Re: anyone else seen an increase in sunrpc scans these days?

[Mihai Moldovanu <mihaim () PROFM RO>]

Jason Lewis wrote:

> I couldn't find any of those addresses, but I have similar scans in my logs.
>
> 63.91.6.36
> 64.32.209.213
> 64.21.114.2
> 66.22.62.2
> 216.98.160.251

Yes . The same problem here . But not only 111 . 21 also.
We deployed a honnypot and waited to be compromised. It took 12 hours to be
compromised. I took it out of the network
and this is what i found on it :
It seemns like a worm that installs StatDXscan  ( Class B rpc.statd scanner) ,
wu-ftpd scanner , a modified t0rn rootkit along with Adore LKM rootkit , and
flood
tools : Sl2 , smurf5 , tojaned sshd running on port 48480 )
t0rnscan  has inside it the following string:  irc.webbernet.net:6667


--
Lead programmer,
Mihai Moldovanu (mihaim () profm ro)
WEB:    http://tfm.profm.ro/
             http://www.developers.ro/