Re: Scans to ports 1090 and 1080

[Gigi Sullivan <sullivan () seclab com>]

Hi there :)

Well, the SOCKS server listen on port 1080.
I dunno if there are some kind of vulnerability, but it seems
that someone tryed to see if you have a SOCKS server to connect to, IMHO.

Bye 

                -- gg sullivan



--
Lorenzo Cavallaro
Intesis SECURITY LAB            Phone: +39-2-671563.1
Via Settembrini, 35             Fax: +39-2-66981953
I-20124 Milano  ITALY           Email: sullivan () seclab com


On Fri, 14 Aug 1998, Roger Marquis wrote:

> Date: Fri, 14 Aug 1998 21:43:16 -0700 (PDT)
> From: Roger Marquis <marquis () roble com>
> To: firewall-wizards () nfr net
> Subject: Scans to ports 1090 and 1080
>
>
> Has anyone heard of vulnerabilities on ports 1080 or 1090?  These look
> like straight scans otherwise.
>
> Roger Marquis
> Roble Systems Consulting
> http://www.roble.com/
>
> > Aug 13 04:40:37 local0 13 deny: TCP from 207.139.170.105.16028 to 205.7.40.2.1080 seq 626CE99, ack 0x0, win 512, SYN 
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.21:1080 from 207.139.170.105:16348
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.26:1080 from 207.139.170.105:16448
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.32:1080 from 207.139.170.105:16973
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.33:1080 from 207.139.170.105:17008
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.34:1080 from 207.139.170.105:17009
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.35:1080 from 207.139.170.105:17022
> > Aug 13 04:40:37 local1 /kernel: Connection attempt to TCP 205.7.40.41:1080 from 207.139.170.105:17218
> > Aug 13 04:40:39 local1 /kernel: Connection attempt to TCP 205.7.40.255:1080 from 207.139.170.105:20991
> > Aug 14 21:17:54 local0 13 deny: TCP from 24.128.144.110.18556 to 205.7.40.2.1090 seq DFDFBE08, ack 0x0, win 512, SYN 
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.21:1090 from 24.128.144.110:18627
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.26:1090 from 24.128.144.110:18769
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.61:1090 from 24.128.144.110:19383
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.52:1090 from 24.128.144.110:19363
> > Aug 14 21:19:49 local3 /kernel: Connection attempt to TCP 205.7.40.63:1090 from 24.128.144.110:19474
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.53:1090 from 24.128.144.110:19375
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.54:1090 from 24.128.144.110:19376
> > Aug 14 21:17:55 local /kernel: Connection attempt to TCP 205.7.40.55:1090 from 24.128.144.110:19377