Re: Ongoing Port 6000 attacks, Windows Xserver Compromises, keyloggers

[Chris Edwards <chris () ENG GLA AC UK>]

| Briefly, the attacker connects to an X server and - provided the X
| server has been improperly configured - they are able to grab a screen
| dump, keystrokes, and anything else in the X session.

Hi,

Out of interest, do those sites experiencing such attacks have incoming X
blocked at the border ?

In other words, are the attackers connecting to unsecured X servers direct
from off-campus (easy), or, from machines on-campus already compromised by
some other means (hopefully not so easy).

Thanks

Chris

--
Chris Edwards, Glasgow University Computing Service