incidents 2002/02
By Thread

Most recent messages
233 messages sorted by: [ author ] [ date ] [ subject ]
Other mail archives

Starting: Thu Jan 31 2002 - 13:33:53 PST
Ending: Sun Mar 10 2002 - 17:10:16 PST

[Unusual Network_scan[tcp-6267]] Russell Fulton (Thu Jan 31 2002 - 13:30:17 PST)
Re: Apache 1.3.XX Russell Fulton (Thu Jan 31 2002 - 13:30:16 PST)
- Re: Apache 1.3.XX Russell Fulton (Thu Jan 31 2002 - 19:05:17 PST)
  - Re: Apache 1.3.XX Blake Frantz (Fri Feb 01 2002 - 12:53:35 PST)
    - Re: Apache 1.3.XX Veins (Fri Feb 01 2002 - 13:17:35 PST)
- Re: Apache 1.3.XX Sten (Fri Feb 01 2002 - 04:03:21 PST)
Re: optic rootkit (was Re: xsf/xchk) Maybe t0rn anon-ymousat_private (Thu Jan 31 2002 - 16:02:47 PST)
Help please Ryan Hairyes (Sat Feb 02 2002 - 11:41:05 PST)
- Re: Help please Alan L. Waller (Mon Feb 04 2002 - 09:14:20 PST)
- Re: Help please H C (Mon Feb 04 2002 - 09:36:10 PST)
- Re: Help please Neil Dickey (Mon Feb 04 2002 - 09:51:19 PST)
- Re: Help please Chris Wilkes (Mon Feb 04 2002 - 09:07:03 PST)
- RE: Help please McCammon, Keith (Mon Feb 04 2002 - 08:57:32 PST)
- RE: Help please Ryan Hairyes (Mon Feb 04 2002 - 11:33:26 PST)
HTTP 408 errors Thomas Frerichs (Sun Feb 03 2002 - 21:53:40 PST)
- RE: HTTP 408 errors Chip McClure (Mon Feb 04 2002 - 09:15:10 PST)
- Re: HTTP 408 errors James Golovich (Mon Feb 04 2002 - 09:03:19 PST)
- Re: HTTP 408 errors Markus Stumpf (Wed Feb 06 2002 - 06:32:49 PST)
gibberish defacement? Oliver Petruzel (Mon Feb 04 2002 - 06:29:44 PST)
- Re: gibberish defacement? townsendat_private (Mon Feb 04 2002 - 10:41:05 PST)
- RE: gibberish defacement? Rob Keown (Mon Feb 04 2002 - 11:22:52 PST)
- Re: gibberish defacement? John R. Marshall (Mon Feb 04 2002 - 12:29:35 PST)
- Re: gibberish defacement? Eryn Rachell (Mon Feb 04 2002 - 11:39:55 PST)
- Re: gibberish defacement? John Sage (Mon Feb 04 2002 - 12:42:17 PST)
New Nimda scanning pattern ? Russell Fulton (Mon Feb 04 2002 - 12:30:50 PST)
Re: nimda like probes Russell Fulton (Mon Feb 04 2002 - 19:14:53 PST)
We Are Past Your Firewall... raymond simon (Tue Feb 05 2002 - 12:54:52 PST)
- RE: We Are Past Your Firewall... McCammon, Keith (Tue Feb 05 2002 - 13:13:05 PST)
- RE: We Are Past Your Firewall... Corey Snipes (Tue Feb 05 2002 - 13:38:48 PST)
- Re: We Are Past Your Firewall...Thanks for the responses raymond simon (Wed Feb 06 2002 - 06:55:19 PST)
Scan that doesn't make sense Johan Augustsson (Wed Feb 06 2002 - 01:21:52 PST)
- Re: Scan that doesn't make sense Johan Augustsson (Wed Feb 06 2002 - 10:04:17 PST)
Why would my machine do this? Pat Moffitt (Thu Feb 07 2002 - 13:11:58 PST)
- RE: Why would my machine do this? Bill Royds (Thu Feb 07 2002 - 16:35:44 PST)
  - RE: Why would my machine do this? Jose Nazario (Fri Feb 08 2002 - 09:29:32 PST)
Strange kind of D.o.S. attack... Raistlin (Fri Feb 08 2002 - 02:37:31 PST)
Netware doing rouge portmap requests? Soeren Ziehe (Fri Feb 08 2002 - 03:46:00 PST)
Steady increase in ssh scans TCG CSIRT (Mon Feb 11 2002 - 08:35:40 PST)
- RE: Steady increase in ssh scans Lee Brotherston (Mon Feb 11 2002 - 10:55:05 PST)
- Re: Steady increase in ssh scans Adam Manock (Mon Feb 11 2002 - 11:39:43 PST)
  - Re: Steady increase in ssh scans Stuart Thomas (Mon Feb 11 2002 - 12:52:44 PST)
  - Re: Steady increase in ssh scans Thomas Themel (Tue Feb 12 2002 - 06:15:13 PST)
- Re: Steady increase in ssh scans Russell Fulton (Mon Feb 11 2002 - 13:18:51 PST)
  - Re: Steady increase in ssh scans Dave Dittrich (Mon Feb 11 2002 - 17:57:53 PST)
- Re: Steady increase in ssh scans Skip Carter (Mon Feb 11 2002 - 14:38:35 PST)
- RE: Steady increase in ssh scans Etienne Joubert (Mon Feb 11 2002 - 23:03:09 PST)
Analysis of the Beastkit v.7 Tom Fischer (Mon Feb 11 2002 - 05:44:52 PST)
TuxKit1.0 and other rootkits Rune Henssel (Sun Feb 10 2002 - 16:32:20 PST)
- Re: TuxKit1.0 and other rootkits Jose Nazario (Mon Feb 11 2002 - 09:02:25 PST)
- Re: TuxKit1.0 and other rootkits GiulioMaria Fontana (Tue Feb 12 2002 - 02:18:35 PST)
morpheus/kazaa probes/scans k (Mon Feb 11 2002 - 16:49:32 PST)
- Re: morpheus/kazaa probes/scans Raistlin (Mon Feb 11 2002 - 12:54:46 PST)
- Re: morpheus/kazaa probes/scans Mike Damm (Mon Feb 11 2002 - 14:34:03 PST)
- Re: morpheus/kazaa probes/scans Russell Fulton (Mon Feb 11 2002 - 13:39:53 PST)
- RE: morpheus/kazaa probes/scans BRAD GRIFFIN (Mon Feb 11 2002 - 15:04:26 PST)
  - Re: morpheus/kazaa probes/scans Troy D. Strum (Tue Feb 12 2002 - 07:51:46 PST)
new SNMP vuln Gerrie / Hit2000 (Tue Feb 12 2002 - 03:04:47 PST)
Malicious web sites VanMeter, John (Tue Feb 12 2002 - 06:27:56 PST)
- RE: Malicious web sites Joakim Aronius (QRA) (Tue Feb 12 2002 - 23:25:47 PST)
Strange web request Nexus (Tue Feb 12 2002 - 09:17:18 PST)
- Re: Strange web request Johannes B. Ullrich (Tue Feb 12 2002 - 10:09:03 PST)
- Re: Strange web request zeno (Tue Feb 12 2002 - 10:02:24 PST)
- Re: Strange web request Gene Barlow (Tue Feb 12 2002 - 18:34:11 PST)
Solaris syslog output from PROTOS tool (fwd) Tina Bird (Wed Feb 13 2002 - 11:49:32 PST)
Port 80 SYN flood-like behavior NESTING, DAVID M (SBCSI) (Wed Feb 13 2002 - 14:51:54 PST)
- Re: Port 80 SYN flood-like behavior Stuart Sheldon (Wed Feb 13 2002 - 15:54:17 PST)
  - Re: Port 80 SYN flood-like behavior Matthew Leeds (Wed Feb 13 2002 - 17:11:42 PST)
- Re: Port 80 SYN flood-like behavior Steve Gibson (Wed Feb 13 2002 - 15:54:45 PST)
  - Re: Port 80 SYN flood-like behavior Dave Dittrich (Wed Feb 13 2002 - 19:58:41 PST)
    - Re: Port 80 SYN flood-like behavior John Elliott (Wed Feb 13 2002 - 21:10:21 PST)
    - Re: Port 80 SYN flood-like behavior Dave (Fri Feb 15 2002 - 18:24:56 PST)
- Re: Port 80 SYN flood-like behavior Lewie Wolfgang (Wed Feb 13 2002 - 17:35:05 PST)
- Re: Port 80 SYN flood-like behavior Thierry Zoller (Thu Feb 14 2002 - 05:43:19 PST)
  - Re: Port 80 SYN flood-like behavior Dave Dittrich (Thu Feb 14 2002 - 15:40:25 PST)
- Re: Port 80 SYN flood-like behavior Thierry Zoller (Fri Feb 15 2002 - 06:20:17 PST)
- Re: Port 80 SYN flood-like behavior Thierry Zoller (Fri Feb 15 2002 - 05:28:05 PST)
  - Re: Port 80 SYN flood-like behavior Steve Gibson (Fri Feb 15 2002 - 11:39:09 PST)
- Re: Port 80 SYN flood-like behavior Steve Gibson (Fri Feb 15 2002 - 11:30:40 PST)
New MSN Messenger Worm Drew Smith (Wed Feb 13 2002 - 05:09:43 PST)
- RE: New MSN Messenger Worm Rocky Stefano (Wed Feb 13 2002 - 17:55:54 PST)
- Re: New MSN Messenger Worm Nathan Einwechter (Wed Feb 13 2002 - 18:47:00 PST)
- Re: New MSN Messenger Worm Bill Schalck (Wed Feb 13 2002 - 20:12:15 PST)
  - Re: New MSN Messenger Worm dreamwvrat_private (Thu Feb 14 2002 - 09:36:38 PST)
- RE: New MSN Messenger Worm Michael Fredericks (Thu Feb 14 2002 - 08:04:41 PST)
- Re: New MSN Messenger Worm Nick FitzGerald (Thu Feb 14 2002 - 00:30:21 PST)
new SunOS 5 rootkit? (fwd) Alan Thew (Thu Feb 14 2002 - 02:26:26 PST)
- Re: new SunOS 5 rootkit? (fwd) Michael H. Warfield (Thu Feb 14 2002 - 19:57:06 PST)
heads up: worm on the loose david evlis reign (Thu Feb 14 2002 - 01:44:11 PST)
NSDAP Solaris rootkit SecLists (Thu Feb 14 2002 - 08:53:39 PST)
NSDAP Solaris rootkit and tripwire report online SecLists (Thu Feb 14 2002 - 12:28:14 PST)
variation of the dtspcd exploit? Nathan W. Labadie (Thu Feb 14 2002 - 13:07:10 PST)
- Re: variation of the dtspcd exploit? Valdis.Kletnieksat_private (Thu Feb 14 2002 - 19:00:19 PST)
IDS signatures for PROTOS SNMP tests Tina Bird (Thu Feb 14 2002 - 20:55:57 PST)
- RE: IDS signatures for PROTOS SNMP tests Russell Siverland-Bishop (Fri Feb 15 2002 - 09:37:30 PST)
Stack Execution Hornat, Charles (Fri Feb 15 2002 - 12:27:43 PST)
- Re: Stack Execution Kurt Seifried (Fri Feb 15 2002 - 13:03:14 PST)
  - Re: Stack Execution Eric Brandwine (Fri Feb 15 2002 - 14:02:09 PST)
More Solaris snmpdx syslog data Tina Bird (Fri Feb 15 2002 - 15:07:37 PST)
Slow SNMP scan... Jay Quinby (Fri Feb 15 2002 - 15:13:42 PST)
- Re: Slow SNMP scan... Jim Watt (Fri Feb 15 2002 - 18:55:44 PST)
Fwd: [suse-security] Port 13139 - attack? JW (Sat Feb 16 2002 - 12:58:39 PST)
- RE: [suse-security] Port 13139 - attack? Richard Stanway (Tue Feb 19 2002 - 10:19:42 PST)
SNMP Scans 02/17/02 Peter Johnson (Sun Feb 17 2002 - 20:23:09 PST)
- Re: SNMP Scans 02/17/02 Security Coordinator (Tue Feb 19 2002 - 06:50:39 PST)
  - Re: SNMP Scans 02/17/02 Valdis.Kletnieksat_private (Thu Feb 21 2002 - 11:02:36 PST)
  - RE: SNMP Scans 02/17/02 Tyrannis Von Nettesheim (Wed Feb 20 2002 - 20:32:20 PST)
- Re: SNMP Scans 02/17/02 Dan Terhesiu (Tue Feb 19 2002 - 00:12:43 PST)
  - Re: SNMP Scans 02/17/02 Peter Johnson (Tue Feb 19 2002 - 01:29:35 PST)
- Re: SNMP Scans 02/17/02 Eric Brandwine (Wed Feb 20 2002 - 17:15:28 PST)
- RE: SNMP Scans 02/17/02 Dmitri Smirnov (Wed Feb 20 2002 - 14:35:58 PST)
- Re: SNMP Scans 02/17/02 Eric Brandwine (Sat Feb 23 2002 - 08:17:21 PST)
strange telnet behavior Vladimir Ivaschenko (Mon Feb 18 2002 - 06:13:08 PST)
- Re: strange telnet behavior Pavel Kankovsky (Tue Feb 19 2002 - 04:56:54 PST)
  - Re: strange telnet behavior Vladimir Ivaschenko (Tue Feb 19 2002 - 05:17:25 PST)
- Re: strange telnet behavior Bryan Andersen (Tue Feb 19 2002 - 19:57:49 PST)
  - Re: strange telnet behavior Gideon Lenkey (Wed Feb 20 2002 - 20:41:21 PST)
    - Re: strange telnet behavior Paul Gear (Fri Feb 22 2002 - 13:09:01 PST)
- Re: strange telnet behavior tfmat_private (Tue Feb 19 2002 - 10:19:50 PST)
  - Solaris hack Jamie Lawrence (Thu Feb 21 2002 - 20:05:06 PST)
  - Re: strange telnet behavior Raistlin (Thu Feb 21 2002 - 06:58:26 PST)
- RE: strange telnet behavior Snow, Corey (Fri Feb 22 2002 - 13:55:29 PST)
ckcool? Bob Maccione (Tue Feb 19 2002 - 06:45:01 PST)
- Re: ckcool? Mike Shaw (Wed Feb 20 2002 - 14:51:47 PST)
- Re: ckcool? Johan Denoyer (Thu Feb 21 2002 - 09:03:08 PST)
- RE: ckcool? Bob Maccione (Wed Feb 20 2002 - 14:51:14 PST)
- Fw: ckcool? James (Wed Feb 20 2002 - 14:33:37 PST)
- Re: ckcool? Chris Wilkes (Wed Feb 20 2002 - 15:10:54 PST)
brocade snmp vulnerability info Quarantine (Wed Feb 20 2002 - 14:04:23 PST)
/etc/ld.so.preload was: strange telnet behavior Jens Hektor (Tue Feb 19 2002 - 22:00:09 PST)
NT/2K/XP Incident Response Training H C (Wed Feb 20 2002 - 10:20:21 PST)
UDP Scan port 53(dns) -> dst port <1024 Clinton Smith (Wed Feb 20 2002 - 23:03:44 PST)
- Re: UDP Scan port 53(dns) -> dst port <1024 Robert Graham (Fri Feb 22 2002 - 14:04:14 PST)
  - Re: UDP Scan port 53(dns) -> dst port <1024 Clinton Smith (Sun Feb 24 2002 - 21:17:53 PST)
ICMP Src IP = Dst IP (not a Land attack) mtorenat_private (Thu Feb 21 2002 - 10:41:33 PST)
dtspcd and /tmp/.fakex , anyone got a copy? Rune Kristian Viken (Fri Feb 22 2002 - 01:21:58 PST)
Distributed MSADC/root.exe scans Chris Adams (Thu Feb 21 2002 - 21:44:38 PST)
- Re: Distributed MSADC/root.exe scans zeno (Mon Feb 25 2002 - 05:38:27 PST)
Virus/trojan tunnel out from behind firewall? David Carmean (Sun Feb 24 2002 - 11:15:25 PST)
- RE: Virus/Trojan tunnel out from behind firewall? Bill Royds (Mon Feb 25 2002 - 05:08:32 PST)
- Re: Virus/trojan tunnel out from behind firewall? Rich Puhek (Sun Feb 24 2002 - 20:22:12 PST)
  - Re: Virus/trojan tunnel out from behind firewall? David Carmean (Sun Feb 24 2002 - 23:07:15 PST)
    - Re: Virus/trojan tunnel out from behind firewall? Rich Puhek (Sun Feb 24 2002 - 23:37:24 PST)
    - Re: Virus/trojan tunnel out from behind firewall? Ben Efros (Mon Feb 25 2002 - 20:32:53 PST)
  - Re: Virus/trojan tunnel out from behind firewall? Mike Shaw (Mon Feb 25 2002 - 15:30:41 PST)
    - RE: Virus/trojan tunnel out from behind firewall? M.Verba (Mon Feb 25 2002 - 18:23:39 PST)
- Re: Virus/trojan tunnel out from behind firewall? Ryan Russell (Mon Feb 25 2002 - 01:01:28 PST)
More slow SNMP scans Jim Watt (Fri Feb 22 2002 - 18:35:38 PST)
Checking for rootkits Jason Dixon (Fri Feb 22 2002 - 14:55:24 PST)
- Re: Checking for rootkits Jason Dixon (Mon Feb 25 2002 - 05:48:11 PST)
  - Re: Checking for rootkits Jon O. (Mon Feb 25 2002 - 14:35:39 PST)
- Re: Checking for rootkits Matt Zimmerman (Sun Feb 24 2002 - 21:35:04 PST)
Smart Web Application Scanners (Sorta) zeno (Mon Feb 25 2002 - 08:34:19 PST)
Possible Worm: UDP Source port 770 Byrne Ghavalas (Mon Feb 25 2002 - 04:11:41 PST)
Vacation Troller, Please Ignore Jensenne Roculan (Mon Feb 25 2002 - 15:55:15 PST)
hack that changes root to Root James (Mon Feb 25 2002 - 16:49:05 PST)
- Re: hack that changes root to Root Yotam Rubin (Tue Feb 26 2002 - 11:17:27 PST)
  - Re: hack that changes root to Root james (Tue Feb 26 2002 - 14:17:34 PST)
    - Re: hack that changes root to Root William York (Wed Feb 27 2002 - 15:38:13 PST)
- Re: hack that changes root to Root Mike Shaw (Tue Feb 26 2002 - 13:00:22 PST)
Determining the country of orgin for IP address(es) Brian Nichols (Tue Feb 26 2002 - 07:16:00 PST)
- Re: Determining the country of orgin for IP address(es) Glenn Forbes Fleming Larratt (Tue Feb 26 2002 - 11:36:14 PST)
- Re: Determining the country of orgin for IP address(es) Neil Dickey (Tue Feb 26 2002 - 12:00:09 PST)
  - Re: Determining the country of orgin for IP address(es) Mally Mclane (Wed Feb 27 2002 - 00:44:16 PST)
- RE: Determining the country of orgin for IP address(es) dendlerat_private (Wed Feb 27 2002 - 08:56:35 PST)
Scan combining internal/external Stephen W. Thompson (Tue Feb 26 2002 - 07:34:53 PST)
- Re: Scan combining internal/external Rich Puhek (Tue Feb 26 2002 - 12:14:18 PST)
Wave of Nimda-like hits this morning? Ralph Los (Tue Feb 26 2002 - 06:46:56 PST)
- Wave of Nimda-like hits this morning? Michael Sutton (Tue Feb 26 2002 - 13:44:29 PST)
- RE: Wave of Nimda-like hits this morning? Brian Mooney (Tue Feb 26 2002 - 13:07:59 PST)
  - Re: Wave of Nimda-like hits this morning? John Brahy (Tue Feb 26 2002 - 16:36:22 PST)
    - Re: Wave of Nimda-like hits this morning? Benjamin Morin (Tue Feb 26 2002 - 23:54:40 PST)
  - RE: Wave of Nimda-like hits this morning? Christopher L. Morrow (Tue Feb 26 2002 - 17:44:43 PST)
- Re: Wave of Nimda-like hits this morning? security (Tue Feb 26 2002 - 17:14:46 PST)
- Re: Wave of Nimda-like hits this morning? Erick Brockway (Tue Feb 26 2002 - 18:57:48 PST)
IIS Server Log security breach? GP (Tue Feb 26 2002 - 13:09:15 PST)
- Re: IIS Server Log security breach? zeno (Tue Feb 26 2002 - 15:07:07 PST)
NTP scan ???? Russell Fulton (Tue Feb 26 2002 - 13:43:19 PST)
- Re: NTP scan ???? Paul Gear (Wed Feb 27 2002 - 04:05:24 PST)
- Re: NTP scan ???? Will Aoki (Tue Feb 26 2002 - 17:52:45 PST)
  - Re: NTP scan ???? Russell Fulton (Wed Feb 27 2002 - 12:16:55 PST)
    - Re: NTP scan ???? Paul Gear (Thu Feb 28 2002 - 02:40:05 PST)
- Re: NTP scan ???? John Kristoff (Thu Feb 28 2002 - 07:36:44 PST)
"Nimda"? Bradley, Tony (Tue Feb 26 2002 - 16:51:16 PST)
- Re: "Nimda"? Eric Brandwine (Tue Feb 26 2002 - 19:56:38 PST)
- RE: "Nimda"? Doug Harold (Wed Feb 27 2002 - 08:26:21 PST)
- Re: "Nimda"? Joshua_Hillerat_private (Tue Feb 26 2002 - 19:05:26 PST)
- Re: "Nimda"? Devdas Bhagat (Wed Feb 27 2002 - 00:40:06 PST)
- RE: "Nimda"? McCammon, Keith (Wed Feb 27 2002 - 10:13:07 PST)
- Re: "Nimda"? John.Swarbrickat_private (Wed Feb 27 2002 - 09:03:44 PST)
- Re: "Nimda"? Greg A. Woods (Wed Feb 27 2002 - 14:25:42 PST)
- Re: "Nimda"? Greg Williamson (Wed Feb 27 2002 - 19:48:26 PST)
  - Question sherman.hand (Thu Feb 28 2002 - 10:35:57 PST)
    - Re: Question Valdis.Kletnieksat_private (Thu Feb 28 2002 - 14:47:57 PST)
RE: [Whitehat] "Nimda"? Peter Mueller (Tue Feb 26 2002 - 18:30:55 PST)
PHP exploit (Was Re: Wave of Nimda-like hits this morning?) Chris Adams (Tue Feb 26 2002 - 17:48:48 PST)
- Re: PHP exploit (Was Re: Wave of Nimda-like hits this morning?) Chris Adams (Wed Feb 27 2002 - 13:14:08 PST)
Increase in Nimda/Code Red Variants - New Requests Made Joshua_Hillerat_private (Tue Feb 26 2002 - 18:10:59 PST)
Strange entry in Apache access log Tommaso Di Donato (Tue Feb 26 2002 - 23:49:01 PST)
More info about New PHP Exploit Richard Gilman (Wed Feb 27 2002 - 14:19:25 PST)
Strange DNS stuff Anthony Buser (Wed Feb 27 2002 - 11:30:20 PST)
- Re: Strange DNS stuff Brian Hatch (Wed Feb 27 2002 - 23:45:58 PST)
- RE: Strange DNS stuff Wirth, Jeff (Thu Feb 28 2002 - 07:18:48 PST)
Suspect short first fragment? jamie@jamie-sue.org (Thu Feb 28 2002 - 09:57:09 PST)
- RE: Suspect short first fragment? Ralph Los (Thu Feb 28 2002 - 10:28:22 PST)
- RE: Suspect short first fragment? Boyan Krosnov (Thu Feb 28 2002 - 12:29:34 PST)
Its not a nimda variant, its the old nimda. Robert Buckley (Thu Feb 28 2002 - 09:09:40 PST)
Rise in spoofing and smurfing? Glenn Forbes Fleming Larratt (Thu Feb 28 2002 - 19:12:42 PST)
nouser - rootkit ? Dan Uscatu (Sun Feb 10 2002 - 15:44:31 PST)

Last message date: Sun Mar 10 2002 - 17:10:16 PST
Archived on: Sun Mar 10 2002 - 17:10:25 PST

233 messages sorted by: [ author ] [ date ] [ subject ]
Other mail archives

This archive was generated by hypermail 2b30 : Sun Mar 10 2002 - 17:10:25 PST

incidents 2002/02By Thread

incidents 2002/02
By Thread