Security Incidents mailing list archives
Re: Scans from udel.edu and tue.nl
From: mhallacy () MERCURY XTRATYME COM (Matthew S. Hallacy)
Date: Wed, 22 Mar 2000 21:41:19 -0600
[largish snip]
It's likely that other readers have seen these problems as well.
Yes actually, all of our webservers (on different /24's, i might add) recieved this scan: fsuj83.rz.uni-jena.de - - [16/Mar/2000:20:10:56 -0600] "POST /cgi-bin/phf?Qname=x%0a/bin/sh+-s%0a HTTP/1.0" 404 205 of course, it wasnt there, but it still set off a few alarms =) (isp was unresponsive, of course, if anyone has a good contact i'd appreciate it) As for that udel machine, I remember a guy a used to know on IRC who always used it, but he got raided by the FBI last June I believe in that big gH thing though =P
jose nazario jose () biochemistry cwru edu PGP fingerprint: 89 B0 81 DA 5B FD 7E 00 99 C3 B2 CD 48 A0 07 80 Public key available at http://biocserver.cwru.edu/~jose/pgp-key.asc
Current thread:
- Scans from udel.edu and tue.nl Jose Nazario (Mar 21)
- Re: Scans from udel.edu and tue.nl Alexandru Popa (Mar 22)
- Re: Scans from udel.edu and tue.nl Jose Nazario (Mar 22)
- 8 hours of pinging & POP2 Paul Tero (ME IT) (Mar 22)
- Re: Scans from udel.edu and tue.nl Ryan Russell (Mar 23)
- R: Scans from udel.edu and tue.nl Gregor Sfiligoj (Mar 22)
- Linux Security slam () THEGRID NET (Mar 22)
- Re: Scans from udel.edu and tue.nl Matthew S. Hallacy (Mar 22)
- <Possible follow-ups>
- Re: Scans from udel.edu and tue.nl Fernando Cardoso (Mar 23)
- Re: Scans from udel.edu and tue.nl Ed Padin (Mar 24)
- Re: Scans from udel.edu and tue.nl Alexandru Popa (Mar 22)