Re: Dameware scans, worm?

[Ben Nelson <lists () venom600 org>]

Keith T. Morgan wrote:
> We've seen an increase in scans for dameware (tcp 6129) over the past
> four days.  I believe there was an exploit released for dameware, but
> I'm unaware of it's behavior.  A colleague first noticed these across
> multiple class C networks scanning consecutive IPs, and we have been
> seeing the same type of activity.
>
> The interesting part about the scans is that they almost universally
> have a source port of 220, which to me indicates either worm activity or
> a canned scanner/exploit combo with a hard-coded source-port.
>
> Anyone else seeing an increase in these?

Yes. I'm also seeing a large increase in tcp/6129 scans.  All of the 
scans I am seeing also have a source port of 220, as you said.  Scans 
are across multiple geographically dispersed class C's.  The scans 
started mid-day yesterday for me.

--Ben

---------------------------------------------------------------------------
----------------------------------------------------------------------------