Snort mailing list archives
massive scans
From: "Steve Moran" <steve.moran () csssoftware com>
Date: Mon, 2 Dec 2002 10:10:25 -0700
Lately I've seen some odd port 80 scans, these scans have been setting off somewhere in the neighborhood of 160-250 different snort signatures. There have been 3 of these scans. One to my mail server, which is on one class c network ( a 198 network), the other two where to an entirely different class c (a 65 network). These scans are very efficient, ie only 1-3 packets per type of exploit. They are not targeted, ie they are looking for any exploit, lotus, windows, apache, anything. One admin said he found an executable called network32 on his dns server and many registry entries to have it automatically start. It was in the win32\label directory. The second attack was from italy, from what appears to be some small italian town's website ( I don't speak or read italian so I'm not entirely sure), but I have not gotten any response from requests for help regarding the scan. I'm still collecting info on the third and latest scan. I don't think I'm being deliberately targeted, as these scans are way too noisy, personally, if it was me, I'd at least take the time to do some recon and tailor my attack to the type of web server. As nothing has been comprosmised and no damage done, law enforcement doesn't really care. As there are close to 1000 packets and, like I said 160-250 different types of attacks, reporting them is very hard, and no one really seems to care (no damage). Is anyone else seeing this sort of traffic lately? I have 3 snort sensors, and they've been running for close to 2 years, and these attacks have registered on two different sensors, running different versions of snort, so I doubt its a snort freak out that's caused this. Is any one aware of some sort of new bug doing this?
Current thread:
- massive scans Steve Moran (Dec 02)
- <Possible follow-ups>
- RE: massive scans Miller, Eoin (Dec 02)