Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Dragonslore]

That particular IP address is from China.

Systems Security is a specialty of mine and I deal with the detection and removal of Malware and other related parasites.

I have done many Reverse IP lookups and found many of them to be from China.
Others originate from all over the world, via worms loose on the net, BotNets and other means.
But many of the Chinese IP's are hackers using what ever tools they have at their disposal.

[Fatman]

Your iPod Touch convinced me security software is not the issue.

hmmmm, I think it is time to discuss using voodoo to resolve your issues.

[HankRiker]

Your iPod Touch convinced me security software is not the issue.

hmmmm, I think it is time to discuss using voodoo to resolve your issues.

Heh. I know. That's why I'm flustered...

At this point, I really think it's either a security setting in the router, or something in FW v1.02.

Beyond that? What could possibly cause these symptoms?

[Dragonslore]

:lol: Looks like we got a bit sidetracked here.

After all, he did ask about that blocked IP and I just provided him with information concerning it

[Dragonslore]

Here is an Idea.....

Check the DNS settings of the router, then bypass the router and see what DNS settings you come up with.

Maybe your router has been hit with DNS poisoning?

Did you take the time to properly secure the router or did you leave it with the Factory default or a weak password?

Vulnerability to DNS poisoning was one of the weaknesses of firmware 1.02 and last year there was a major effort by all companies to eliminate this vulnerability in their hardware products and in Operating Systems.

[HankRiker]

Here is an Idea.....

Check the DNS settings of the router, then bypass the router and see what DNS settings you come up with.

Good thought. I connected the portable to the modem, and now have the IP address of the site. I connect the router back up, and try using the IP address, and it fails. Argh.

Maybe your router has been hit with DNS poisoning?

I don't believe that to be true. I use a good, randomly generated password from GRC.com for it. No dictionary attacks here. 

Vulnerability to DNS poisoning was one of the weaknesses of firmware 1.02 and last year there was a major effort by all companies to eliminate this vulnerability in their hardware products and in Operating Systems.

I am aware of the issues, I actually had asked a while back about the stability of FW's beyond 1.02 due to that exact problem, but I have tested myself, and do use OpenDNS, so I doubt that's the issue.

[Dragonslore]

Ok, then log into your router and try changing the DNS settings to OpenDNS using these DNS settings:

208.67.222.222
208.67.220.220

Then on your system, go into Internet Options > conections and make sure that AutoDetect Proxy settings is Not checked as this can sometimes bypass the DNS settings of the router.

While you're at it, later on you might want to open an account with OpenDNS so you can use the Dashboard (webpage) where you can actively block sites according to category and/or domain. ConFlicker is actively blocked by OpenDNS too which is a plus.

[HankRiker]

Ok, then log into your router and try changing the DNS settings to OpenDNS using these DNS settings:

Um, I think I've mentioned a few times that I'm using OpenDNS. In the router. Just like you described.

And Autodetect is off on my machines. Thanks for the suggestions though. 

I have now tried:

• Falling back to the default settings in the router
• Trying the native TWC DNS servers
• Trying the INAIC Public Root DNS servers

But I don't think it is a DNS issue, as I have the IP address of yourfoodstore.com, 199.108.162.224 and using that directly doesn't resolve the web site either.

I'm going to give up for a few hours and have dinner. Perhaps I'll have an epiphany.

Thanks again to everyone for their suggestions and help.

[Dragonslore]

My Bad...

I should have scrolled back and reread things.

a bit hectic here at home and I got a bit distracted.

 -

BTW....

This just started a couple of days ago, so it's not related, but could possibly cause problems now.

It seems that DNS servers are starting to get attacked with a DDoS attack since the 1st of this month.
This may possibly be what the April 1st Conflicter payload was.

http://isc.sans.org/diary.html?storyid=6121
http://www.theinquirer.net/inquirer/news/638/1051638/register-com-suffers-dos-attack
http://www.scmagazineus.com/DDoS-attacks-hit-major-web-services/article/130060/

[4500Owner]

This sounds like the infamous "IE UserAgent String Length Issue" at work again as of late.  This is happening more and more due to really bad practices by MS...

Essentially, IE is sending a UserAgent string that is too long - usually somewhere over 200 characters.  This causes the firewall of some sites to reject the connection request, and your browser to "error out".

You can check the content/length of your browser UserAgent string here:

http://www.enhanceie.com/ua.aspx

You might see something like this:

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0;
.NET CLR 1.0.3705; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR
3.0.04506.30; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR
3.0.4506.2152; .NET CLR 3.5.30729)

You'll probably also see a big yellow warning box about your string being too long - this is what is causing the issue.  You'll probably also notice the ridiculously long string content itself - full of seemingly every .NET framework version/update, as well as perhaps some MS Office related module versions/updates - THESE appended entries from MS are what are causing the problem, and need to be removed/deleted. 

Apparently, MS decided to append IE's UA string with this nonsense every time you installed/updated a .NET Framework package, or certain MS Office updates/packages etc, thus creating the increasingly common problem over time.  Essentially, the older a Windows install is, the more likely its going to have been updated with these packages, and the more likely the UA string will get too long.

Why did Microsoft decide to append the UA string with all this nonsense to begin with?  Good question, and a very bad practice best left to MS to explain.  Feel free to contact them about the issue.

Regardless, you can edit the registry and solve your problem.  Go to the following key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Platform]

..and delete everything aside from "Default".  That should take care of the issue.

Good luck

[HankRiker]

This sounds like the infamous "IE UserAgent String Length Issue" at work again as of late.  This is happening more and more due to really bad practices by MS...

Essentially, IE is sending a UserAgent string that is too long - usually somewhere over 200 characters.  This causes the firewall of some sites to reject the connection request, and your browser to "error out".
<snip>

Thanks for the reply, but I cannot reach the yourfoodstore.com with any browser, not just Internet Explorer. Firefox, Opera, Chrome, Safari (even on an iPodTouch) all fail to resolve the web site. I've also tried it on a variety of machines, with different operating systems.

Yet if I connect a machine directly to the cable modem, I can resolve the page in any of the above mentioned browsers.

Still, interesting to know about the string length. Thanks.

[Puffnstuff]

FWIW I can't load that site either and http://downforeveryoneorjustme.com/ says that the site is up.

[HankRiker]

FWIW I can't load that site either and http://downforeveryoneorjustme.com/ says that the site is up.

Oh man! Thank you for that site. That's great!

And even better, you also can't get to it?

Of course, now I have to ask, are you on the East coast? DGL-4500? FW? Hosting Provider (TWC?)?

I have an old Linksys POS that I am currently trying to find, to test that on the portable.

I considered getting a Netgear WNR3500, but I'd rather wait for D-Link's next DGL, as I'm comfortable with the interface, and feel they make pretty solid gear. If I can find the POS, I'll report back.

Thanks again.

[HankRiker]

Okay. Finally found the old Linksys BEFSR41 V.2 POS.

Guess what? It works.

I can get to yourfoodstore.com just fine. Which means it's most certainly the DGL-4500.

I suppose now I can focus my efforts there, now that I know it's the point of failure.

Is there anyone running FW v1.02 that can get to the site? If so, please private message me, as I would like to try and emulate your settings. There are so many options, and if a DMZ was not enough, I'm guessing it really IS something obscure.

Hmm. Reinvented mentioned being able to connect with a DGL-4300 and FW 1.9. I think that will be my next step, actually. I have a spare, that I will flash to FW 1.9, and give that a try...

Thanks again, everyone.

[Puffnstuff]

I'm running the 4500 fw 1.16b3.