Security Incidents: by thread

Security Incidents: by thread

Previous period

165 messages starting Mar 31 03 and ending Apr 30 03
Date index | Thread index | Author index

Re: new attack tool combining SMB and WebDAV? Bill McCarty (Mar 31)
- <Possible follow-ups>
- RE: new attack tool combining SMB and WebDAV? Toby Miller (Apr 01)
RE: POP3 logon attempts Jerry Shenk (Mar 31)
- Re: POP3 logon attempts Tom Fischer (Apr 02)
- <Possible follow-ups>
- RE: POP3 logon attempts Curt Purdy (Mar 31)
- Re: POP3 logon attempts Bojan Zdrnja (Mar 31)
- Re: POP3 logon attempts Torsten Mueller (Mar 31)
- Re: POP3 logon attempts dreamwvr () dreamwvr com (Apr 02)
- Re: POP3 logon attempts Mike (Apr 02)
- Re: POP3 logon attempts Steve Cody (Apr 23)
Why alerts on ports 1025-1029, 1036 Tomas Carlsson (Mar 31)
- RE: Why alerts on ports 1025-1029, 1036 Erik Boles (Mar 31)
- Re: [CERT] Why alerts on ports 1025-1029, 1036 ePAc (Mar 31)
- <Possible follow-ups>
- RE: Why alerts on ports 1025-1029, 1036 Matt Marcos (Apr 01)
  - Increase of attempts on port 635 in last couple days Jeff Lane (Apr 02)
- RE: Why alerts on ports 1025-1029, 1036 Stuart Wallace (Apr 02)
- RE: Why alerts on ports 1025-1029, 1036 Leo, Joel (Apr 02)
New Article: U.S. Information Security Law, Part 2 Dan Hanson (Apr 01)
Educational Incident Data Comparison Pilot (X-Post) Alfred Huger (Apr 01)
Re: SQL Slammer Variant? crucible (Apr 02)
- <Possible follow-ups>
- RE: SQL Slammer Variant? Wilson, Aaron J. (Apr 02)
- RE: SQL Slammer Variant? Rob Shein (Apr 02)
RE: WebDAV Exploit Lab Jeremy Junginger (Apr 02)
RE: Logon/Logoff Failure Events Robert Wagner (Apr 02)
- <Possible follow-ups>
- RE: Logon/Logoff Failure Events John Ives (Apr 03)
- RE: Logon/Logoff Failure Events Russell Morrison (Apr 03)
Increase in Source to Port 445 Rob Keown (Apr 02)
- RE: Increase in Source to Port 445 James C Slora Jr (Apr 03)
- <Possible follow-ups>
- Re: Increase in Source to Port 445 aladin168 (Apr 03)
UDP traffic to net and broadcast addresses Zen (Apr 02)
- <Possible follow-ups>
- RE: UDP traffic to net and broadcast addresses Joshua Wright (Apr 03)
Logon.dll? Possible root-kit? Nick Jacobsen (Apr 02)
- RE: Logon.dll? Possible root-kit? Rob Shein (Apr 03)
- Re: Logon.dll? Possible root-kit? Harlan Carvey (Apr 03)
- <Possible follow-ups>
- Re: Logon.dll? Possible root-kit? Nick Jacobsen (Apr 03)
- RE: Logon.dll? Possible root-kit? Amarante, Rodrigo P. (Apr 03)
- Re: Logon.dll? Possible root-kit? Nick Jacobsen (Apr 03)
  - Re: Logon.dll? Possible root-kit? Harlan Carvey (Apr 04)
    - Re: Logon.dll? Possible root-kit? Nick Jacobsen (Apr 04)
  - RE: Logon.dll? Possible root-kit? Rob Shein (Apr 04)
- RE: Logon.dll? Possible root-kit? Jason Pagano (Apr 04)
possible rootkit, maybe partial? Benjamin Tomhave (Apr 02)
- Re: [CERT] possible rootkit, maybe partial? ePAc (Apr 03)
- Re: possible rootkit, maybe partial? Richard Rager (Apr 03)
- Re: possible rootkit, maybe partial? D.C. van Moolenbroek (Apr 03)
- Re: [0.5OT answer]possible rootkit, maybe partial? nobody (Apr 03)
Field Report: New Worm falcon (Apr 03)
UDP scans from AOL NS boxes? Mike Mills (Apr 03)
RECAP: possible rootkit, maybe partial? Benjamin Tomhave (Apr 03)
SMTP probes Rich Puhek (Apr 04)
- Re: SMTP probes Bojan Zdrnja (Apr 05)
- Re: SMTP probes Christine Kronberg (Apr 07)
- <Possible follow-ups>
- Re: SMTP probes Neil Dickey (Apr 05)
Does anyone recognize the scanner that causes this pattern ? dean (Apr 06)
- Re: Does anyone recognize the scanner that causes this pattern ? Laurent Luyckx (Apr 07)
- RE: Does anyone recognize the scanner that causes this pattern ? Jerry Shenk (Apr 07)
- RE: Does anyone recognize the scanner that causes this pattern ? Justin Coffi (Apr 07)
- Re: Does anyone recognize the scanner that causes this pattern ? Gene (Apr 07)
- <Possible follow-ups>
- Re: Does anyone recognize the scanner that causes this pattern ? dean (Apr 07)
unknown rootkit found in the wild Jerome (Apr 07)
ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool) Joe Stewart (Apr 07)
New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows Dan Hanson (Apr 09)
New SecurityFocus article: Steganography Revealed Dan Hanson (Apr 09)
New trojan? Old trojan with new characteristics? Anyone seen this? Mike Parkin (Apr 10)
- Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Alex Lambert (Apr 14)
  - Re: New trojan? Old trojan with new characteristics? Anyone seenthis? vex86 () rogers com (Apr 15)
    - Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Mike Parkin (Apr 17)
Port 17300 probes? incidents (Apr 14)
- Re: Port 17300 probes? Gerd Feiner (Apr 15)
- <Possible follow-ups>
- Re: Port 17300 probes? Kevin Patz (Apr 15)
  - Re: Port 17300 probes? Joe Stewart (Apr 17)
- Re: Port 17300 probes? MARLON BORBA (Apr 15)
- Re: Port 17300 probes? Joris De Donder (Apr 17)
Port 3366 activity defaillance (Apr 15)
Logging of connects to port 6346 kbergen (Apr 15)
- Re: Logging of connects to port 6346 Nicolas Couture (Apr 17)
- <Possible follow-ups>
- RE: Logging of connects to port 6346 LordInfidel (Apr 17)
port 5168 Molony, Duncan (Apr 17)
- <Possible follow-ups>
- re: port 5168 Harlan Carvey (Apr 19)
Trojan found... Les Ault (Apr 17)
- Re: Trojan found... Harlan Carvey (Apr 19)
- <Possible follow-ups>
- Re: Trojan found... Les Ault (Apr 19)
- Re: Trojan found... aladin168 (Apr 24)
  - Re: Trojan found... Patrick Nolan (Apr 25)
Port 6666 Scans Thomas Vincent (Apr 17)
Intresting problem concerning libresolv.so.2 Sam Evans (Apr 17)
- Re: Intresting problem concerning libresolv.so.2 Kevin Reardon (Apr 19)
  - Re: Intresting problem concerning libresolv.so.2 Paul Gear (Apr 21)
- Re: Intresting problem concerning libresolv.so.2 Paul Gear (Apr 19)
Anyone seen this UDP source port 7001 traffic? Faron . Golden (Apr 19)
- <Possible follow-ups>
- Re: Anyone seen this UDP source port 7001 traffic? Michael Lau (Apr 28)
  - RE: Anyone seen this UDP source port 7001 traffic? Taz (Apr 29)
  - Re: Anyone seen this UDP source port 7001 traffic? Tina Bird (Apr 29)
  - Re: Anyone seen this UDP source port 7001 traffic? Jose Nazario (Apr 29)
IP Spoofs in the log - not sure what to do next Chris Corbett (Apr 19)
- RE: IP Spoofs in the log - not sure what to do next Curt Purdy (Apr 21)
- RE: IP Spoofs in the log - not sure what to do next David Klotz (Apr 21)
- <Possible follow-ups>
- Re: FW: IP Spoofs in the log - not sure what to do next crawford charles (Apr 21)
  - Re: FW: IP Spoofs in the log - not sure what to do next David Hawley (Apr 22)
- Re: IP Spoofs in the log - not sure what to do next aladin168 (Apr 24)
Company being War Dialed Fred Kreitzberg (Apr 19)
- Re: Company being War Dialed Brett Glass (Apr 19)
- Re: Company being War Dialed Kurt Seifried (Apr 21)
- RE: Company being War Dialed Curt Purdy (Apr 21)
- Re: Company being War Dialed public list (Apr 21)
- <Possible follow-ups>
- Re: Company being War Dialed James . Phillips (Apr 21)
- RE: Company being War Dialed James . Jackson (Apr 21)
  - RE: Company being War Dialed nospam (Apr 23)
Strange, scary, subtle trojan Jeff Kell (Apr 19)
- <Possible follow-ups>
- RE: Strange, scary, subtle trojan Dowling, Gabrielle (Apr 21)
port 139 syn-fin scans Skip Carter (Apr 19)
- Re: port 139 syn-fin scans Scott A. McIntyre (Apr 21)
- Re: port 139 syn-fin scans Muchacki Robert (Apr 21)
- RE: port 139 syn-fin scans Toby Miller (Apr 21)
- <Possible follow-ups>
- RE: port 139 syn-fin scans Kevin Hodle (Apr 21)
Mo'Logs sf (Apr 19)
Re: SMTP Scans Hoof Hearted (Apr 21)
- RE: SMTP Scans Rob Shein (Apr 22)
  - RE: SMTP Scans Mally Mclane (Apr 22)
    - RE: SMTP Scans Jimi Thompson (Apr 24)
    - Re: SMTP Scans Kurt Seifried (Apr 25)
  - RE: SMTP Scans paul (Apr 28)
- <Possible follow-ups>
- RE: SMTP Scans Luc Somers (Apr 23)
- Re: SMTP Scans Hoof Hearted (Apr 28)
  - Re: SMTP Scans Chris Boyd (Apr 29)
msamba Steve Bromwich (Apr 21)
- Re: msamba Paulo Abrantes (Apr 21)
- Re: msamba William Salusky (Apr 22)
  - Re: msamba noconflic (Apr 22)
- Re: msamba Nikola Pepelishev (Apr 22)
- Re: msamba Steve Bromwich (Apr 22)
  - Re: msamba noconflic (Apr 23)
    - Re: msamba Tobias Klein (Apr 25)
Tracking proxies on port 1180/1182 Joe Stewart (Apr 21)
- Re: Tracking proxies on port 1180/1182 George Bakos (Apr 21)
- Re: Tracking proxies on port 1180/1182 Michael Scheidell (Apr 21)
protocol watcher Justin Pryzby (Apr 23)
- Re: protocol watcher Jose Nazario (Apr 23)
New attack or old Vulnerability Scanner? Mark Embrich (Apr 25)
- RE: New attack or old Vulnerability Scanner? Keith (Apr 28)
- <Possible follow-ups>
- RE: New attack or old Vulnerability Scanner? James C. Slora, Jr. (Apr 28)
- Re: New attack or old Vulnerability Scanner? Jason Falciola (Apr 28)
- Re: New attack or old Vulnerability Scanner? rhandwerker (Apr 28)
- Re: New attack or old Vulnerability Scanner? jac (Apr 29)
- Re: New attack or old Vulnerability Scanner? Mark Embrich (Apr 29)
- Re: New attack or old Vulnerability Scanner? Jason Falciola (Apr 30)
- Re: New attack or old Vulnerability Scanner? Jason Falciola (Apr 30)
Scans on TCP port 9631 + other unknown ports Kevin Patz (Apr 25)
New CodeRed strain? Frank Knobbe (Apr 28)
- Re: New CodeRed strain? Frank Knobbe (Apr 28)
- Re: New CodeRed strain? -- UPDATE Frank Knobbe (Apr 29)
lots of port 0 scannings SB CH (Apr 28)
- Re: lots of port 0 scannings Brad Doctor (Apr 29)
- <Possible follow-ups>
- Re: lots of port 0 scannings Neil Dickey (Apr 29)
Odd IIS log entries Hahn, Jacob (Apr 29)
- <Possible follow-ups>
- RE: Odd IIS log entries James C. Slora, Jr. (Apr 30)
undetected DDOS Chris Cahill (Apr 29)
Re: New CodeRed strain? -- UPDATE Justin Pryzby (Apr 29)
- <Possible follow-ups>
- RE: New CodeRed strain? -- UPDATE larosa, vjay (Apr 30)
Administrivia: SPAM control, vacation messages, and the like. Dan Hanson (Apr 30)
Logs showing GET /.hash=... Keith Bergen (Apr 30)
- <Possible follow-ups>
- Re: Logs showing GET /.hash=... Chris Mann (Apr 30)
UDP packets towards port 38293 (NAV) Alan B. Clegg (Apr 30)
- Re: UDP packets towards port 38293 (NAV) Russell Fulton (Apr 30)
  - Re: UDP packets towards port 38293 (NAV) Nexus (Apr 30)

Previous period