Pfsense found docker process

aaronouthier

Even scarier: The ptr record for 104.244.77.92 points to nasa.gov.

I don’t know which is more disturbing: The thought that the US Feds did this, or the thought that their server might be compromised!??!

I don’t know. Can a ptr record be spoofed?

aaronouthier

@aaronouthier

Thinking about it some more, the ptr record is certainly spoofed. Probably attempting misdirection.

aaronouthier

@aaronouthier
If your box wasn’t accessible from the outside, then something inside maybe compromised, or perhaps a visitor’s device was compromised and launched an attack on your router while on your network.

stephenw10

Mmm, it would be very interesting to see what's in those script files.

Seeing this error log on a box with 16GB RAM:

[zone: pf states] PF states limit reached\

Implies it's moving a lot of traffic.

Steve

Bob.Dig

I knew it, one day docker would come to pfSense...

johnpoz

@bob-dig hahah

johnpoz

@stephenw10 Yeah I bet ;)

Other then curiosity on what it is, and how it got there being the biggest question. I would wipe this box for sure.. This is clearly not something you setup. And everything points to nefarious use.. The IPs are hosted vps, and you got some weird ass PTR setting nasa.gov - yeah ok ;)

And the one IP is a tor exit node..