Re: Chinese dot-dot-slash attack on Windows 2000/IIS

[Andrew Daviel <advax () TRIUMF CA>]

On Fri, 12 Sep 2008, Justin Azoff wrote:

> Can't comment on the rest, but "B.A.C.K.D.O.O.R" was most likely just
> the utf-16 representation of "BACKDOOR".. the .'s were probably 0x00

Yes, they were 0x00.
.. ah.. I just compared the log to a capture of myself logging on
using rdesktop.
It's just the local name of the computer used to login. One mystery
solved (either that's the name of their computer, or probably they are
coming through a trojan proxy that sets the machine name to that string.)


--
Andrew Daviel, TRIUMF, Canada
Tel. +1 (604) 222-7376  (Pacific Time)
Network Security Manager