0

I hope I can get some help with a rather strange problem on my late 2013 MacBookPro running Yosemite 10.10.1

Up until 3 days ago, I could ssh into my server without any problems. I then updated to 10.10.1 and started to see some strange behaviour. At first I didn't notice, but it turns out I can not connect to remote ssh-boxes anymore. Local connections (including those via open-vpn tun-interface to a remote host) seem to work fine though.

Looking at a TCP dump when trying to connect to a box via internet revealed the following strange fact:

my.internal.ip.address.50596 > gl02.opentracker.net.ssh: Flags [S], cksum 0x7b7d (correct), seq 4179750266, win 65535, options [mss 1460,nop,wscale 5,nop,nop,TS val 958226379 ecr 0,sackOK,eol], length 0

Doing the same one an up-to-date Mavericks box shows no signs of "gl02.opentracker.net" address and everything works just as it should be.

Since I cannot find a way to prevent (or even change/turn off) this "feature" on my MacBookPro, I consider this to be HARMFUL and an unwanted intrusion / exploitation (go take a look at ww.opentracker.net - I do NOT want to be anal-yzed by those guys!!!).

So here are my questions:

  1. Why is my Mac trying to connect to "gl02.opentracker.net"?
  2. Where does this behavior come from?
  3. How can I turn this off?
  4. Is this a malicious attempt to break my security? (--> thinking "Root-Pipe" exploit I heard about)
  5. If so, where do I find people with proper digital-forensics knowledge and further information about this subject?

If you need more information regarding the configuration of my machine, please tell me which commands to run / config-files to provide to help track down this issue.

Thanks.

Improve this question
1
  • Please add the interface you connect through and the DNS servers configured, for you 2 compared connections (Mavericks & Yosemite).
    – dan
    Dec 14, 2014 at 0:01

1 Answer 1

Reset to default
1

opentracker.net is a service provider that offers analytics. My guess is that your redirection happens when you are connected to a network provider that internally uses opentracker.net.

I suggest you try again from another network provider.

Improve this answer
1
  • I have a Mavericks box on the same network, going through the same provider (so it basically is the same infrastructure I'm using) and it works perfectly! No ssh-redirection! Just open Terminal, type "ssh -l my.user x.x.xxx.xxx -v", get connected. So this has to be Yosemite-specific OR someone dropped me a nice exploit.
    – GlotzerHotze
    Nov 21, 2014 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .