Security Incidents mailing list archives

Re: anyone else seen an increase in sunrpc scans these days?

From: Ed Woodson <edwo01 () HOTMAIL COM>
Date: Mon, 15 Jan 2001 15:41:48 -0800

Derek Kwan wrote:

<SNIP>
Also there is a scan from 24.0.0.203 (authorized-scan1.security.home.net)
on port 119 atleast 2-3 times daily too. Does other cable modem user have
a similiar scan on their machine?
<SNIP>

See the following:
http://rogers.home.com/servlet/support.viewentries?entrytype=3

This from their "Resolved Investigations":

Title: NNTP Scanning (24.0.0.203)
Synopsis:
Source IP: 24.0.0.203 (authorized-scan1.security.home.net)
Target Port: 119
Violation Date: None
Resolution Date: None
Notes: This scanning is done proactivly by @Home to find insecure proxy
software that may be allowing thirdparty access to our Usenet servers. These
are ongoing scans and may be done at any time


_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com

Current thread:

Ramen worm . More details on it. ( found a password and e-mails crypted inside it), (continued)
- - - Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Mihai Moldovanu (Jan 16)
    - Re: Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Jeffrey F. Lawhorn (Jan 16)
    - Re: Ramen worm . More details on it. ( found a password and e-mails crypted inside it) Daniel Martin (Jan 16)
    - Re: FTP and RPC based worms [was anyone else ...] Steve Clement (Jan 16)
- Re: anyone else seen an increase in sunrpc scans these days? thomas lakofski (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? Niels Heinen (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? Edward Mitchell (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? Timothy Lyons (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? Alfred Huger (Jan 15)
  - Rise in rpc scans - Honeynet Project Lance Spitzner (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? Ed Woodson (Jan 15)
- Re: anyone else seen an increase in sunrpc scans these days? James Bryan (Jan 15)