Ask Your Question
0

Packet capture rate at 14,000 per second without anything running, is my PC compromised ?

asked 2022-02-26 20:49:56 +0000

laurentz1241 gravatar image

updated 2022-02-27 20:22:12 +0000

On 26 February, I was sitting in an internet cafe shop, running Wireshark and Snort to measure traffic on the computer that I was sitting at. The rate of packet capture per second was too high (peaked at 14,000) that Wireshark got malfunctioned, whereas Snort still worked normally https://imgbox.com/41aBuJK2 . So, I saved only Snort log files instead of pcap files from Wireshark https://mega.nz/folder/11MF1aYI#cNcAE... .

Recording video: https://www.youtube.com/watch?v=5m6gI...

When analyzing the log files on Wireshark, I only see that almost all of conversations of my client computer are with an another computer in the shop, whose local IP address is 192.168.1.242. However, I'm pretty sure that kids in the internet cafe shop plus the owner did not do anything to transfer files between my computer and theirs. Additionally, this has already occurred many times in not just only that internet shop but also other shops.

As I have been cyber-spied on intensely by Vietnam. I suspect that this is Vietnam cyber-espionage on me. Since this is a nation state actor, it is not surprising when its cyber-spies are capable of hiding their identity by using one of the computers in internet cafe shops to intrude into the other ones.

edit retag flag offensive close merge delete

Comments

fixed 192.168.1.242, not 192.168.1.241

laurentz1241 gravatar imagelaurentz1241 ( 2022-02-27 07:22:21 +0000 )edit

@SYN-bit@grahamb , please give some thoughts about this. I put pcap files captured by Wireshark in Caploader (trial version) and then double-clicked on the conversation that generated the highest number of capture packets (screenshot: https://imgbox.com/jRVUD3Wa) to see the content of the conversation. The contents show Porttugese and Indonesian texts like this:

Indonesian: https://controlc.com/9b236d03 (https://imgbox.com/7JQvpq1S)

Portugese: https://controlc.com/bc035899 (https://imgbox.com/HSqgxFG1)

Download links to the pcap files are put in the description of this Youtube video: https://www.youtube.com/watch?v=2xoBF...

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 09:23:56 +0000 )edit

Videos aren't useful when attempting to analyze traffic. Please post the capture files on a public share and then a link to them back here.

grahamb gravatar imagegrahamb ( 2022-03-04 10:22:42 +0000 )edit

@grahamb I uploaded the capture files to Mega.nz, which you can download them here:

Link 1 (1.08 Gb): https://mega.nz/file/DrwCzaKQ#UruEWmr... Link 2 (3.15 Gb): https://mega.nz/file/Cq4UxY4K#QIFQucZ... Link 3 (1.16 Gb): https://mega.nz/file/OuhgQaLA#2A1d_Vc...

For capture files in link1 & link2, I opened them in Caploader (free trial version) and double-clicked on the most intense conversation to see the content of the conversation, and then I copied and pasted the contents here:

https://controlc.com/9b236d03https://controlc.com/bc035899

As I'm just a layman in Wireshark analysis, these codes look meaningless to me. Please help me to analyze them, grahamb.

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 11:28:50 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-03-04 13:10:57 +0000

grahamb gravatar image

updated 2022-03-04 17:29:02 +0000

I looked at the first capture file listed, as noted in the answer to your similar question by @SYN-bit, by opening the Statistics -> Protocol Hierarchy dialog you can see the traffic is mostly iSCSI traffic, reads and writes between 192.168.1.142 (probably your machine) & 192.168.1.210.

Using the Statistics -> Conversations dialog, TCP tab (check the Name resolution option) you can see again that most traffic is to the isci-target port (3260) on 192.168.1.210. There are some other smaller conversations to the same IP on ports, 6894, 6895 but these seem to be binary data with nothing standing out.

There is another conversation on port 1000 that does have some vaguely interesting text in it (use the filter tcp.stream == 4 and right click any packet and select Follow -> TCP Stream), where it seems that .242 is sending queries about temperatures and hardware info to .142 which responds with some information. This may or my not be malicious.

You can also view some of the contents of the data transfer over iSCSI, again by clearing the display filter, selecting one of the iSCSI packets and using Follow -> TCP Stream. Looks to be a mix of binary, English, JavaScript??, Portuguese and some other languages.

You should determine what the other computer is (.210) and why your computer is reading and writing data to it over the iSCSI protocol. The text in the follow stream window for the iSCSI traffic might be a clue to you about the data transfer.

edit flag offensive delete link more

Comments

@grahamb Thanks for your answer. Is iSCSI traffic generated when 2 computers in the same local network communicating to each other ? When a computer in a local network is compromised by hackers and then it is used to communicate with other computers in the local network, is the traffic that is generated from the communications between them iSCSI ? It is sure that other users plus the owner in the internet shop that I sat in did not do anything. Therefore, the possibility that one of the computers in the shop (192.168.1.210) was compromised to intrude into my computer is most likely.

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 14:59:32 +0000 )edit

@grahamb I've gotten a couple more questions from your above answer. Why does the conversation on port 1000 (screenshot https://imgbox.com/CFYDMLd6) correspond to filter "tcp.stream == 4" rather than tcp.stream == 1 or 2 or 3 or 5, etc. ?

After selecting one of the iSCSI packets and using Follow -> TCP Stream, there are a mix of binary, English, JavaScript??, Portuguese and some other languages shown, how to understand the meaning of these binary, Javascript, Portugese, English and what effects do they have on my computer ?

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 15:15:45 +0000 )edit

The tcp stream indexes are a synthetic property calculated by Wireshark for each tcp flow (source IP and port, Destination IP and port) as they occur in the capture. The first packet for that flow is the 5th (counting from 0) stream encountered in the capture file. The tcp stream index does not appear anywhere in the traffic.

The stream "Follow" dialog shows what data is being transferred over the stream. As the stream in this case is iSCSI this would seem to be the contents of disk blocks, i.e. files. The data with the light red background is being sent from .142, the data with the light blue background is being sent to .142. I have no idea what the contents are about, but from the protocol used it would seem to be some form of file transfer.

grahamb gravatar imagegrahamb ( 2022-03-04 16:28:12 +0000 )edit

@grahamb Thanks. Is iSCSI traffic generated when 2 computers in the same local network transferring files with each other ? if 192.168.1.210 was compromised, and then it was used to transfer files with my computer 192.168.1.142, then iSCSI traffic would be generated, right?

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 17:19:14 +0000 )edit

I'm not that familiar with iSCSI, but yes, it's a networking protocol to transfer files, usually between a client and some form of storage array.

From what I can see it's your PC that's controlling the data transfer and issuing the commands, both reads and writes. Unfortunately the info isn't available from the capture file, but if it happens again you could use other tools to locate the process causing this transfer, e.g. TCPView.

grahamb gravatar imagegrahamb ( 2022-03-04 17:32:05 +0000 )edit

@grahamb I'm pretty sure that I did not command to transfer any file. That's why I'm puzzled. The Wireshark capture file that you checked was captured on February 17. On February 26, I captured traffic again in the same internet shop with both Wireshark and Snort. When this problem was happening (it happens in every internet shop and every time I sit in), I looked up the port in the output of netstat -anp tcp -o and then looked up the corresponding process ID (pid) with task manager (used the 'details' tab) to see which program is using the TCP connection (video recording, timepoint 6:20). I saw that only Windows apps were using TCP connection. Those steps that I did are equivalent to using the tool TCPView, right ?

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 18:16:16 +0000 )edit

Unfortunately it would seem that the process responsible for the traffic to .210 port 3260 has PID 4 which is the System process, which is somewhat understandable as it's probably a filesystem driver that's actually generating the traffic.

As to why this is occurring, I have no idea. There is a Windows tool, "iSCSI Initiator" that might show some information on the connection, but I've never used it so can't help any further.

If you still think this is caused by malware you will need to follow up with an appropriate resource for that, e.g. Bleeping Computer Security Forums, it's not a Wireshark related issue.

grahamb gravatar imagegrahamb ( 2022-03-04 18:40:22 +0000 )edit

@grahamb Thanks for your suggestions. it appears to me that this is caused by cyber-spies as I went through a lot of similar experiences in the past several years. For instance, back on January 16, in my apartment, when about to post a comment on my old blog that I no longer remember its password, disk usage of my PC suddenly jumped to 100%, causing it to be frozen temporarily. Checking what programs were causing this issue on Task Manager, I saw "windows modules installer worker", "Service Host: Local Service" (Video recording). After posting the comment and pressing F5 to refresh the page, the comment disappeared unexplainably, whereas posting comments with an altered content shortly later, they still appeared normally. It seems that nation-state sponsored cyber-spies can manipulate components of Windows Operating System remotely whenever they want, to cause trouble to their targets. But how they can detect me in ...(more)

laurentz1241 gravatar imagelaurentz1241 ( 2022-03-04 19:42:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-02-26 20:49:56 +0000

Seen: 1,185 times

Last updated: Mar 04 '22