Re: Strange attacks

[Russell Fulton <r.fulton () auckland ac nz>]

On Sat, 2002-10-26 at 05:47, opus wrote:
> Beginning on October 10th at 1:42am CDT what was considered a pretty 
> significant attack took place.  These attack attempts were all web based.  
> What is curious about these attacks is the number of unique strings used 
> in the attacks.  In all there were 149 unique Snort rules triggered, from 
> 5 attacks in 14 days.

I see these from time to time,  looks like someone using nessus of
whisker...  I am also seeing more clusters of similar attacks from
various DSL and Cable networks.  It is likely that these are the work of
the same group, probably using compromised machines.

-- 
Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand

"It aint necessarily so"  - Gershwin


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com