Article View: comp.security.firewalls
Article #114Re: Cuervo, I disagree: ShareSniffer Released
From: Earl Ruberts Jr.
Date: Mon, 26 Feb 2001 17:54
Date: Mon, 26 Feb 2001 17:54
41 lines
3351 bytes
3351 bytes
"John Navas" <spamfilter@navasgrp.dublin.ca.us> wrote in message news:8Qum6.4140$S25.63391@typhoon.sonic.net... > [POSTED TO comp.dcom.modems.cable; PLEASE REPLY THERE] > > In <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com>, Never anonymous Bud > <thekat@san.rxyzr.com> wrote: > > >John Navas <spamfilter@navasgrp.dublin.ca.us> opened the coffin lid and croaked... > > > >>A port "scan" is an attempt to connect (enter). If you don't understand > >>that, then I suggest you refer to the RFC's. > > > >Bull. It's ONLY an attempt to see IF there is a service running on that port. > > Bull, yourself -- these are connection attempts. Got a wealth of logs > to prove it. > > -- > Best regards, > John Navas <http://navasgrp.home.att.net/> > CABLE MODEM/DSL GUIDE: <http://Cable-DSL.home.att.net/> Correct me if I am wrong here, One could have fun with log files by writing a "harmless" HTML email in which a person could use a meta refresh tag pointed at a domain name or an IP address but using a nonstandard port or well known trojan port e.g. http://yourdomain.com:8181 this would cause the HTML readers to try to connect with that port to retrieve a web page. Factor in a script that makes this self replicating (e.g. Love Bug) and watch a network admin go crazy thinking people are *trying* to "enter" or "break in" that particular port. While this is certainly not legal or authorized activity, it just goes to show that an innocent person can be a hapless victim of the "port scanner police" :-) Earl
Technical Details
Message-ID:
<6Lwm6.231$cw3.62050@typhoon2.ba-dsg.net>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!newsfeed.utk.edu!washdc3-snf1!news.gtei.net!cyclone1.ba-dsg.net!typhoon2.ba-dsg.net.POSTED!not-for-mailReferences:
<3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <Bzmm6.4119$S25.62449@typhoon.sonic.net> <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com> <8Qum6.4140$S25.63391@typhoon.sonic.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f922c,b3c453f70036b961 X-Google-Attributes: gidf922c,public X-Google-Thread: 10090f,b3c453f70036b961 X-Google-Attributes: gid10090f,public X-Google-Thread: f5dc1,b3c453f70036b961 X-Google-Attributes: gidf5dc1,public X-Google-Thread: 113850,b3c453f70036b961 X-Google-Attributes: gid113850,public X-Google-ArrivalTime: 2001-02-26 09:56:07 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!logbridge.uoregon.edu!newsfeed.utk.edu!washdc3-snf1!news.gtei.net!cyclone1.ba-dsg.net!typhoon2.ba-dsg.net.POSTED!not-for-mail From: "Earl Ruberts Jr." <eruberts@aol.com> Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable References: <3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com> <qO9m6.4024$S25.60081@typhoon.sonic.net> <t5nj9t4vvua0ovclofd9fcidjgfqmjnk2m@4ax.com> <Bzmm6.4119$S25.62449@typhoon.sonic.net> <toak9tkrc8fnsa1kt4nsiu5udammcg60kh@4ax.com> <8Qum6.4140$S25.63391@typhoon.sonic.net> Subject: Re: Cuervo, I disagree: ShareSniffer Released Lines: 43 X-Priority: 3 X-MSMail-Priority: Normal X-Newsreader: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Message-ID: <6Lwm6.231$cw3.62050@typhoon2.ba-dsg.net> Date: Mon, 26 Feb 2001 17:54:10 GMT NNTP-Posting-Host: 151.204.74.111 X-Complaints-To: newsadmin@bellatlantic.net X-Trace: typhoon2.ba-dsg.net 983210050 151.204.74.111 (Mon, 26 Feb 2001 12:54:10 EST) NNTP-Posting-Date: Mon, 26 Feb 2001 12:54:10 EST