Re: Slow scan, the rest of the story

[hektor () RZ RWTH-AACHEN DE (Jens Hektor)]

Hi,

thanks for the answers to my posting, maybe the rest is also
interesting.

Of course I had informed the WHOIS given contact and later 
the day they gave positive feedback and scanning stoppped.

One hour later the whole started again now from two
machines located in Japan and Estonia. Admin contacts
as well as CERT's have been informed, no feedback from 
estonia until now, but scanning has stopped.

A little investigation revealed the Japanese machine as 
root-shelled, the process was found and here is additional
info:

The slow scan was caused by an aprox. 240Mbyte file of all
137.-IP's sorted by incrementing the 3rd byte, then the 
2nd byte and finally the 4th byte.

The login was trojaned giving access if the DISPLAY variable
contained a special string. Other trojans were found also.

Seemed that the attacker came from Slovenia.

Bye, Jens