One could think of some hacker that uses ifconfig to set up a virtual
interface in
order to use that with IRC bots or the like, but the problem here is that
IPs which
are off your netblock (given that you have a network with public IP
addresses)
are generally not routed to you, therefore it would be completely useless
to
set up such interface; one could not use it to connect to anywhere. Usually
one
can not even send out packets from a IP that is not inside the site's
official
netblock since most ISPs are now performing egress filtering on theyre
border
routers, allowing only traffic to pass to the outside that originates from
the
ISP's assigned IP range.
Cheers
Chris
.-.
/v\ L I N U X
// \\ >I know KungFu!!<
/( )\
^^-^^
|--------+----------------------->
| | Markus Kohli |
| |
--------------------------------------------------------------------------------------------------------------------------| | | | An: suse-security@suse.com | | Kopie: "Stefan Nauber"
| | Thema: Re: [suse-security] unknown network interface showed up suddenly | --------------------------------------------------------------------------------------------------------------------------|
I'd bet it was some "sit 6" interface, or something like this. Showed up on my laptop once, too. In my case it was related to an SSH-tunnel I had openend. Could that match your case, too? I just don't think some remote attacker installed a new interface... Doesn't make to much sense IMO.
Greetz
Markus