Re: Cuervo, I disagree: ShareSniffer Released

Article View: comp.security.firewalls

Article #232

Back to comp.security.firewalls Previous Next

#232

From: Hal Burgiss
Date: Sun, 25 Feb 2001 01:19

36 lines
2650 bytes

>Port scanning is like flipping thru magazines at a newspaper stand.
>Problems arise when users on Network connected machines don't
>understand or realize that their OS has setup a newstand and is
>providing some pamphlets and newspapers w/o telling them so.

So far this week, these are the TCP magazine readers:

port                 count
21                   14
21519                11
139                  8
53                   6
27374                6
111                  5
1080                 4
1243                 3
23                   2
143                  2
22                   1
515                  1

I don't log port 137, and few others that are intentionally left open. I
would bet dollars to doughnuts that all of these are looking for known
vulnerabilities with the intention of letting themselves in, and
probably most (or all?) are originating from an already cracked box. The
high count for FTP is probably the Ramen worm at work. No way in the
world is that legitimate traffic. 



-- 
Hal B
 hal@foobox.net
 hal@burgiss.net
 hburgiss@bellsouth.net
--

Technical Details

Message-ID: <slrn99gndj.ibf.hal@localhost.localdomain>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!newsflash.concordia.ca!sunqbc.risq.qc.ca!feeder.qis.net!feed2.news.rcn.net!rcn!newsfeed.atl!news1.atl.POSTED!localhost!hal

References:

<3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-ArrivalTime: 2001-02-24 17:26:03 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!nntp.cs.ubc.ca!newsflash.concordia.ca!sunqbc.risq.qc.ca!feeder.qis.net!feed2.news.rcn.net!rcn!newsfeed.atl!news1.atl.POSTED!localhost!hal
From: hal@burgiss.net (Hal Burgiss)
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Cuervo, I disagree: ShareSniffer Released
References: <3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> <OTul6.2816$L04.327284@newsread2.prod.itd.earthlink.net> <jtvl6.1306$aA5.364833@typhoon2.ba-dsg.net> <97656j$d8f$2@news.panix.com> <WqBl6.3899$S25.55097@typhoon.sonic.net> <qvig9tobv9597b8fmhp5bohg701i8ftbtk@4ax.com>
Reply-To: Hal Burgiss <hal@foobox.net>
Message-ID: <slrn99gndj.ibf.hal@localhost.localdomain>
User-Agent: slrn/0.9.6.2 (Linux)
X-Original-NNTP-Posting-Host: 127.0.0.1
X-Original-Trace: 24 Feb 2001 20:19:47 -0500, 127.0.0.1
Lines: 36
Date: 24 Feb 2001 20:19:47 -0500
NNTP-Posting-Host: 216.78.197.8
X-Trace: news1.atl 983063988 216.78.197.8 (Sat, 24 Feb 2001 20:19:48 EST)
NNTP-Posting-Date: Sat, 24 Feb 2001 20:19:48 EST

Reply to Parent Message