Skip to main content

Whiskey Tango Foxtrot

Today is one of those Whiskey Tango Foxtrot kind of days. I've been tracking a real November Sierra since December, and even reported it. I figured it was a bug, so I submitted it to the security folks. Their response? "We're not the team for this problem." ok.

Now today I see two data points, one weird-o one-timer kind of probe. Yup, for real, a solo IP in the gigabytes of logs that my splunk eats. Yet this IP correlates with another IP that has been on my radar.

So I get out my splunk and pull a "deny" query on this IP. Not only does it generate IPS hits from my desktop, outbound to destination, but I see inbound activity from this IP (also denied, of course).

(2017-03-29T17:56:44) firewall: msg_id="3000-0150" Deny 1-Trusted 0-External 9840 tcp 20 64 [desktop_ip] 184.86.92.71 12766 80 offset 5 A 2936268642 win 342 signature_name="WEB-CLIENT WScript.Shell Remote Code Execution -1 (Ransomware A" signature_cat="Access Control" signature_id="1110895" severity="5" geo_dst="USA" msg="IPS detected" (HTTP-proxy-00)

 (2017-03-23T08:35:36) firewall: msg_id="3000-0148" Deny 0-External Firebox 936 tcp 20 56 184.86.92.71 [office-ip] 80 1847 offset 5 A 2554649786 win 913 msg="tcp syn checking failed (expecting SYN packet for new TCP connection, but received ACK, FIN, or RST instead).

 That IP (184.86.92.71) is owned by non-other than Microsoft. They host the OfficeCat update content on Akamai:

(2017-03-29T17:56:45) http-proxy[2026]: msg_id="1AFF-0021" Allow 1-Trusted 0-External tcp [desktop_ip] 184.86.92.71 12768 80 msg="ProxyAllow: HTTP Request categories" proxy_act="HTTP-Client.1" cats="Information Technology" op="GET" dstname="www.microsoft.com" arg="/office/offcat/2.5/en/offcat.nextversion.xml" geo_dst="USA" (HTTP-proxy-00)

I sent email to security at microsoft.com explaining how this first showed up in December during a Visio update (2AM kind of MSFT update). They responded with the "yeah, not our problem," kind of email.

The other November-Sierra involves a fast tripwire that implicated Microsoft again. That one won't go up on the blog until after I get a response from BigSoft's contact.

Fun times.

Popular posts from this blog

Stock Option Debt Income

The 2024 Presidential election has brought out a topic of interest that seems to have been perverted. There is this "Taxing Unrealized Capital Gains" [1] movement that is being falsely attributed to Vice President Harris. Clearly, this is a change in the revenue code that was designed by someone in office long before VP Harris was in office. My money is on Elizabeth Warren and Bernie Sanders. What is this change in the revenue code though? For that you have to understand what Silicon Valley zillionaires are doing with their stock options. Many of these people in this special economic area have huge discounts on stock prices for companies that are not public yet, or are public and can not be sold [2]. To be fair to these holders of equity, banks allow them to finance debt using leverage against those options. If you hold an option that is worth $5M then a bank might lend you a share of that value, thus realizing a debt against the option [3]. This is a fair debt instrument and...
Read more

The Spinning Brain

Intuition is a phenomenon of the biological brain that doesn't have any physical explanation. Many people experience intuition with varying degrees of success. There are a variety of theories regarding intuition [1] and some people regard intuition with much caution [2] . Yet, I am happily in the camp that has learned to respect my intuition as it has proven time and time again to be correct. Recently, though, I'd been thinking about intuition and soothsaying . There are many cases of people who claim to see the future, whatever that might be. Maybe there is something to be said about this mystical phenomenon. Maybe there is a real physical process at work that we just haven't thought of yet. To this end, I am proposing a theory about human intuition. This theory, though requires some background in quantum mechanics . Specifically, quantum entanglement . I'm not the only person who has theorized about quantum entanglement and its role in biological congnition and th...
Read more

UNTITLED

I like people who can talk straight and take it standing. There's not enough straight talkers in the world, and certainly not enough in the USA. It seems as though our opinions are illegal if they are not in-line with the normative line of acceptance. That truly seems Orwellian to me. That said, though, this blog is more about race and ignorance than about the Thought Police. There does not exist a more sensitive and inflammatory topic than race . You should read the Wikipedia entry on race as it pertains to humans. It may enlighten you somewhat. The USA has two presidential candidates in its 2008 Presidential race. One of them is sort of a pinkish-white color, and the other is something of a brown color. The pinkish-white one has an American heritage with clear ancestry back to Northern Europeans. The brownish colored one has an Indonesian heritage with some suspected ancestry back to Africa, although he also has European ancestry. Call them whatever race you want. Where I have ...
Read more