Re: Dameware scans, worm?

["Russell J. Lahti" <russell () 911 net>]

Ben Nelson wrote:

> Keith T. Morgan wrote:
> > The interesting part about the scans is that they almost universally
> > have a source port of 220, which to me indicates either worm activity or
> > a canned scanner/exploit combo with a hard-coded source-port.
>
> Yes. I'm also seeing a large increase in tcp/6129 scans.  All of the 
> scans I am seeing also have a source port of 220, as you said.  Scans 
> are across multiple geographically dispersed class C's.  The scans 
> started mid-day yesterday for me.

After looking though our logs, here's an exact
time frame for these scans against our networks:

December 14th: Dameware Pre-Authentication
               Buffer Overflow posted on BugTraq.

December 19th: Dameware exploit posted on BugTraq.

December 21st: Beginning of wide-spread scanning for
               port 6129 on our networks.

January  10th: 2nd Dameware exploit posted on BugTraq.

January  16th: Start of scans originating from port 220.


Kind regards,

-Russell Lahti


---------------------------------------------------------------------------
----------------------------------------------------------------------------