Page 1 of 1
Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 6:10 am
by leigh
Hi All,
I came in this morning and found this from Little Snitch:
In Date & Time preferences, I have the system set to use "time.nist.gov".
According to IPillion.com, "The IP address 172.246.126.134 belongs to Enzu ISP in San Francisco (California, CA), United States (37.7748985291 and -122.419403076). The hostname is mail1.watchesofhongkong.com."
Any suggestions about what to look for on my system?
**Leigh
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 6:40 am
by Phil O
This may shed some light:
http://apple.stackexchange.com/question ... connection
NIST.gov may use a pool as well. I don't know. If nothing else, it may give you some ideas of what to search for. Hope it helps.
Phil
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 8:57 am
by bayswater
Some Whois lookups say the site is hosted in Guangdong province in China. Different info from what you found.
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 9:02 am
by leigh
bayswater wrote:Some Whois lookups say the site is hosted in Guangdong province in China. Different info from what you found.
That's a bit more disturbing.
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 9:52 am
by cuttime
A quick search of mail1.watchesofhongkong.com quickly took me to places I didn't want to go, including places that Chrome tried to automatically block. I understand your concern. If I was in your shoes I'd start by opening Activity Monitor and try to identify every process running. Open in safe mode, lather rinse, repeat. I'd then use FindAnyFile:
http://apps.tempel.org/FindAnyFile/
and search for the strings "genieo" and "installmac".
I'd then run
http://www.adwaremedic.com/index.php
I'd finish off with a cocktail of virus scanners, including ClamXav.
Good info here:
http://www.thesafemac.com/
Good Luck!
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 10:05 am
by mikehalloran
That's a bit more disturbing.
Why? Because you don't understand it?
In that case, there are many, many processes in your Mac that can worry you. The best course is to learn what they are.
Do you know what UDP protocol is? Do you know what /usr/sbin/ntpd does? Both are easily searched.
Anyway, ntpd is the Network Time Protocol Daemon for UNIX. It will broadcast to all servers over UDP. Apparently, there's a time/date server in China on UDP port 41718. Imagine that. The ntpd requests time and date data–that's all it does. Servers, likewise, are broadcasting the same. Without this, your Mac can't keep time.
Read this for some understanding of UDP:
http://www.diffen.com/difference/TCP_vs_UDP
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 10:07 am
by mikehalloran
cuttime wrote:A quick search of mail1.watchesofhongkong.com quickly took me to places I didn't want to go, including places that Chrome tried to automatically block. I understand your concern. If I was in your shoes I'd start by opening Activity Monitor and try to identify every process running. Open in safe mode, lather rinse, repeat. I'd then use FindAnyFile:
http://apps.tempel.org/FindAnyFile/
and search for the strings "genieo" and "installmac".
I'd then run
http://www.adwaremedic.com/index.php
I'd finish off with a cocktail of virus scanners, including ClamXav.
Good info here:
http://www.thesafemac.com/
Good Luck!
Well, that would be a nice way to waste a lot of time. Read my other post.
Really, the sky is
not falling. Learn what things are before trying to chase the non-existant boogiemen away.
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 1:42 pm
by leigh
mikehalloran wrote:That's a bit more disturbing.
Why? Because you don't understand it?
In that case, there are many, many processes in your Mac that can worry you. The best course is to learn what they are.
Do you know what UDP protocol is? Do you know what /usr/sbin/ntpd does? Both are easily searched.
Anyway, ntpd is the Network Time Protocol Daemon for UNIX. It will broadcast to all servers over UDP. Apparently, there's a time/date server in China on UDP port 41718. Imagine that. The ntpd requests time and date data–that's all it does. Servers, likewise, are broadcasting the same. Without this, your Mac can't keep time.
Read this for some understanding of UDP:
http://www.diffen.com/difference/TCP_vs_UDP
I have been using some form of Unix since 1983.
The well-known port for NTP is 123.
I do understand what NTP is and how it works. I know that it requests only time and date data. I understand that this is how my Mac (and most computers in the world) keep accurate time. I understand the difference between UDP and TCP.
What I don't understand is why my NTP daemon would be trying to connect to an NTP server at mail1.watchesofhongkong.com on port 41718. I couldn't find a way to check it at ntppool.org. What would be helpful to me is to tell me how to check to see if it's in a legitimate server pool used by time.nist.gov.
**Leigh
Re: Suspicious Outbound NTPD Connection
Posted: Mon Dec 29, 2014 11:39 pm
by James Steele
mikehalloran wrote:Really, the sky is not falling. Learn what things are before trying to chase the non-existant boogiemen away.
I'm really trying to make this a friendlier place. If someone has made a mistake, if the correction could be less like scolding, I think that would be nice. Thanks.
Re: Suspicious Outbound NTPD Connection
Posted: Sun Jan 11, 2015 5:25 pm
by cuttime
Re: Suspicious Outbound NTPD Connection
Posted: Sun Jan 11, 2015 10:11 pm
by bayswater
The first link gave me an impenetrable article. The second gave me an equally opaque blank page.
Re: Suspicious Outbound NTPD Connection
Posted: Sun Jan 11, 2015 10:11 pm
by billf
It definitely is a security issue. There was a security update issued by Apple on December 22nd for this.
https://support.apple.com/en-us/HT6601
Re: Suspicious Outbound NTPD Connection
Posted: Mon Jan 12, 2015 6:56 pm
by BKK-OZ