Security Incidents mailing list archives

Re: Port 1243

From: lalune () LINUX CA (laLune)
Date: Fri, 17 Mar 2000 02:09:12 -0500


BackDoor-G, SubSeven 1.1 uses this port.

I've noticed a great increase in SubSeven scans, especially for the more
recent version (2.1) which uses 1234 and 27374 by default.

Additionally, I've also seen hundreds of infected machines auto-joining
IRC servers with this same remote access trojan. It seems to be quite
wide-spread at the moment.

- Anita

Omachonu Ogali wrote:


Last night I received a port scan on all my IP's for a foreign dialup
customer looking for port 1243. I talked to the rest of the network
engineers and they reported it was a scan of our whole subnet. Anyone
remember anything off head about this port? (Each xxx.xxx.xxx.xxx
represents a different IP address).

Current thread:

Re: TCP port 3218 Warren Belfer (Mar 14)
- Re: TCP port 3218 Boris Badenov (Mar 14)
- Port 1243 Omachonu Ogali (Mar 16)
  - Re: Port 1243 laLune (Mar 16)
  - Re: Port 1243 Robert Graham (Mar 17)
  - possible side effects from wide spread DOS attacks?? Russell Fulton (Mar 18)
    - Re: possible side effects from wide spread DOS attacks?? Russell Fulton (Mar 20)