Re: FTP exploit?

[Ben Beuchler <insyte () emt-p org>]

On Mon, Mar 19, 2001 at 01:01:39PM -0800, Clayton Fiske wrote:

> Is there a (fairly) recent exploit for common ftp daemons going around
> lately? In the past several days, I've seen a very noticeable jump in
> the number of people attempting anonymous ftp logins. Typically I
> noticed it once or twice a week, and usually single attempts, but now
> they're coming in every few hours and they each make 4 attempts within
> a second (which is one per IP bound to the box I'm watching). It looks
> like it has to be some kind of script.
>
> Anyone else seeing any noticeable increases like this?

My snort logs (on my home network) show at least one scan like that
every day, usually two or more.

Ben

-- 
Ben Beuchler                                           There is no spoon.
insyte () emt-p org                                            -- The Matrix