Is this hacking activity?
Is this definitely someone hacking my stuff, and not just Norton Internet Security not playing well with Trend Micro Housecall? I understand everything is configured poorly and needs redone. Just trying to figure out what is already compromised.
This is from a desktop with Windows 10, Norton Lifelock security trial, Trend Micro Housecall, Windows Defender. I used Teamviewer at one point to coordinate between the two desktops and it has still been running in startup.
Hardwired to Netgear Nighthawk AX6 (wifi is currently disabled, am using Netgear Armor), wired to Google fiber "network box." Google hands out the IP and it seems to stay the same from day to day. MAC address on network box is fixed, wifi disabled. Also attached to the Netgear router are a brother printer that has unsafe wifi (not sure how to disable wifi), an android phone, a hardwired windows 8 desktop, an android phone on wifi.
When I look at the Netgear logs, it always has Fraggle and Smurf attacks from 192.168.1.1 and from 10.x network addresses (when I've researched it has been suggested these are false alarms), and occasional port scans or other attacks that are real but appear to be random.
Anyway, this Norton Security data has me concerned. I think I've removed sensitive data like actual ip or mac addresses, let me know if I'm wrong:
Category: Intrusion Prevention Date & Time,Risk,Activity,Status,Recommended Action,IPS Alert Name,Default Action,Action Taken,Attacking Computer,Attacker URL,Destination Address,Source Address,Traffic Description,Category
9/19/2020 12:47:27 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,OS Attack: Microsoft Windows CVE-2015-1635,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 65305)",kbuoynmn/,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 65305",
9/19/2020 12:46:22 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51609)",10.0.0.5/../../../../../etc/shadow,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51609",
9/19/2020 12:46:20 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: D-Link Router Information Disclosure,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51606)",10.0.0.5/model/__show_info.php?REQUIRE_FILE=/vaetc/httpasswd,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51606",
9/19/2020 12:46:20 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51603)","10.0.0.5/cgi-bin/webproc?getpage=../../../../etc/passwd&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard","10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51603",
9/19/2020 12:46:00 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Passwd File Download Attempt 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51581)",10.0.0.5/scgi-bin/platform.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51581",
9/19/2020 12:45:32 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51558)",10.0.0.5/apply.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51558",
9/19/2020 12:45:24 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51551)",10.0.0.5/apply.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51551",
9/19/2020 12:45:03 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: CCTV-DVR Remote Code Execution 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51533)",10.0.0.5/cgi-bin/nobody/Machine.cgi?action=get_capability,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51533",
9/19/2020 12:44:42 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Netgear Router Authentication Bypass,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51510)",10.0.0.5/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=cat+/www/.htpasswd&curpath=/¤tsetting.htm=1,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51510",
9/19/2020 12:44:36 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Asuswrt Remote Command Execution CVE-2014-9583,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 57473)",,"I3-2120T (10.0.0.3, 9999)",3600-32-3600 (10.0.0.4),"UDP, Port 57473",
9/19/2020 12:44:36 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,OS Attack: Microsoft Windows Remote Desktop Services RCE CVE-2019-0708,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51498)",,"I3-2120T (10.0.0.3, 3389)",3600-32-3600 (10.0.0.4),"TCP, Port 51498",
9/19/2020 12:44:36 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Asuswrt Remote Command Execution CVE-2014-9583,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 57471)",,"I3-2120T (10.0.0.3, 9999)",3600-32-3600 (10.0.0.4),"UDP, Port 57471",
9/19/2020 12:44:26 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,OS Attack: Microsoft Windows CVE-2015-1635,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51477)",smifmnli/,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51477",
9/19/2020 12:44:24 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51464)",10.0.0.1/../../../../../etc/shadow,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51464",
9/19/2020 12:44:22 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: D-Link Router Information Disclosure,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51459)",10.0.0.1/model/__show_info.php?REQUIRE_FILE=/vaetc/httpasswd,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51459",
9/19/2020 12:44:20 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Netgear Command Injection Activity,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51456)",10.0.0.5/boardDataWW.php,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51456",
9/19/2020 12:44:20 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51454)","10.0.0.1/cgi-bin/webproc?getpage=../../../../etc/passwd&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard","10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51454",
9/19/2020 12:44:18 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Passwd File Download Attempt 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51437)",10.0.0.1/scgi-bin/platform.cgi,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51437",
9/19/2020 12:44:15 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51419)",10.0.0.1/apply.cgi,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51419",
9/19/2020 12:44:13 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51415)",10.0.0.1/apply.cgi,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51415",
9/19/2020 12:44:11 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: CCTV-DVR Remote Code Execution 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51398)",10.0.0.1/cgi-bin/nobody/Machine.cgi?action=get_capability,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51398",
9/19/2020 12:44:08 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Netgear Router Authentication Bypass,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51388)",10.0.0.1/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=cat+/www/.htpasswd&curpath=/¤tsetting.htm=1,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51388",
9/19/2020 12:44:06 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Netgear Command Injection Activity,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51378)",10.0.0.1/boardDataWW.php,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51378",
9/19/2020 12:44:05 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: HP Printer Remote Code Execution CVE-2017-2741 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51363)",,"10.0.0.5, 9100",3600-32-3600 (10.0.0.4),"TCP, Port 51363",
9/19/2020 12:44:05 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: D-Link Router Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51368)",10.0.0.5/command.php,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51368",
9/19/2020 12:44:03 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: D-Link Router Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 51356)",10.0.0.1/command.php,"10.0.0.1, 80",3600-32-3600 (10.0.0.4),"TCP, Port 51356",
9/19/2020 12:44:03 AM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Asuswrt Remote Command Execution CVE-2014-9583,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 62893)",,"3600-32-3600 (10.0.0.4, 9999)",3600-32-3600 (10.0.0.4),"UDP, Port 62893",
9/18/2020 3:33:36 PM,Info,Intrusion Prevention has been enabled,Detected,No Action Required,,No Action Required,No Action Required,,,,,,Intrusion Prevention
9/18/2020 3:33:36 PM,Info,Intrusion Prevention Engine version: 9.0.4.10 Definitions Set version: 20200918.061,Detected,No Action Required,,No Action Required,No Action Required,,,,,,Intrusion Prevention
9/18/2020 3:33:36 PM,Info,Intrusion Prevention is monitoring network traffic. Driver version: 17.2.3.38,Detected,No Action Required,,No Action Required,No Action Required,,,,,,Intrusion Prevention
9/17/2020 8:38:15 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,OS Attack: Microsoft Windows CVE-2015-1635,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59759)",lpdnuccv/,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59759",
9/17/2020 8:37:04 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59725)",10.0.0.5/../../../../../etc/shadow,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59725",
9/17/2020 8:37:01 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: D-Link Router Information Disclosure,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59723)",10.0.0.5/model/__show_info.php?REQUIRE_FILE=/vaetc/httpasswd,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59723",
9/17/2020 8:37:01 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Passwd File Download Attempt,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59720)","10.0.0.5/cgi-bin/webproc?getpage=../../../../etc/passwd&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:login=true&var:page=wizard","10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59720",
9/17/2020 8:35:54 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Attack: Passwd File Download Attempt 2,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59684)",10.0.0.5/scgi-bin/platform.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59684",
9/17/2020 8:35:25 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59664)",10.0.0.5/apply.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59664",
9/17/2020 8:35:18 PM,High,An intrusion attempt by 3600-32-3600 was blocked.,Blocked,No Action Required,Web Attack: Linksys Router Remote Code Execution,No Action Required,No Action Required,"3600-32-3600 (10.0.0.4, 59659)",10.0.0.5/apply.cgi,"10.0.0.5, 80",3600-32-3600 (10.0.0.4),"TCP, Port 59659",
9/17/2020 8:34:55 PM,High,An intrusion attempt by 360
submitted by
RustStainRemover to
HomeNetworking