Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[pierre.huybens]

I have the following connection established  from my  DNS320L  the netstat shows:
 
tcp        0      0 192.168.1.201:37989     54.194.162.61:443       ESTABLISHED

  using lsof we can find that the connection is established  by the signalc  process

signalc    7100            root    4u     IPv4    2398399      0t0     TCP MyNas:37989->ec2-54-194-162-61.eu-west-1.compute.amazonaws.com:443 (ESTABLISHED)
does some one knows what this process is doing  ?
the process is running from  /mydlink  directory.
If I stop it, a few second after it is restarted
If this is to access the NAS from the outside network , could we disable this feature ?

where could we found more technical inforation about process running on the NAS  ?

thanks

[tudvari]

Hi.

I think this is a trojan or something like this. Unfortunately you should make a factory reset.

Regards,
tudvari

[NixZero]

I have the following connection established  from my  DNS320L  the netstat shows:
 
tcp        0      0 192.168.1.201:37989     54.194.162.61:443       ESTABLISHED

  using lsof we can find that the connection is established  by the signalc  process
west-1.compute.amazonaws.com:443 (ESTABLISHED)

that compute.amazonaws.com is pretty clear: its the connection to your cloud storage service on amazon cloud.

[JavaLawyer]

that compute.amazonaws.com is pretty clear: its the connection to your cloud storage service on amazon cloud.

While I'm not convinced this is connection is anything malicious, I'm not sure I entirely agree with your conclusion. D-Link Cloud camera owners have been reporting that same connection on their Cloud cameras dating back to 2012. D-Link does not offer Cloud-based storage for video feeds. Perhaps D-Link is partnering with Amazon in some other capacity relating to mydlink.

   

[pizzaking]

While I'm not convinced this is connection is anything malicious, I'm not sure I entirely agree with your conclusion. D-Link Cloud camera owners have been reporting that same connection on their Cloud cameras dating back to 2012. D-Link does not offer Cloud-based storage for video feeds. Perhaps D-Link is partnering with Amazon in some other capacity relating to mydlink.

   

I think you may be right. As far as i understand, the mydlink app does not require any port forwarding on the users network equipment, which must ultimately mean, that you do not have a direct connection to your DNS-320L when you use the mydlink app. My guess is that Amazon act as a routingserver in this connection, in the same way as when using TeamViewer for remote technical support.

[pierre.huybens]

This is not a virus. This should be part of the base software provide.  Currently my NAS is only accessible from my local LAN no port forwarding and I have only  install fun_plug.

The processes ( signalc  tsa ) and the watch dog (/mydlink/mydlink-watch-dog.sh) of the network  processes are started at boot time  from the folder /mydlink. There is also a script to start/stop them.

It is easy for you to check if you have the same on your DNS320 with the latest firmware version.
 We should ask DLink what us the usage of those connection, because using this connection with root privilege … anything can be requested to the NAS.

Well of course I can stop them using fun_plug at boot time, but before I would prefer to know why they are started
 
Thanks for your help.