Security Incidents mailing list archives
Trojan attacking our switches
From: Charles Polisher <cpolish () attbi com>
Date: Thu, 20 Mar 2003 17:50:34 -0800
Search of CVE and securityfocus and googling did not turn up adequate information. Anyone seen this beast? Our campus network has a couple of thousand hosts, and 93 switches. Telnetting into our HP Procurve 2524 switch shows an ongoing attempt to brute-force the SNMP community (public, of course). HP apparently does not provide a method for disbling SNMP, and we're going to have to visit all 93 switches in person to set a strong password -- yes, it had been left blank! PCdoorguard 3 virus scanner identified a virus, "f*ck door server", but provides little useful information other than pointing to \windows\system\setdefed.exe which is 24,576 bytes. Thanks, Charles Polisher ---------------------------------------------------------------------------- <Pre>Lose another weekend managing your IDS? Take back your personal time. 15-day free trial of StillSecure Border Guard.</Pre> <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
Current thread:
- Trojan attacking our switches Charles Polisher (Mar 21)
- Re: Trojan attacking our switches dreamwvr () dreamwvr com (Mar 21)
- Re: Trojan attacking our switches Mike Hoskins (Mar 21)
- Re: Trojan attacking our switches Kris Saw (Mar 22)