Suspicious source for updating time -Akamai? Security hole?

Quick to answer questions about finding your way around Linux Mint as a new user.
Forum rules
There are no such things as "stupid" questions. However if you think your question is a bit stupid, then this is the right place for you to post it. Stick to easy to-the-point questions that you feel people can answer fast. For long and complicated questions use the other forums in the support section.
Before you post read how to get help. Topics in this forum are automatically closed 6 months after creation.
Locked
DennisEHam

Suspicious source for updating time -Akamai? Security hole?

Post by DennisEHam »

My first post -- about 2 weeks after trying out various flavors and birds of Linux, I have been using various networking performance tools. Then I noticed the following output of the lsof -i command this evening.

clock-app 1870 den 19u IPv4 28984 0t0 TCP den-Vista.local:51813->a23-59-191-27.deploy.akamaitechnologies.com:http (CLOSE_WAIT)
clock-app 1870 den 20u IPv4 28986 0t0 TCP den-Vista.local:50457->a23-59-191-72.deploy.akamaitechnologies.com:http (CLOSE_WAIT)
clock-app 1870 den 21u IPv4 30437 0t0 TCP den-Vista.local:50486->a23-59-191-72.deploy.akamaitechnologies.com:http (CLOSE_WAIT)
clock-app 1870 den 22u IPv4 30591 0t0 TCP den-Vista.local:50490->a23-59-191-72.deploy.akamaitechnologies.com:http (CLOSE_WAIT)
clock-app 1870 den 23u IPv4 30593 0t0 TCP den-Vista.local:51848->a23-59-191-27.deploy.akamaitechnologies.com:http (CLOSE_WAIT)

This suggests to me that the Clock 1.4.0 application in Linux Mint 14 MATE is using Akamai as an NTP (Network Time Protocol server) ??? As a newbie, I admit to being deficient in my understanding of Akamai but I thought one of their missions was to gather data and tracking analytics on folks for marketing purposes. I searched the Forum for Akamai, configuring clock-app and did not get any hits on those search terms.

When I went to the developer web site http://matsusoft.com.ar/projects/mate/ , I could not read it, but noticed the following table ~

Caracteristicas

Este escritorio posee caracteristicas que otros escritorios no poseen. O que posiblemente contengan ocultas.

Desktop/OS Bugs Virus Troyan Security Holes Spywares Internet memes
XFCE no no no no no no
KDE no no no no no no
GNOME no no no no no no
Microsoft Windows ? ? ? ? ? no
Mac OSX ? ? ? ? ? no
Matsusoft MATE yes yes yes yes yes yes

(I'm new to this posting stuff, nearly 70 years old) Looks like they say there is a security hole with their clock software for MATE then? I searched the forum for their name Matusoft but also found nothing in the Forum. Surely tho I can't be the first person to notice this?

I have some experience in using several NTP programs in Win 7/XP that we use in amateur radio (hence the 'ham' in my name) for radio propagation delay timing and the like, and am used to choosing the closest NTP servers to me (like Univ of Wash.) But I don't remember Akamai being on the list of 'official' NTP time servers. I also saw some other ESTABLISHED and LISTENING ports I'm following up on but they aren't relevant to this post.

I also wonder why clock-app is using 5 different ports. I have two locations set in it for weather conditions -- where I live and also Seattle. The first time I ran the lsof -i command, the status was ESTABLISHED, i.e. active connection open.

The output below may not be relevant but I included it per my understanding of the Forum guidelines.

-Version-
Kernel : Linux 3.5.0-17-generic (x86_64)
Compiled : #28-Ubuntu SMP Tue Oct 9 19:31:23 UTC 2012
C Library : Unknown
Default C Compiler : GNU C Compiler version 4.7.2 (Ubuntu/Linaro 4.7.2-2ubuntu1)
Distribution : Linux Mint 14 Nadia
-Current Session-
Computer Name : den-Vista (my wife's computer but with my 200-gig secondary drive for Linux--she has the best monitor so I hang out on this machine the most altho MATE and Cinnamon are USB stick on laptop so I can choose which one suits me best--so far, MATE is winning, but I'm really new at this. First tried out MS Xenis on Altos Computer's 1st 8086 in the early 80s when I was in tech sales)
User Name : den (den)
Home Directory : /home/den
Desktop Environment : MATE
-Misc-
Uptime : 1 hour, 15 minutes
Load Average : 0.37, 0.42, 0.42

Thanks...
User avatar
catweazel
Level 19
Level 19
Posts: 9763
Joined: Fri Oct 12, 2012 9:44 pm
Location: Australian Antarctic Territory

Re: Suspicious source for updating time -Akamai? Security ho

Post by catweazel »

DennisEHam wrote:This suggests to me that the Clock 1.4.0 application in Linux Mint 14 MATE is using Akamai
That time server will probably be specified by your ISP. Don't worry about it. Akamai is a huge technology company so it stands to reason you're going to come into contact with them eventually.
(I'm new to this posting stuff, nearly 70 years old)
HA! Spring chicken! I'm 84!

If Akamai worries you still, disconnect from the internet :mrgreen:
"There is, ultimately, only one truth -- cogito, ergo sum -- everything else is an assumption." - Me, my swansong.
glenm
Level 1
Level 1
Posts: 14
Joined: Thu Mar 28, 2013 8:16 am

Re: Suspicious source for updating time -Akamai? Security ho

Post by glenm »

I am wondering if it is the weather option of the clock that could be trying to contact Akamai. Like catweazel says, they are a large hosting and caching service. I tried the lsof -i command myself and at first all it showed was clock connecting to cogeco because I am in Ontario. After searching the web for info about Akamai I ran lsof -i again and it showed Firefox established a connection to Akamai and several others.
One other interesting thing about our lsof -i results for the clock is it is using tcp. I would think the time server function would show ntp and it would only connect momentarily to retrieve the time data. Another reason for me to think it is the weather option.
Have you set your location in the clock applet? The Akamai server in your list is located at Akamai Technologies, Inc., Cambridge, MA.
I am going to see if there is a way to disable the weather option. It allows us not to show it, but it doesn't say it is turned off.
Locked

Return to “Beginner Questions”