dangers of public proxy servers

[george12pds]

I strarted using switch proxy extension in Mozilla firefox to learn
about proxy servers. I'm reasonably careful, and am sitting behind a
nat router and sygate firewall. I got this warning from sygate

ntoskrnl.exe is being contacted from a remote machine 195.141.64.150

Sure enough, this was one of the proxies I was using. Why this server
wants to talk to my kernal, and how it got past the nat router, is
something I'll have to consider

Moral... use a firewal, the nat router is not sufficient

Here are the details


ile Version : 5.0.2195.6902
File Description : NT Kernel & System (NTOSKRNL.EXE)
File Path : C:\WINNT\system32\NTOSKRNL.EXE
Process ID : 0x8 (Heximal) 8 (Decimal)

Connection origin : remote initiated
Protocol : TCP
Local Address : xxx.xxx.xxx.xxx:xxx
Local Port : 1812 (RADIUS - RADIUS Authentication Protocol)
Remote Name :
Remote Address : 195.141.64.150
Remote Port : 80

Ethernet packet details:
Ethernet II (Packet Length: 60)
Destination: xxxxxxxxxxxxxxxxx
Source: XXXXXXXXXXXXX
Type: IP (0x0800)
Internet Protocol

 

[REM]

george12pds <[email protected]> wrote:

195.141.64.150

OrgName: RIPE Network Coordination Centre
OrgID: RIPE
Address: Singel 258
Address: 1016 AB
City: Amsterdam
StateProv:
PostalCode:
Country: NL

Does this sound as if it might be a proxy?

It looks like they have the entire 195.xxx.xxx.xxx block of addresses, so it's
possible. Yet, talking to your kernel?

 

[derek / nul]

The radius server on the proxy requested a logon,

Hardly anything to worry about.

 

[george12pds]

The radius server on the proxy requested a logon,

Hardly anything to worry about.

thanks... but how did you figure it requested a logon?

 

[derek / nul]

thanks... but how did you figure it requested a logon?

The port number is the radius logon request port