3 ms·
Ask HN: Is My Machine Hacked?
I was prototyping flask applications on my macpro and today I noticed unusual logs. GET calls I didn't make. I am running the simple flask app on localhost with port 80.
The weird thing is each time I launch Chrome or Firefox and surf the web, the GET calls show up in my flask logs. I disabled all the extensions and they still show up. I wrote another simple flask app running on port 80 and its still the case.
Here are the standard output..
* Serving Flask app "test" (lazy loading)
* Environment: production
WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: off
* Running on http://0.0.0.0:80/ (Press CTRL+C to quit)
127.0.0.1 - - [27/Mar/2021 22:04:18] "GET /V3/02/1-f8a.3-1a8f.6-b0d.8-91c.a-eaf.c-50f.e-f1f.10-24.13-2.17-1.18-1ace.19-4e.2d-1429.32-bf3.100-a51.102-1a8.107-b4e.605bc56d.0816459f741140a69fc8fb47c66bdeb377c21c3accc248ff9356fc356bb0d19.g/142.12.217.172.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:18] "GET /V3/01/3.113.82.140.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:29] "GET /V3/01/78.64.250.142.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:30] "GET /V3/01/246.9.217.172.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:37] "GET /V3/01/14.80.250.142.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:38] "GET /V3/01/79.215.117.63.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:04:39] "GET /V3/01/131.165.217.172.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:05:20] "GET /V3/01/164.12.217.172.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:05:26] "GET /V3/01/240.230.216.209.ip/ HTTP/1.1" 404 -
127.0.0.1 - - [27/Mar/2021 22:06:17] "GET /V3/01/74.64.250.142.ip/ HTTP/1.1" 404 -
- fireeyed 6y agoUpdate: After eliminating all candidates - browser extensions, vscode, npm packages, I finally disconnected my pihole power supply and these GET calls stopped. The macpro is not using the pihole, is it possible the pihole is compromised is calling all ip ranges with port 80 ? I configured my flask app to run on port 0.0.0.0
- sigmaprimus 6y agoMaybe Pihole blocking updates/version checks for flask app? Many of the calls seem to be 404 errors, they may be getting through when PiHole or DNS server is offline? Any reason your not using 127.0.0.1 IP for local host?
- fireeyed 6y agoDoesn't seem to be pihole calls. Pihole was running on a Raspberrypi connected to the main router. I am thinking a malware somehow got on the RPi is calling anything on the network with a port 80 with the calls I mentioned above.
- sigmaprimus 6y agoOh ok, I thought that snippet was from an error log hence the reason the calls were not being displayed once the blocker was powered off. It is my understanding that the RPI takes over DNS service when powered on instead of the router, in effect forcing the router into a switch, but if the Pi is offline the router reverts back to being the gateway and probably would allow the GET calls through. I haven't used PiHole but it looks like a practical use for one of my PIs currently collecting dust. Other than this issue how have You found it? Does it do a good job of blocking adds?
- sigmaprimus 6y agoYou may be right 74.64.250.142 is listed on S.O.R.B.S, my tablet battery is dying so can't check them all. But You might want to search the other IPs on https://whatismyipaddress.com/ https://whatismyipaddress.com/