Re: Not pulling the plug

[thomas () 88 NET (thomas lakofski)]

I saw this too

Feb 16 17:32:04 oi ippl: port 5 connection attempt from ns.rbscc.com
[12.3.24.2]

portsentry blocked the host very quickly...  works for me.

as to port 5... ???

-tl

On Wed, 16 Feb 2000, Stephen Friedl wrote:

> From: Stephen Friedl <friedl () MTNDEW COM>
> To: INCIDENTS () SECURITYFOCUS COM
> Date: Wed, 16 Feb 2000 07:19:12 -0800
> Subject: Not pulling the plug
>
> Hello all,
>
> For *two days*, an ADMROCKS-compromised machine in New Jersey has been doing
> a scan for TCP port 5 (what's this?), and the owner of the box refused to
> pull the plug while he fools with it. What's the best way to handle this?

......
         who's watching your watchmen?
EF D8 33 68 B3 E3 E9 D2  C1 3E 51 22 8A AA 7B 98