Security Incidents mailing list archives
Re: Strange back-orifice looking scan...
From: Jeff Kell <jeff-kell () utc edu>
Date: Wed, 04 Sep 2002 22:32:09 -0400
KoRe MeLtDoWn wrote:
Hey Jeff, Port 1214 used by Kazaa aka Morpheus, this is obviously the remote port that the "scanner" is using. Port 31336 IS used by Back Orifice 2000 aka BO2k aka DeepBO (this is a special release of BO btw).
But this is UDP, not TCP.
however they are actively portscanning either your network I wasnt sure if it was a network you had) or just your lone box.
It is an overloaded NAT, not a lone box. Jeff ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Strange back-orifice looking scan... Jeff Kell (Sep 04)
- <Possible follow-ups>
- Re: Strange back-orifice looking scan... KoRe MeLtDoWn (Sep 05)
- Re: Strange back-orifice looking scan... Jeff Kell (Sep 05)
- Re: Strange back-orifice looking scan... Neil Dickey (Sep 05)
- Re: Strange back-orifice looking scan... Scott Nursten (Sep 11)