I have been having some fun messing around with Apache running on an Ubuntu Server. It is set up as a global web server and shares some files that I can access anywhere. I am also using it to connect to my music and play it via my Android phone when away from my house. It also houses shares that are only visible to my local network.
I set logwatch up a few weeks ago and have logs sent to me every morning via email. Every now and then I am seeing this in my logs (or something very similar).
Attempts to use known hacks by 1 hosts were logged 3 time(s) from: <Routers local IP Address>: 3 Time(s)
Logwatch shows no successful attempts were made and I am pretty sure I am not really being hacked. But what would cause my routers local IP address to show up in logwatch as a threat?
Is it secretly out to ruin me
Just some other tidbits about the network:
- My Router hides my home network behind a NAT
- I do develop on Android and make connections to it via the emulator in Eclipse as well as from my phone.
- My phone as well as home PCs connect to the web share to stream music and download files (globally and locally)
I can't seem to pinpoint exactly what is causing this..
- Bad android code?
- The fact that the server shares locally and globally?
- Accessed from a cell network?
EDIT: More about my architecture
My home network is behind my routers NAT (router local IP is .1). I have a laptop and a desktop both who have static IPs. My desktop can connect wireless and wired. I also have a Wii that connects when it needs to go online etc. The below is the table from my router showing what has connected.
.2 <MAC ADDRESS> expired (This is my Desktops Wireless Conn.) .3 <MAC ADDRESS> Forever (This is my laptop) .4 <MAC ADDRESS> Forever (This is my Desktop Wired Conn.) .8 <MAC ADDRESS> Forever (This is my Wii) .5 <MAC ADDRESS> Forever (This is my phone)
I matched all of the MAC addresses to a device in my home.
I have also looked at the logs the router records (to long to post) but the only IPs there are that of devices in my house.
Edit: More Router info
- EnGenius ESR9850
- NAT is enabled
- Router firewall is enabled
- The router supplies two different SSIDs(but this shouldn't be causing a problem)
- The router has port forwarding and forwards port 80 to a higher number port and forwards it to the server at .6)
- The router is set to only allow IPs from .2 - .10 to make a connection.
- The router and each SSID are password protected (all different passwords)
Edit: Received another hack attempt
Today I received the following
Attempts to use known hacks by 1 hosts were logged 1 time(s) from: X.X.X.X: times(1) A total of 1 sites probed the server X.X.X.X
The IP listed is clearly a global IP address and not that of my router.
From the answers below it seemed that I would only be seeing the routers IP as the "hacker". How come in this case it shows a global IP.
Note: This global IP is not the global IP of my NAT nor is it the global IP of my smart phone.