RE: [suse-security] Port 13139 - attack?

From: Richard Stanway (incidentsat_private)
Date: Tue Feb 19 2002 - 10:19:42 PST

Next message: Dan Terhesiu: "Re: SNMP Scans 02/17/02"

Previous message: Jens Hektor: "/etc/ld.so.preload was: strange telnet behavior"
In reply to: JW: "Fwd: [suse-security] Port 13139 - attack?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> >Has anyone else seen this happen recently.  Is there a new
> attack of some sort which is
> >directed to port 13139?  I have never noticed this specific port
> before with so many hits
> >and now it is starting to rival the old nimba entries in my logs.
> >
> >Thanks,
> >
> >Jim
>
> He mentioned in another post later that it's UDP.

I just noticed this too when going over some of my firewall logs - turns out
port 13139 is used by GameSpy Arcade for "Custom UDP Pings". Simply by
joining one of the gamespy game channels will trigger every user in there to
start pinging you in this way.

Richard Stanway
http://www.r1ch.net/


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Dan Terhesiu: "Re: SNMP Scans 02/17/02"
Previous message: Jens Hektor: "/etc/ld.so.preload was: strange telnet behavior"
In reply to: JW: "Fwd: [suse-security] Port 13139 - attack?"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Feb 20 2002 - 15:40:59 PST