Security Incidents mailing list archives

Re: Solegg ?

From: Pieter <pieter () thedarkside nl>
Date: Fri, 14 May 2004 20:04:49 +0200

On Fri, 2004-05-14 at 18:52, David Gillett wrote:

  I recently attempted to contact this forum about strange traffic
coming from one of our hosts.  (My message was rejected without
explanation.)  The host was sending out ICMP Echo-Reply packets
which contained the keyword "skillz" and about 1K of null bytes.
No ICMP Echo-Request packets were seen eliciting these.

Stacheldraht:
http://staff.washington.edu/dittrich/misc/stacheldraht.analysis

-- 
Pieter



---------------------------------------------------------------------------
----------------------------------------------------------------------------

Current thread:

Re: New piece of spyware?, (continued)
- Re: New piece of spyware? Valdis . Kletnieks (May 13)
- RE: New piece of spyware? Charles Tholen (May 13)
  - Re: Re: New piece of spyware? Andrew Smith (May 14)
- Re: New piece of spyware? Harlan Carvey (May 13)
- RE: New piece of spyware? Rob Shein (May 13)
- Re: New piece of spyware? Rob (May 14)
- Re: New piece of spyware? caldcv (May 14)
  - Re: New piece of spyware? Mister Coffee (May 14)
    - Dead Thread: New piece of spyware? Daniel Hanson (May 14)
    - Solegg ? David Gillett (May 14)
    - Re: Solegg ? Pieter (May 14)
    - Re: Solegg ? xian (May 14)
  - RE: New piece of spyware? Rob Shein (May 14)