have other better ideas; that's truly just off the top of mine.)

ddan

Confidence games and the spy world can only work when people DON'T think they're being fooled. Me, I know I'm fallible. Someone tells me I'm smart, I immediately grab my wallet.

A bit more on my theory: the local machine would send only a few extra bytes announcing its ID and presence, at any time, and most importantly, rarely because otherwise extra traffic from millions of machines would be noted. If on a local net, a Windows server would specially interpret it, and, being a bit more compromised, either pass it on or merely note it in case a specific request came in. But because the packets are normal with a bit extra, it doesn't depend on local servers, only needs to get out somewhere. This is all distributed, and includes Windows servers monitoring net traffic, so that eventually, one of the special headers gets  home, and if there's interest, they now know where THAT machine is. If you have a portable computer, it can almost certainly be located similarly after getting onto the internet, presumably recent desktops too.

So you're at best manually looking for RARE instances of literally a few extra bytes somewhere in gigabytes, don't have an absolutely reliable tool to do it with, and probably haven't accumulated much traffic to sift through for what's unrecognizable to you. So negative results of your test are really all that I expect.

When faced with problems like that -- advantage, Crimosoft -- it's reasonable to consider motives and history. Frankly, though I still don't approve, the NSA would be a BIT careless if they DIDN'T have a way into Crimosoft machines, probably others, and it's as certain as sunrise that such capabilities exist.

Saijin_Naib

I acknowledge your criticism and I see that it is valid, but I don't have ready access to any hardware solutions for monitoring packets. This is outside of my area of work (Environmental Science/GIS/Remote Sensing) so I don't even know of any helpful people inside my university that would assist me in such a project.

I have not called the results conclusive, but only not indicative of any problem that I am able to see using a trusted piece of software used by IT and Network Security professors and students within my University to perform tests.