Security Incidents mailing list archives
Re: ingreslock message
From: bugtraq () NETWORKICE COM (Robert Graham)
Date: Tue, 7 Mar 2000 09:43:22 -0800
It is an attempt to connect to a root shell installed by an exploit in sendmail/RPC/BIND. It doesn't mean that you've been exploited, only that somebody is searching to see if that backdoor has been installed. I've written a good document that describes these sorts of things at: http://www.robertgraham.com/pubs/firewall-seen.html#port1524 Rob. -----Original Message----- From: Incidents Mailing List [mailto:INCIDENTS () securityfocus com]On Behalf Of Dino Amato Sent: Sunday, March 05, 2000 5:34 PM To: INCIDENTS () securityfocus com Subject: ingreslock message I logged this: Mar 5 15:58:23 monitor tcplogd: ingreslock connection attempt from unknown () sleipnir1 cs ucl ac uk what does the ingreslock mean and what was this person trying to do? Thanks -------------------------------------------- Dino Amato Systems Administrator ------------------------------------------
Current thread:
- Re: @home: Is *anyone* really home there???, (continued)
- Re: @home: Is *anyone* really home there??? Greg A. Woods (Feb 29)
- Re: @home: Is *anyone* really home there??? Rob Quinn (Mar 01)
- Re: @home: Is *anyone* really home there??? Jon Burdge (Mar 02)
- Re: @home: Is *anyone* really home there??? Greg A. Woods (Mar 02)
- Re: @home: Is *anyone* really home there??? William Annis (Mar 03)
- scans with spoofed address (was @home: Is *anyone*...) Russell Fulton (Mar 07)
- Re: @home: Is *anyone* really home there??? Ville (Mar 03)
- ingreslock message Dino Amato (Mar 05)
- Re: ingreslock message Graeme Fowler (Mar 07)
- Re: ingreslock message Dino Amato (Mar 07)
- Re: @home: Is *anyone* really home there??? Greg A. Woods (Mar 02)
- Re: ingreslock message Robert Graham (Mar 07)
- firewall abusing Przemyslaw Frasunek (Mar 07)
- Re: ingreslock message H D Moore (Mar 07)
- Re: ingreslock message Eric Maiwald (Mar 07)
- Re: auto-reporting to ISPs John Nemeth (Mar 07)
- UDP flood 28001-28003 George (Mar 07)
- Re: ingreslock message Jens Hektor (Mar 09)
- Re: ingreslock message Ex Machina [xm] (Mar 13)
- Re: ingreslock message Jens Hektor (Mar 13)