Lots netbios scans (udp 137)

[r.fulton () AUCKLAND AC NZ (Russell Fulton)]

HI,
        Over the last few days I have seen four or five 'short' scans
of udp 137 ports in various parts of our /16 network address space.

These scans seem to start at a address 1 in a random class C and then
probe in an ascending sequence -- sometimes stopping short of the
address 254.  Three packets to each address and around 5 - 7 seconds
between addresses, suggests that this is something using standard
netbios calls. Since we block 137 on our DMZ I have not been able to
observe a what happens when a machine responds.

I am wondering if this is a new worm working through open shares, it
certainly looks similiar to the report from Bryce Alexander at

http://www.sans.org/y2k/honeypot_catch.htm.

If it is then it looks as if it is being very sucessful.  The scans I
logged came from all over the world.

Cheers, Russell.

Russell Fulton, Computer and Network Security Officer
The University of Auckland, New Zealand.

PS. here's the argus logs for the start of one scan,
Times are UTC +120 if anyone cares...

29 Apr 00 00:18:07      udp   209.82.89.212.137    ->   130.216.128.1.137   3      0       174       0        TIM
29 Apr 00 00:18:14      udp   209.82.89.212.137    ->   130.216.128.2.137   3      0       174       0        TIM
29 Apr 00 00:18:22      udp   209.82.89.212.137    ->   130.216.128.3.137   3      0       174       0        TIM
29 Apr 00 00:18:29      udp   209.82.89.212.137    ->   130.216.128.4.137   3      0       174       0        TIM
29 Apr 00 00:18:37      udp   209.82.89.212.137    ->   130.216.128.5.137   3      0       174       0        TIM
29 Apr 00 00:18:44      udp   209.82.89.212.137    ->   130.216.128.6.137   2      0       116       0        TIM
29 Apr 00 00:18:52      udp   209.82.89.212.137    ->   130.216.128.7.137   3      0       174       0        TIM
29 Apr 00 00:19:00      udp   209.82.89.212.137    ->   130.216.128.8.137   3      0       174       0        TIM
29 Apr 00 00:19:07      udp   209.82.89.212.137    ->   130.216.128.9.137   3      0       174       0        TIM
29 Apr 00 00:19:15      udp   209.82.89.212.137    ->  130.216.128.10.137   3      0       174       0        TIM
29 Apr 00 00:19:22      udp   209.82.89.212.137    ->  130.216.128.11.137   3      0       174       0        TIM
29 Apr 00 00:19:30      udp   209.82.89.212.137    ->  130.216.128.12.137   3      0       174       0        TIM
29 Apr 00 00:19:37      udp   209.82.89.212.137    ->  130.216.128.13.137   3      0       174       0        TIM
29 Apr 00 00:19:45      udp   209.82.89.212.137    ->  130.216.128.14.137   3      0       174       0        TIM
29 Apr 00 00:19:53      udp   209.82.89.212.137    ->  130.216.128.15.137   3      0       174       0        TIM
29 Apr 00 00:20:00      udp   209.82.89.212.137    ->  130.216.128.16.137   3      0       174       0        TIM
29 Apr 00 00:20:08      udp   209.82.89.212.137    ->  130.216.128.17.137   3      0       174       0        TIM
29 Apr 00 00:20:15      udp   209.82.89.212.137    ->  130.216.128.18.137   3      0       174       0        TIM