Security Incidents: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

281 messages starting Dec 31 99 and ending Jan 31 00
Date index | Thread index | Author index

• Re: ICMP time exceed in-transit packets White, Tim (Dec 31)
  • Re: ICMP time exceed in-transit packets Chris Brenton (Jan 01)
    • Re: ICMP time exceed in-transit packets Alain Thivillon (Jan 01)
      • Re: ICMP time exceed in-transit packets Christopher Wilson (Jan 02)
      • port 119 Dariusz Zmokly (Jan 03)
      • Re: port 119 Robert Graham (Jan 03)
      • Re: port 119 Thomas Molina (Jan 04)
      • Re: port 119 Vince Vielhaber (Jan 05)
      • Ports 25092 / 20869 Vanja Hrustic (Jan 04)
      • Re: Ports 25092 / 20869 Robert Graham (Jan 04)
      • port 1150 and 4833 ? Kim R. Rasmussen (Jan 04)
      • Re: port 1150 and 4833 ? Frameloss, Frameloss (Jan 10)
      • Re: port 119 R a v e N (Jan 05)
      • Re: port 119 Scott Laws (Jan 04)
      • Writeup: it. TLD going astray Arrigo Triulzi (Jan 03)
      • Computer Forsenics System Administrator (Jan 03)
      • Re: Computer Forsenics-> www.fish.com/forensics mike (Jan 03)
      • traceroute ICMP packets Laszlo Fabian (Jan 04)
      • Re: traceroute ICMP packets M J (Jan 04)
      • Re: traceroute ICMP packets Larry Canup (Jan 18)
    • Re: ICMP time exceed in-transit packets Dave Dittrich (Jan 01)
      • Re: ICMP time exceed in-transit packets Paul Cardon (Jan 02)
    • Y2K bug in Shadow IDS Patrick Oonk (Jan 02)
    • Port Scan on 371... M. Edward Wilborne III (Jan 02)
      • Re: Port Scan on 371... Etaoin Shrdlu (Jan 02)
      • Re: Port Scan on 371... Christopher Wilson (Jan 02)
      • correlation between porscans and local activity Thomas Molina (Jan 02)
      • Re: correlation between porscans and local activity Sean Sosik-Hamor (Jan 03)
      • ADMROCKS McNab, Chris (Jan 03)
      • R: correlation between porscans and local activity Raistlin (Jan 04)
      • Re: R: correlation between porscans and local activity Michael Babcock (Jan 12)
      • Re: correlation between porscans and local activity R a v e N (Jan 04)
• Re: :8 -> :0 Belgarion of Riva (Dec 31)
  • <Possible follow-ups>
  • Re: :8 -> :0 CyberPsychotic (Jan 01)
  • Re: :8 -> :0 Bubonic (Jan 02)
  • Re: :8 -> :0 Frameloss, Frameloss (Jan 10)
• Re: ICMP timex to X.Y.Z.0 Donald McLachlan (Jan 02)
• Re: Y2K bug in Shadow IDS Donald McLachlan (Jan 02)
• Re: Port Scan on 371... Fisher, Lee (Jan 02)
• Re: correlation between porscans and local activity Bob Johnson (Jan 03)
• Re: Source Host 0.0.0.0 Frederic Ple (Jan 04)
  • <Possible follow-ups>
  • Re: Source Host 0.0.0.0 Dante Mercurio (Jan 04)
    • Re: Source Host 0.0.0.0 Grzegorz Janoszka (Jan 06)
  • Re: Source Host 0.0.0.0 Chuck Phillips (Jan 06)
• Re: named ADMROCKS exploit replacing sshd1 Paul Hurley (Jan 04)
• Scanners using netcraft? Michael Damm (Jan 05)
  • Re: Scanners using netcraft? Richard Trott (Jan 05)
  • Re: Scanners using netcraft? Mike Johnson (Jan 05)
    • Got cracked/attacked this morning Filip M. Gieszczykiewicz (Jan 08)
    • god damn - we got rooted again (long, alas) Filip M. Gieszczykiewicz (Jan 09)
    • rootkit site found in sniff log (??) Filip M. Gieszczykiewicz (Jan 09)
  • Re: Scanners using netcraft? Al Huger - Mail Account (Jan 05)
  • Port 3593 Raistlin (Jan 05)
  • Re: Scanners using netcraft? sekurity (Jan 05)
  • <Possible follow-ups>
  • Re: Scanners using netcraft? Eric Cholet (Jan 05)
    • Re: Scanners using netcraft? mea culpa (Jan 10)
• Connection attempts with source port 113 Ginsberg Rainer (QI/INF4) * (Jan 05)
  • Re: Connection attempts with source port 113 daswasme () SDF LONESTAR ORG (Jan 09)
• unusual UDP probes T.Esting (Jan 05)
  • Re: unusual UDP probes Ron Gula (Jan 05)
  • Command confirmation request cancelled L-Soft list server at LISTS.SECURITYFOCUS.COM (1.8d) (Jan 06)
  • <Possible follow-ups>
  • Re: unusual UDP probes T.Esting (Jan 05)
• IIS 5.0 not displaying asp Justin Lintz (Jan 05)
  • <Possible follow-ups>
  • Re: IIS 5.0 not displaying asp Andrew_Kunz () TDGROUP COM (Jan 06)
• Re: port 119 Russ Allbery (Jan 05)
• Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Thomas E. Ruth (Jan 06)
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Jeffrey Papen (Jan 07)
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Thomas E. Ruth (Jan 07)
  • <Possible follow-ups>
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Maniac . (Jan 07)
    • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Thomas E. Ruth (Jan 07)
      • Cable modem hosts being exploited to spam. TCP ports 224, 253 Aaron Higbee (Jan 07)
      • Probe from NS2.SOHONET.COM Jonathan S. Keim (Jan 08)
      • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Missouri FreeNet Administration (Jan 10)
      • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Thomas Molina (Jan 11)
      • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Andrew Kunz (Jan 11)
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Andy David (Jan 10)
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Maniac . (Jan 11)
  • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Maniac . (Jan 11)
    • Re: Attacks from cr595282-a.hnsn1.on.wave.home.com [24.112.41.167] Al Huger - Mail Account (Jan 14)
• Distributed Scanning? Missouri FreeNet Administration (Jan 06)
  • Ports 12345, 5742 and 20034 Artur Nowak (Jan 08)
    • Re: Ports 12345, 5742 and 20034 Michal Rok (Jan 10)
      • Re: Ports 12345, 5742 and 20034 Artur Nowak (Jan 11)
  • Re: Distributed Scanning? Richard Bejtlich (Jan 08)
  • Port 4 Arne Vidar Sjønøs (Jan 09)
    • Re: Port 4 Keith Owens (Jan 10)
    • Re: Port 4 Sean Sosik-Hamor (Jan 11)
      • Re: Port 4 Philipp Buehler (Jan 11)
      • Re: Port 4 Sean Sosik-Hamor (Jan 11)
      • Re: Port 4 Boris Badenov (Jan 11)
      • IRC-bots: what are they for ? Jens Hektor (Jan 12)
      • Re: IRC-bots: what are they for ? Jon Paul, Nollmann (Jan 12)
      • Re: IRC-bots: what are they for ? SecOrg (Jan 12)
      • Re: IRC-bots: what are they for ? Ninja Information Systems. (Jan 12)
      • Re: IRC-bots: what are they for ? Jens Hjalmarsson (Jan 12)
      • Re: IRC-bots: what are they for ? tyler (Jan 12)
      • Re: IRC-bots: what are they for ? David Brumley (Jan 12)
      • Re: IRC-bots: what are they for ? The Undernet Bonk (Jan 12)
      • Re: IRC-bots: what are they for ? Filip M. Gieszczykiewicz (Jan 12)
      • Strange behaviour Belgarion of Riva (Jan 13)
      • Re: Strange behaviour Richard Bejtlich (Jan 15)
      • UDP probing [ trojan? ] mabrown () SECUREPIPE COM (Jan 17)
      • Re: UDP probing [ trojan? ] Jose Nazario (Jan 18)
      • Probe from UK Provider ? Duarte Cordeiro (Jan 18)
      • Re: Probe from UK Provider ? Pauline van Winsen (Jan 19)
      • Re: Probe from UK Provider ? Arrigo Triulzi (Jan 20)
      • Re: Probe from UK Provider ? Gene Harris (Jan 20)
      • Re: Probe from UK Provider ? Jason Witty (Jan 20)
      • Solaris BSM Audit Logs Wozz (Jan 17)
      • Re: Strange behaviour John Turner (Jan 17)
      • SMTP bombing Kaupo Palo (Jan 18)
      • Log tools? Chad Day (Jan 17)
      • Re: Log tools? James Phillips (Jan 17)
      • Re: Log tools? Gene Harris (Jan 18)
      • Re: Log tools? Richard Trott (Jan 17)
      • Re: Log tools? Pauline van Winsen (Jan 18)
      • AMD/Port 100099 and portmap Daniel K. Boyd (Jan 18)
      • Re: AMD/Port 100099 and portmap CyberPsychotic (Jan 18)
      • Large quantity of traffic from amazon.com - source_port 3000 Peter Bates (Jan 13)
      • Re: Port 4 Lutz Pressler (Jan 12)
      • Re: Port 4 Vanja Hrustic (Jan 13)
      • New vulnerability (fwd) Alfred Huger (Jan 13)
      • An Embryonic Counterintelligence Tool Stephen P. Berry (Jan 14)
      • Re: An Embryonic Counterintelligence Tool Vanja Hrustic (Jan 18)
      • Maillog Suspicious flirtingboy20 (Jan 11)
      • Re: Maillog Suspicious David A. Bandel (Jan 11)
      • Re: Maillog Suspicious James Phillips (Jan 11)
      • Re: Maillog Suspicious Yiorgos Adamopoulos (Jan 11)
      • strange entrys in /var/log/messages Ben Russell (Jan 11)
      • Re: strange entrys in /var/log/messages Christopher Wilson (Jan 12)
      • Re: strange entrys in /var/log/messages Robert Graham (Jan 12)
      • Re: Maillog Suspicious Jose Nazario (Jan 11)
      • Re: Maillog Suspicious Larry W. Cashdollar (Jan 11)
      • Attempted port scans. Steve (Jan 11)
      • Re: Maillog Suspicious Khetan Gajjar (Jan 11)
      • Text file monitor? Luther Trammel (Jan 12)
      • Re: Text file monitor? James A Kennemore Jr (Jan 12)
      • Re: Maillog Suspicious Christopher Rhodes (Jan 12)
      • Re: Maillog Suspicious Christopher Rhodes (Jan 12)
    • Re: Port 4 CyberPsychotic (Jan 11)
      • Re: Port 4 Daniel Jacobowitz (Jan 11)
• Update: other depts attacked Filip M. Gieszczykiewicz (Jan 09)
• strange icmp traffic Dariusz Zmokly (Jan 10)
  • Re: strange icmp traffic Jacob Langseth (Jan 11)
    • Re: strange icmp traffic Dariusz Zmokly (Jan 12)
• NT4.0 Logs Daniel K. Boyd (Jan 10)
• Re: Ports 12345, 5742 and 20034 Andy David (Jan 10)
  • <Possible follow-ups>
  • Re: Ports 12345, 5742 and 20034 Woods,Stan (Jan 11)
• Re: strange entrys in /var/log/messages Larry W. Cashdollar (Jan 12)
• Re: Attempted port scans. Larry W. Cashdollar (Jan 12)
• More icmp floating around... Ralf Günthner (Jan 14)
• Re: Large quantity of traffic from amazon.com - source_port 3000 Chris (Jan 15)
  • Re: Large quantity of traffic from amazon.com - source_port 3000 Joseph Geyer (Jan 17)
  • <Possible follow-ups>
  • Re: Large quantity of traffic from amazon.com - source_port 3000 Dominique Brezinski (Jan 15)
    • Re: Large quantity of traffic from amazon.com - source_port 3000 Andrew Steingruebl (Jan 18)
      • Re: Large quantity of traffic from amazon.com - source_port 3000 Dominique Brezinski (Jan 18)
      • Re: Large quantity of traffic from amazon.com - source_port 3000 Robert Graham (Jan 19)
      • Socks port 1080 Heman Leopando (Jan 20)
      • Re: Socks port 1080 Russell Fulton (Jan 20)
      • I was scaned C. (Jan 20)
      • Re: I was scaned Robert Graham (Jan 22)
      • Re: I was scaned Jose Nazario (Jan 23)
      • Re: I was scaned Gene Harris (Jan 23)
      • Re: I was scaned Keith Owens (Jan 24)
      • Got scaned again C. (Jan 24)
      • ? C. (Jan 24)
      • Re: ? Mike Tancsa (Jan 24)
      • Re: ? Brock Sides (Jan 24)
      • Re: unapproved AXFR Russell Fulton (Jan 24)
      • No Idea CN (Jan 25)
      • PC Anywhere client seems to probe class C of connected networks Troy Ablan (Jan 25)
      • Re: PC Anywhere client seems to probe class C of connected networks Steve Ellermann (Jan 26)
      • Re: PC Anywhere client seems to probe class C of connected networks Paul L Schmehl (Jan 26)
      • Re: PC Anywhere client seems to probe class C of connected networks Jose Nazario (Jan 26)
      • Anti-Death Penalty Robert Graham (Jan 26)
      • Re: Anti-Death Penalty Derek Moeller (Jan 28)
      • Re: Anti-Death Penalty Robert Graham (Jan 28)
      • BOGUS.IvCD File Jonathan A. Zdziarski (Jan 26)
      • Re: BOGUS.IvCD File Vanja Hrustic (Jan 27)
      • Re: PC Anywhere client seems to probe class C of connected networks Robert Graham (Jan 26)
      • Probes to tcp 2766 ('System V Listner') Russell Fulton (Jan 26)
      • Re: No Idea Paul L Schmehl (Jan 25)
      • Re: No Idea Robert Graham (Jan 25)
      • Possible Probe = Possible Malfunction Ron Gula (Jan 25)
      • Possible attemt at hacking? Geir A. Bjune (Jan 25)
      • Re: Possible attemt at hacking? Brendan Grieve (Jan 27)
      • Re: ? Adam Boileau (Jan 25)
      • Korea (was RE: ?) Fernando Cardoso (Jan 26)
      • Strange DNS/TCP activity Pavel Kankovsky (Jan 26)
      • Re: Strange DNS/TCP activity Asmodeus (Jan 27)
      • Re: Strange DNS/TCP activity Roy Pait (Jan 27)
      • port 768 Guido A.J. Stevens (Jan 27)
      • Re: port 768 Robert Graham (Jan 27)
      • Re: Strange DNS/TCP activity technot (Jan 27)
      • Re: Strange DNS/TCP activity Richard Bejtlich (Jan 27)
      • Connect thru PIX & ports 1727, 2209, 9200 CL: Nelson, Jeff (Jan 27)
      • Re: Korea (again) Kim R. Rasmussen (Jan 26)
      • Re: Korea (again) zeek (Jan 27)
      • Re: Korea (again) Kim Roland Rasmussen (Jan 27)
      • Re: Korea (again) Thomas Molina (Jan 27)
      • Re: Korea (again) Rob Quinn (Jan 28)
      • Re: Korea (again) Granquist, Lamont (Jan 27)
      • Re: Korea (was RE: ?) horio shoichi (Jan 26)
      • Re: Korea (was RE: ?) David Brumley (Jan 27)
      • Re: Korea (was RE: ?) Patrick Oonk (Jan 28)
      • Re: Korea (was RE: ?) Arrigo Triulzi (Jan 28)
      • Re: Korea (was RE: ?) Dug Song (Jan 28)
      • Re: Korea (was RE: ?) Patrick Oonk (Jan 28)
      • DNS update queries: another sort of suspicious activity. Fyodor (Jan 28)
      • Re: DNS update queries: another sort of suspicious activity. Patrick Oonk (Jan 28)
      • Re: DNS update queries: another sort of suspicious activity. Fyodor (Jan 28)
      • Re: DNS update queries: another sort of suspicious activity. Patrick Oonk (Jan 28)
      • Recent Scans Edwin Covert (Jan 28)
      • Re: DNS update queries: another sort of suspicious activity. Rob Quinn (Jan 31)
      • Re: Socks port 1080 Randy Mclean (Jan 21)
      • Re: Socks port 1080 Richard Bejtlich (Jan 21)
      • Unusual Netstat Listing Rob (Jan 22)
• Name server probe from NS2.50megs.com Jonathan S. Keim (Jan 16)
  • Re: Name server probe from NS2.50megs.com Jonathan S. Keim (Jan 17)
• Re: Strange behaviour Dante Mercurio (Jan 17)
  • <Possible follow-ups>
  • Re: Strange behaviour Iván Arce (Jan 18)
• Scans Scott Armstrong (Jan 17)
• Re: Log tools? Lammerse, Marcel (Jan 18)
  • <Possible follow-ups>
  • Re: Log tools? Woods,Stan (Jan 18)
• Re: An Embryonic Counterintelligence Tool Iván Arce (Jan 18)
• Unusual scan pattern Russell Fulton (Jan 18)
  • ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Michael Vaughan (Jan 19)
    • Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Cy Schubert - ITSD Open Systems Group (Jan 21)
    • Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Ex Machina [xm] (Jan 21)
    • Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File CyberPsychotic (Jan 21)
      • Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Dug Song (Jan 22)
  • Re: Unusual scan pattern Granquist, Lamont (Jan 19)
  • Slow scan Mixmaster (Jan 19)
  • Re: Unusual scan pattern Richard Bejtlich (Jan 20)
  • Re: Unusual scan pattern Kevin Houle (Jan 20)
    • Re: Unusual scan pattern Russell Fulton (Jan 23)
    • semi careful, very patient attacker Jon Paul, Nollmann (Jan 24)
  • <Possible follow-ups>
  • Re: Unusual scan pattern Oliver Friedrichs (Jan 19)
    • Unknown Port Numbers Edwin Covert (Jan 21)
• Re: ANOTHER DNS MAC ADDRESS Change w/h Unix Log File Donald McLachlan (Jan 21)
• Re: I was scaned Oliver Friedrichs (Jan 21)
  • <Possible follow-ups>
  • Re: I was scaned Larry W. Cashdollar (Jan 24)
• Re: ? Fernando Cardoso (Jan 25)
  • <Possible follow-ups>
  • Re: ? Robert G. Ferrell (Jan 25)
• Re: Possible attemt at hacking? Dante Mercurio (Jan 26)
• Extrange named messages king (Jan 27)
  • Re: Extrange named messages Massimo Ferrario (Jan 28)
    • Re: Extrange named messages Rob Quinn (Jan 31)
  • eri? Fletcher Mattox (Jan 28)
    • Re: eri? Bill Gilpatric (Jan 28)
• Re: Strange DNS/TCP activity Howard M. Kash III (Jan 27)
• Re: Anti-Death Penalty Bill Royds (Jan 27)
  • Re: Anti-Death Penalty Thomas Molina (Jan 27)
• Re: Korea (was RE: ?) Robert G. Ferrell (Jan 27)
  • Re: Korea (was RE: ?) R a v e N (Jan 27)
  • <Possible follow-ups>
  • Re: Korea (was RE: ?) Brooke, O'Neil (Jan 27)
    • Re: Korea (was RE: ?) Kim Robert Blix (Jan 28)
      • probe backs? was Re: [INCIDENTS] Korea Jose Nazario (Jan 28)
      • Re: Korea (was RE: ?) Mark Seiden (Jan 28)
      • Re: Korea (was RE: ?) Rob McCauley (Jan 29)
    • Re: Korea (was RE: ?) JJ Gray (Jan 28)
      • Re: Korea (was RE: ?) David Brumley (Jan 28)
  • Re: Korea (was RE: ?) Brooke, O'Neil (Jan 28)
    • R: Re: Korea (was RE: ?) Raistlin (Jan 30)
  • Re: Korea (was RE: ?) Robert G. Ferrell (Jan 28)
  • Re: Korea (was RE: ?) Andy Hooper (Jan 28)
  • Re: Korea (was RE: ?) Drissel, James W. (Jan 31)
• Re: Probes to tcp 2766 ('System V Listner') Robert G. Ferrell (Jan 27)
  • source port 321 T.Esting (Jan 28)
    • Re: source port 321 Robert Graham (Jan 28)
  • Re: Probes to tcp 2766 ('System V Listner') Thiago/c0nd0r (Jan 28)
• Re: port 768 Guido A.J. Stevens (Jan 28)
  • Re: port 768 Richard Johnson (Jan 28)
  • Re: port 768 Dave Dittrich (Jan 28)
  • Re: port 768 Robert Graham (Jan 28)
  • First china, now russia? Joseph Geyer (Jan 30)
  • Re: port 768 Eric Preston (Jan 30)
  • <Possible follow-ups>
  • Re: port 768 Guido A.J. Stevens (Jan 28)
• Another Korean asshole Patrick Oonk (Jan 28)
• Re: port 768 (fwd) Jose Nazario (Jan 28)
• Re: DNS update queries: another sort of suspicious activity. Bill Royds (Jan 28)

Previous period

Next period