Two suspicious looking networks in Nautilus

[mzsade]

Didn't notice this before because never had a reason to explore "Network" in the sidebar in Nautilus. How did they get there and what can i do to remove them?

[Zero Prime]

Why would you want to remove them? If they are sharing your wireless network they are supposed to be there. Now, if this is your wireless network, and you really have no idea who owns that macbook, you may want to enable security on your router.

[mzsade]

Why would you want to remove them? If they are sharing your wireless network they are supposed to be there. Now, if this is your wireless network, and you really have no idea who owns that macbook, you may want to enable security on your router.

Huh..no wireless, no router, don't even use the modem supplied by the ISP, just plug the jack into the PC. Hence the suspicion. I have since then read somewhere that the Windows Network is there by default. But what about that Gaurav Vadhera's Macwhatever, is that there by default too? LM 9.

[Zero Prime]

By any chance are you in India? Cause here is the Flicker account for the owner of that macbook.

http://www.flickr.com/people/gauravtimefreezeartifacts/

[mzsade]

You are scaring me now, yes i am from India..please tell me how that account could have got here, and how i can remove it.

[ddalley]

Why would you want to remove them? If they are sharing your wireless network they are supposed to be there. Now, if this is your wireless network, and you really have no idea who owns that macbook, you may want to enable security on your router.

Huh..no wireless, no router, don't even use the modem supplied by the ISP, just plug the jack into the PC. Hence the suspicion. I have since then read somewhere that the Windows Network is there by default. But what about that Gaurav Vadhera's Macwhatever, is that there by default too? LM 9.

I think the "Windows Network" is there if you run SAMBA. If you use LM9 Gnome, then chances are SAMBA is still running and "network" will be visible through Nautilus.

If you are not using the router, then you may be on the Internet unprotected. If you are not using the router, then your computer may also be unprotected by a Linux software firewall. One solution? If it has a firewall built into it, use a router, even if you don't plug other things into it. That, at least, will offer you a bare minimum of protection, plus you can better control wireless access to your computer and Internet connection (see below).

Have you tried double-clicking the suspicious macbook node?
What happens?

Do you use a laptop or a desktop?

If a laptop, did you ever connect it to someone else's network, say, at a school?
If a desktop, have you ever plugged in any wireless network adapters or other wireless devices of any kind?
Are any wireless adapters or devices plugged in now?

Is your Linux distro installed on an internal hard drive, or a USB hard drive or mem-stick?

[mzsade]

I think the "Windows Network" is there if you run SAMBA. If you use LM9 Gnome, then chances are SAMBA is still running and "network" will be visible through Nautilus.

Never used samba or wine, had XP on virtualbox before, had a shared folder, so the Windows Network could be from there.

If you are not using the router, then you may be on the Internet unprotected. If you are not using the router, then your computer may also be unprotected by a Linux software firewall. One solution? If it has a firewall built into it, use a router, even if you don't plug other things into it. That, at least, will offer you a bare minimum of protection, plus you can better control wireless access to your computer and Internet connection (see below).

For the last time, i don't use a router, never have, this is a single user, LAN-less, LM9 edition Desktop with ufw enabled by default, and i don't think that without it i am unprotected. I get my connection from an Optical Fibre cable hub/node/whatever which terminates in the terrace above my flat, via a Cat 5 ethernet cable with a RJ 45 jack at the end. As i said before, i have the option of plugging it into the "modem" (glorified splitter) my ISP has provided me, but i don't. I hope i have made everything very clear, it's not a hardware/networking problem related to wireless, routers, etc. I suspect a couple of movie sites that could have lodged this, you know how a new tab opens as soon as you click on a link, and when you try to close it won't until you click OK. I usually kill firefox from the terminal at that point.

Have you tried double-clicking the suspicious macbook node?
What happens?

Why didn't i ever think of that?

Do you use a laptop or a desktop?

If a laptop, did you ever connect it to someone else's network, say, at a school?
If a desktop, have you ever plugged in any wireless network adapters or other wireless devices of any kind?
Are any wireless adapters or devices plugged in now?

Is your Linux distro installed on an internal hard drive, or a USB hard drive or mem-stick?

Replied to above.

And look, it's gone, and now there are two more of them, with different names! What the h**s happening? Would appreciate if somebody who knows the file system better would respond.

[mzsade]

Also followed this neat tip for ufw, for added security, didn't work obviously:
Look in /etc/ufw/before.rules and comment out this line:
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT
Those d*** movie sites, even megavideo links play the same mischief sometimes.

[mzsade]

New information; those imac networks disappear as soon as i unplug the ethernet, and reappear after i reconnect. So it seems my ISP is doing this, is that even legal? And how do i block these? Is is possible that these networks can control my PC or send information from it, out remotely?

[ddalley]

If you are using the Gnome version of LM, then SAMBA should be running, otherwise, with default settings, I doubt you could see the Windows device.

My other leading questions were to find out what you may have attached or used to allow someone to access your computer at some point, network or not, router or not, wireless or not. Since my Linux installs don't have someone else's network devices on my Nautilus nor do I know anyone else to have them, then you have done something or allowed something to access yours.

If you can't solve the infection otherwise, reinstall. Good luck.

[mzsade]

I had already removed samba from synaptic. I apologize if i have offended you with expressions of my frustration, the only people i have allowed access to in unavoidable ways is my ISP. My question is, could the ISP be held accountable, like a big brother thing on the dirty? Also, how can i block that without cutting access to the Internet? How can i block this 'Amar Varma's Imac' everytime i connect to the Internet?

[ddalley]

Nobody really knows what has happened at your end (that's why I asked those questions) and has a definite solution, so since you think your ISP is to blame, why not ask them for help? If your computer is infected with something, they may already know about how to deal with it.

Whatever the solution is, though, please post it here for others to learn from your problem.

[mzsade]

I was planning to, just wanted to eliminate other possibilities before i went ballistic with the customer support of my ISP. I am still in two minds about it though, reliable broadband service is scarce here and i have very few alternatives in my area, besides, those networks are just sitting there, not affecting anything as far as i can tell, so what if they are keeping track of all data and activity of mine, i have no secrets or details that would compromise me (other than my favourite <violates forum rules> site bookmarks ).
Aargh! Is there really no way to block, disable or remove such networks?

Edit: Found the same networks on my LMDE partition too. Couldn't let it go, dashed off a stern email to ISP demanding an explanation. Will keep informed. But it's quite clear that there's no other technical explanation, or is there? I will end up with egg on my face otherwise.

Edit1: Nothing, i got snubbed. First this:

Dear Customer,

Thank you for contacting xxxxxxxxxx xxxxxxx Customer Care.

We regret the inconvenience caused.

This is with reference to your e-mail regarding 'Connectivity Issue'. Kindly note that your complaint has been registered vide Service Request ID xxxxxxxxx and the same would be resolved in the next 24 hours.

Kindly be assured that we would do our best to resolve your concern.

Yours sincerely,

xxxxxxxxxxxx
Broadband Customer Care

Then in response to my calling them spies and also mentally challenged, i got a text message from them saying that my Service Request ID had already been "processed", implying that the matter was resolved from their end and the case closed.
This led me to retrace my steps a little further back; i remember using Bleachbit as root and viking777's forebodings against it. Could that be it? Is there no other way to escape the clutches of these nefarious networks other than by reinstalling? C'mon guys, this is Linux! We are supposed to be able to do what we want with it. There has got to be another way. Tried "rm -f", sudo umount, removed Samba, nothing works..please don't ditch me in my time of need.

[ddalley]

Bleachbit is open sourced, so I would be surprised if it was infected with something potentially exposing.

To me, it is a bit curious as to why the two suspicious "networks" are Mac-based.
Is anyone aware of some Mac-based threat that is suspicious in this manner?

There are no other Google hits for the two names other than this thread, therefore, whatever happened happened at your end. Did your ISP have anything to do with it, as you suggest? I doubt it, and you need better proof if you are going to lay accusations on them.

Experiment: boot from any Linux Live DVD that has Nautilus installed as default (to easily show the network device). Boot and see if these "networks" show up again. If they do appear again with a default install, then you've got something to bargain with (If they do show up again, try once more without the hard drive connected, too.). If they are not there (as I suspect), then I still say you may have to wipe the partition clean and start over (since you don't have a better, clear option, at this point) to eliminate the worry and whatever may be going on.

Once you have a clean install again, then you need do whatever it takes to keep it clean. You will then have some experience to be able to do that.

Alternative: I remember that there are free, on-line security sites which can investigate problems, but you should get better evidence first.

[Beardedragon]

Two questions:
1) is your computer 802.11 capable?
2) are you on a shared network?

See the attached screen shot for an example. My desktop is compatible and I get this every time I click on the Internet Connection Icon in the panel, even though I am connected via Ethernet. I am using DSL, but, the connection is similar.

Screenshot.png

[mzsade]

Bleachbit is open sourced, so I would be surprised if it was infected with something potentially exposing.

To me, it is a bit curious as to why the two suspicious "networks" are Mac-based.
Is anyone aware of some Mac-based threat that is suspicious in this manner?
Experiment: boot from any Linux Live DVD that has Nautilus installed as default (to easily show the network device). Boot and see if these "networks" show up again. If they do appear again with a default install, then you've got..

This was the best piece of advice, should have thought of it myself..guess what, they do show up with the live DVD boot, and with different names each time. Where do i go from here, what authorities do i approach, could this be a technical requirement on the ISP's part and is that why they treated the matter so perfunctorily?

[Beardedragon]

I normally use Thunar for a File Manager, so, I downloaded and installed Nautilus to see what you are up against. (See Attachement) It would appear that your ISP has shared the line you are using with the other users. Unless you have and pay for a dedicated line you can expect this and if you read your ISPs contract it is most likely in there and allowed. Sorry if I did not make this clearer earlier.

Screenshot_Nautilus.png

[mzsade]

I am supposed to have a dedicated connection, the ISP is Reliance Broadband, they are big players, not some local cable network, and i haven't read the fine print but i don't think any sub-clause can dilute the meaning of the word "dedicated". However, seeing that i have very few alternatives as to ISP's, and as long as i am getting the speeds and consistency promised, should i even pursue this further? Would really appreciate some help in making a decision.

[zombieslayer77]

ON A CABLE BROADBAND ISP... ALL USERS ARE ON A "DONUGHT" OR ..RING... HOWEVER YOUR "RING" IS LOCAL TO YOUR AREA WHERE YOU LIVE OR WORK AND HAVE YOUR ACCOUNT INSTALLED AT... SO NOW..ON BROADBAND ISP SERVICE YOU CAN ENTER SOME BROWSER COMMANDS AND ACTUALLY SEE ALL THE USERS ON YOUR ..RING... OR CIRCLE OR LOOP..WHATEVER YOU WANT TO CALL IT.... IN THE LAST FEW YEARS MOST BB ISP HAVE ACTED TO HIDE THE USER RING FROM EVERY ONE...AND WITH EVERYONE ADDING ROUTERS AND HI END FIREWALLS IT HAS BECOME VERY DIFFICULT TO SEE EVERYONE ON YOUR RING... IT APPEARS THAT FOR SOME TECHNICAL REASON YOU ARE SEEING OTHER USERS ON YOUR ...RING..( YOUR LOCAL NETWORK LOOP) ...THIS ISNT NESSASAIRLY BAD...ITS JUST ..SLOPPY ISP WORK... AND JUST BECAUSE YOU CAN SEE THE OTHER USERS DOES NOT MEAN THEY CAN SEE YOU... YOU COULDNT SEE THEM AT ALL UNTIL YOU WANDERED INTO THE DEEP DARK DUSTY CORNER OF LINUX... THEY PROBABLY ARE NOT EVEN RUNNING LINUX.... SO .. IM BETTING THAT WHAT YOUR SEEING IS HARMLESS.... WE USED TO SEE HUNDREDS OF OTHER USERS ON CABLE BROADBAND JUST SEVERAL YEARS AGO... IF YOU KNEW HOW TO TYPE SOMETHING INTO THE BROWSWER IN THE RIGHT WAY BACK THEN.....

[thouartsimple]

I am supposed to have a dedicated connection, the ISP is Reliance Broadband, they are big players, not some local cable network, and i haven't read the fine print but i don't think any sub-clause can dilute the meaning of the word "dedicated". However, seeing that i have very few alternatives as to ISP's, and as long as i am getting the speeds and consistency promised, should i even pursue this further? Would really appreciate some help in making a decision.

As long as you don't share any files, you should be a-OK. I wouldn't bother...