Free Republic
Browse · Search
News/Activism
Topics · Post Article

To: AnonymousGuy
They are IP ranges.

They're clearly ranges of some sort - IP ranges sound likely but I'm not quite convinced.

To followup on my previous message, I think given the allocation of Internet addresses, anything starting with 67.* (43 hexadecimal) is likely to be a US ISP address. So if the ranges happen to start out with a 67 (hex 43) for some other reason, it would be quite possible for the ranges to appear to correspond with IP ranges.

But what else could they be? Times? Longitude/Lattitude? They can't be very heavily encrypted because they're just too regular, but that doesn't mean that there couldn't have been some trivial code applied to them. Unfortunately there isn't enough ciphertext to provide a very solid clue other than the (likely good) guess that they're IP addresses.

2,643 posted on 10/13/2005 11:57:37 AM PDT by brucecw
[ Post Reply | Private Reply | To 2605 | View Replies ]


To: brucecw

The dates are when the messages were posted. Each post (on the given date) was merely the hex code. A hacker doing a sequential scan of IPs, probing for some vulnerability (or previous infection) will most likely find it on computers that are always connected to the internet (like a brodband connection). When one or more "targets" are found, it is reported to the bad guy, but the test needs to be reran to verify the IPs. They must be verified since most broadband connections are using dynamic IPs as opposed to static ones, you are going to come across ranges where one or more infected or vulnerable machines are connected, but over time the IP(s) will change. Hence, if you want to post to a group of partners the computer(s) you found, you can't post an IP for each one but the IP range.


2,646 posted on 10/13/2005 12:13:38 PM PDT by AnonymousGuy
[ Post Reply | Private Reply | To 2643 | View Replies ]

Free Republic
Browse · Search
News/Activism
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson