Security Incidents mailing list archives

RE: popup msg spamming

From: "Pavel Kankovsky" <peak () argo troja mff cuni cz>
Date: Tue, 15 Oct 2002 23:28:48 +0200 (CEST)

On Tue, 15 Oct 2002, Hay,Daniel wrote:

We are in the same boat, We have udp/tcp 135-139 and 445 blocked but
we still see the spam.


At least in theory, one might probe (unfiltered) ports above 1024, esp.
1029/udp and 1030/udp (*), and check directly whether the messenger
service is listening there.

(*) AFAICT, in 90 % of cases, the messenger service is listening in one of
those two ports.

--Pavel Kankovsky aka Peak
"Welcome to the Czech Republic. Bring your own lifeboats."


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Current thread:

RE: Hay,Daniel (Oct 15)
- RE: Hugo van der Kooij (Oct 15)
  - Cacheflow proxy abuse (was: no subject) Alain Fauconnet (Oct 16)
    - Re: Cacheflow proxy abuse (was: no subject) Hugo van der Kooij (Oct 16)
- RE: popup msg spamming Pavel Kankovsky (Oct 15)
- RPC-Spam issue, was => RE: H C (Oct 15)
- RE: T. Willner, Elitetraderz.com (Oct 16)
- Re: Gary Flynn (Oct 16)