Security Basics mailing list archives

re: Is this a scanner?


From: H C <keydet89 () yahoo com>
Date: Thu, 12 Dec 2002 11:14:25 -0800 (PST)

Back to the question: Does the log show a new
scanner at
work, or is it merely a browser with these values
set 
for anonymous logins? If it were the latter, I don't
see 
why it would have an email address as both the
username 
and password.

Without more log entries, it's hard to tell.  Yes, it
*could* be a scanner (based on the time stamps, it
looks pretty automated), but it *could* also be
someone's browser.  Why does it have an email address
in both the username and password?  Well, w/ all of
the misconfigured machines out there, is it any wonder
that some dude misconfigured his browser's anon-FTP
entries?

I read your "welcome" msg:
220 All connection attempts logged/reported. Anyone 
attempting to log in will be reported to their ISP. 

Access illegal unless prior permission recieved from
owner of FTP server.

Wow, you really are an aspiring BOfH!  You're msg says
that you will report *anyone* trying to log in, to
their ISPs, regardless!  So you're actually planning
to take the time to report everyone who logs in, even
legit users?!  Wow!  Yeah, I know you say your little
blurb about "illegal" access, but that somes after
your other message...sheesh, dude!  You're hard core!





__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com


Current thread: