Re: Jetdirect card Attack???

From: Bojan Zdravkovic (bzdravkoat_private)
Date: Thu Jul 19 2001 - 17:00:42 PDT

  • Next message: Penn, Toby (IT.Ops Security Services): "Host Unreachable Scan"

    Hi James,
    
    Make sure nobody is running ISS scans on your LAN. They are known to throw
    printers and printservers out of whack.
    
    -Bojan
    
    
    
    
    
    James Edwards <jedwardsat_private> on 07/19/2001 01:07:09 PM
    
    To:   sdsu-certat_private
    cc:   incidentsat_private (bcc: Bojan Zdravkovic/SIAC)
    Subject:  Jetdirect card Attack???
    
    
    
    Yesterday, one of the printers here in ITS began printing a Jetdirect
    Diagnostic Page showing a S/W Exception 00fb and a core dump
    ("Registers", "Stack", and "Register Pointer Memory Dump" in Hex). I
    changed the slot, and the error followed (from EIO1 to EIO2),
    therefore I guessed that the card was bad. Today another printer
    began to share the same symptoms. I have a hard time believing that
    two cards would go bad at the same time
    
    Has anyone else noted this phenomenon??
    
    Could it be a different type of printer attack than the port 515 attacks??
    
    Jim
    
    (PS, I've already called John and notified him--he asked me to post
    here (I'm also posting to the Security Focus list) for feedback.)
    --
    James Edwards
    Instructional Technology Consultant
    Instructional Technology Services
    Adams Humanities-1109, MC-8114
    San Diego State University
    San Diego, Ca. 92182-8114
    
      (619) 594-5727
      mailto:jedwardsat_private
      Fax (619) 594-4061
      <http://www-rohan.sdsu.edu/dept/its/directory/staff.html#Jim>
    
    
    ----------------------------------------------------------------------------
    
    
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management
    and tracking system please see:
    
    http://aris.securityfocus.com
    
    
    
    
    
    
    
    ----------------------------------------------------------------------------
    
    
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see:
    
    http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jul 19 2001 - 20:08:51 PDT