Re: Beagle trojan attack acussed by my ISP

[Joe Shaw <joeshaw novell com>]

Hi,

On Tue, 2006-04-04 at 15:11 +0200, Zunbeltz Izaola wrote:
> My Internet Servcie Proveider (telefonica.es) has send me a letter. The
> say that the have detected some attack in their machines from my
> computer. They say that they have detected to a trojan called Beagle.D.
> 
> Since i run linux almost everytime (and in the exact day and hour they
> detected the attack my machine was running Ubuntu dapper) I suposse that
> it should be something related to the beagle  daemon.
> 
> Someone has been in the same situation?

An April Fools joke, maybe?

By default, Beagle doesn't open any ports or make any remote
connections.  If you're running an old version of Beagle, you might have
the webservices running, which opens a couple of ports but handles HTTP
connections.  If you patched the source and set a Google API key, you
might be using the Google search driver.  Most likely?  You have
neither.  And even if you did, a trojan it isn't, and those features are
so obscure that there's no way they've been exploited.

Either your ISP is wrong, or you do have a Windows machine on your
network that has it.  Do you have an open wireless network?  Shame on
you. ;)

Joe