Re: Curious HTTP related probings.

[techs () OBFUSCATION ORG (Erik Fichtner)]

On Wed, Mar 22, 2000 at 09:19:59AM -0500, Scott A . McIntyre wrote:
> Wed 03/22 14:06:00 tcp x.x.x.x.2140 > host.whoi.edu.80
> Wed 03/22 14:06:46 tcp x.x.x.x.2196 > host.whoi.edu.8080
> Wed 03/22 14:07:32 tcp x.x.x.x.2238 > host.whoi.edu.3128

> I'm curious of anyone else has seen such patterns and if they've
> discovered any particularly negative results as a consequence of the
> probes.

Yeah. It's a trojan.  Its goal in life is to search out open proxies and
report back to the author when it finds one.   It's called RingZero.

I've seen a new variant of this signature that includes 1080/tcp.  It may
be a new version, or it may be just someone manually looking for open proxies.

--
Erik Fichtner; Warrior SysAdmin (emf|techs)                       34.9908%
http://www.obfuscation.org/techs/      N 38 53.055'  W 77 21.860'  764 ft.
       "What's the most effective Windows NT remote management tool?"
          "A car."  --  Stephen Northcutt