Security Incidents mailing list archives

Re: SQL port probe repeats

From: "Harlan S. Barney, Jr." <hsbarney () nycap rr com>
Date: Sat, 22 Jun 2002 21:34:22 -0400

After about 250 SQL port probes to my workstation without a repeat of
source IP, I have found two repeats in the last week.  One was from
Korea, the other from the USA.

Maybe someone cleaned the two systems but did not secure them properly.

I have also noted that in March I had a SQL port probe followed by an
FTP port probe from the same source in France.

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Current thread:

port 32814 Brian Collins (Jun 22)
- Re: SQL port probe repeats Harlan S. Barney, Jr. (Jun 22)
  - Re: SQL port probe repeats David Barnett (Jun 23)