Security Incidents mailing list archives
Re: Firewall hits/unknown ports
From: Valdis.Kletnieks () vt edu
Date: Sun, 04 Nov 2001 23:13:53 -0500
On Sun, 04 Nov 2001 21:28:29 CST, Glenn Forbes Fleming Larratt <glratt () rice edu> said:
You might look at (and provide) what they're using for a "source" port - I've seen numerous "reverse http" and "reverse telnet" scans, where a source port of 80 or 23 is used. Such a approach could fool a stateless firewall or IDS. On Sun, 4 Nov 2001 bonk () webchat chatsystems com wrote:Anyone know what trojans/backdoors run on 22634, 24544 and 29319 ? 22634 24.254.60.19 unknown Nov 3 23:49:26
Equally to the point - I may have blinked, but I didn't see ruled out that 24.254.60.19 isn't running a http/smtp/ftp/whatever server unbeknownst to the firewall admin. So 22634 may be a totally reasonable ephemeral port picked at the client end for a connection to a web server running on the box, triggering an IDS. And remember that there's at least one instant messaging client that provides a baby web server onboard.... Valdis Kletnieks Operating Systems Analyst Virginia Tech ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Firewall hits/unknown ports bonk (Nov 04)
- Re: Firewall hits/unknown ports Stephen (Nov 04)
- RE: Firewall hits/unknown ports Loki (Nov 04)
- Re: Firewall hits/unknown ports Glenn Forbes Fleming Larratt (Nov 04)
- Re: Firewall hits/unknown ports Valdis . Kletnieks (Nov 04)
- Re: Firewall hits/unknown ports Nick FitzGerald (Nov 08)
- <Possible follow-ups>
- RE: Firewall hits/unknown ports Barber, Chris (Nov 05)
- Re: Firewall hits/unknown ports freehold (Nov 05)
- Re: Firewall hits/unknown ports Stephen (Nov 04)