Possible network intrusion?

minikin

Hi folks,

Have eir fibre here with the standard F2000 modem, firewall set to medium.
I've had some credit card fraud lately - so did a bit of digging, found the following samples of activity in the modem logs:

2016-05-09 07:09:40
Security
Warning
Intrusion -> SRC=78.188.81.46 DST=86.44.24.130 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=61883 DFPROTO=TCP SPT=39287 DPT=23 WINDOW=5808 RES=0x00 SYNURGP=0

2016-05-09
15:08:18
Security
Warning
Detect UDP port scan attack, scan packet from 192.168.1.11. (which is a wintel laptop, all other machines are macs)

I tried changing the firewall to 'high' but that caused issues with emails / other cloud-based software.

Something to be worried about? All machines have software firewalls enabled and McAfee activated. A separate hardware firewall required?

scamalert

Seems somewhat common thing on fiber ?
But following this site and the link within should clear it up for you and probably harmless,since as explained seems like some sort of reverse dns attack to obtain host pc name.heres link if it helps and test in there as well to check if router is vulnerable.

http://community.talktalk.co.uk/t5/Superpowered-Fibre-Broadband/Network-Intrusion-In-System-Logs/m-p/1641796

minikin

Thanks for the link!

scamalert

Np seems some interesting flaw,but most routers are patched,thus could be just log of attempts.