Re: TCP/1008 port scans

From: Andreas Östling (andreasoat_private)
Date: Wed Apr 25 2001 - 11:11:09 PDT

Next message: Leon Rosenstein: "new worm scan?"

Previous message: Russell Fulton: "Re: scan for 109, new worm-variant or simple scan?"
In reply to: Jeff Nieusma: "TCP/1008 port scans"
Next in thread: Joe Matusiewicz: "Re: TCP/1008 port scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Wed, 25 Apr 2001, Jeff Nieusma wrote:
[...]
> I've seen 215 log entries this month from 9 Internet
> hosts aimed at 177 internal hosts behind a filter that
> denies port 1008. Anyone know anything about this?

It might be someone looking for open root shells left behind by early
versions of the Lion worm.
Check out Max Vision's analysis,
http://www.whitehats.com/library/worms/lion/index.html

Regards,
Andreas Östling

Next message: Leon Rosenstein: "new worm scan?"
Previous message: Russell Fulton: "Re: scan for 109, new worm-variant or simple scan?"
In reply to: Jeff Nieusma: "TCP/1008 port scans"
Next in thread: Joe Matusiewicz: "Re: TCP/1008 port scans"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Apr 26 2001 - 07:43:33 PDT