tunnel over ssh

Question

tunnel over ssh

flyredeagle 1

I think I have some shape of security incident somebody looks to be tunneling on my machine from an IP address in china 221.131.165.56

azureuser@www :~$ netstat -na | grep 80
tcp 0 1080 10.0.0.4:22 221.131.165.56:23755 ESTABLISHED
tcp6 0 0 :::80 :::* LISTEN

my apache went down somehow (I don't know when) but looks today
and from the apache access logs attached it seems that they tried a couple of hacks.

Can you run an investigation on this and see what is going on ?
I did not touched much to try to understand what is going on.

The strange thing is that this afternoon (around 14) I received a call from sbdy that stated that he belongs to microsoft azure getting started team etc. and that they wanted to have a chat

phone number is +31 20 500 1500

Tomorrow we booked sometime for him to phone back cause today I was busy.
is this normal procedure and how I can check if this is a genuine microsoft guy ?

103141-access.log

flyredeagle 1 Reputation point

2021-06-07T20:00:32.617+00:00

I imagine that support can track this but just in case
here is IP and dns

nslookup trusteagle.com
Server: 192.168.2.254
Address: 192.168.2.254#53

Non-authoritative answer:
Name: trusteagle.com
Address: 104.47.147.236
flyredeagle 1 Reputation point

2021-06-07T20:33:14.1+00:00

technical support request number: SR2106070060004654

1 answer

Your answer

flyredeagle 1 Reputation point

2021-06-07T20:00:32.617+00:00

I imagine that support can track this but just in case
here is IP and dns

nslookup trusteagle.com
Server: 192.168.2.254
Address: 192.168.2.254#53

Non-authoritative answer:
Name: trusteagle.com
Address: 104.47.147.236
flyredeagle 1 Reputation point

2021-06-07T20:33:14.1+00:00

technical support request number: SR2106070060004654

Answer 1

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@flyredeagle
Thank you for the detailed post and for your updates!

When it comes to Microsoft reaching out to you via phone call, if you've never opened a support request or had any reason for us to reach out, then from my experience, this wouldn't be normal procedure. However, from your issue description, I believe this should definitely be looked at by our support team so they can take a closer look into your environment and issue.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

flyredeagle 1 Reputation point

2021-06-13T02:06:04.283+00:00

The incident above is on visual studio service team (so wrong place .. did you checked ? ) ..
From them I got this link:
https://learn.microsoft.com/en-us/azure/security/fundamentals/event-support-ticket
And this redirects me back to azure portal ...
Is the link correct ?
Can I open a security issue without an extra paid support contract and in which cases ?
It says:
Scenarios that are related to security are not supported. This includes, but is not limited to, compromised virtual machines, security forensics, DDoS, or intrusion-prevention assistance.
Here it looks that they are saying that even with a commercial support contract this is not supported.
flyredeagle 1 Reputation point

2021-06-13T02:06:22.263+00:00

Ok essentially I prob know what it is,
I have port 80 and 443 open and this guy is tunnelling in by 80 and out by the ssh,
I think I can find a fix, but I don't have a support contract.
Then I kicked out the tunnel and these bastards reconnected in:
tcp 0 1081 10.0.0.4:22 221.181.185.198:47472 FIN_WAIT1
tcp 0 0 10.0.0.4:22 222.186.30.112:21037 ESTABLISHED
In worse case I need to rebuild the machine if they managed to download sth on to it...
I tracked who phoned in and he looks to have a microsoft mail address plus the call phone no (i.e the number above) is from the actual microsoft NL, he did not had much of a clue, but he was traceable, I will ask him where he got my name from,
I had a contact with a senior sales person some time ago.

He also mentioned to give a try microsoft security center, cause is in the free services, but he had not much of a clue what the product did.

Share via

tunnel over ssh

1 answer

Your answer