incidents 2002/03
By Thread

Starting: Thu Feb 28 2002 - 14:28:38 PST
Ending: Mon Apr 01 2002 - 16:43:04 PST

• Re: "Nimda"? Nick FitzGerald (Thu Feb 28 2002 - 14:05:44 PST)
  • Re: "Nimda"? Greg Williamson (Thu Feb 28 2002 - 13:28:16 PST)
• RE: Suspect short first fragment? Boyan Krosnov (Thu Feb 28 2002 - 23:56:33 PST)
• Re: Rise in spoofing and smurfing? Stuart Sheldon (Fri Mar 01 2002 - 09:16:01 PST)
• Update: UDP 770 Potential Worm Byrne Ghavalas (Fri Mar 01 2002 - 15:16:53 PST)
  • Re: Update: UDP 770 Potential Worm H C (Fri Mar 01 2002 - 20:21:12 PST)
    • Re: Update: UDP 770 Potential Worm Byrne Ghavalas (Fri Mar 01 2002 - 23:48:12 PST)
      • Re: Update: UDP 770 Potential Worm H C (Sat Mar 02 2002 - 06:43:50 PST)
      • Re: Update: UDP 770 Potential Worm H C (Mon Mar 04 2002 - 05:12:09 PST)
• *****SPAM***** Re: Large Attack Passion (Fri Mar 01 2002 - 20:06:56 PST)
• FYI - slow scans for https... Russell Fulton (Sun Mar 03 2002 - 13:30:50 PST)
  • Re: FYI - slow scans for https... Hugo van der Kooij (Mon Mar 04 2002 - 02:07:08 PST)
  • Re: FYI - slow scans for https... Andreas Östling (Mon Mar 04 2002 - 01:16:36 PST)
  • Re: FYI - slow scans for https... Erik Fichtner (Mon Mar 04 2002 - 11:38:55 PST)
• Rcon trojan Owen Creger (Mon Mar 04 2002 - 09:08:00 PST)
  • Re: Rcon trojan Hugo van der Kooij (Mon Mar 04 2002 - 14:16:20 PST)
  • Re: Rcon trojan Tom Gerritsen (Mon Mar 04 2002 - 14:39:04 PST)
    • Re: Rcon trojan H C (Tue Mar 05 2002 - 05:38:07 PST)
  • Re: Rcon trojan H C (Mon Mar 04 2002 - 17:53:32 PST)
• Re: Solaris hack Christopher Samuel (Mon Mar 04 2002 - 02:36:12 PST)
• increase in ftp scanning quentynat_private (Mon Mar 04 2002 - 04:15:34 PST)
  • Re: increase in ftp scanning adminat_private (Tue Mar 05 2002 - 06:56:59 PST)
  • Re: increase in ftp scanning Dragos Ruiu (Mon Mar 04 2002 - 18:24:19 PST)
  • Re: increase in ftp scanning Baribault, Gary (Tue Mar 05 2002 - 05:40:33 PST)
  • RE: increase in ftp scanning Benninghoff, John (Tue Mar 05 2002 - 07:44:58 PST)
  • RE: increase in ftp scanning Ryan Hill (Tue Mar 05 2002 - 09:48:04 PST)
• Increase in squid scanning... switched (Tue Mar 05 2002 - 08:36:26 PST)
  • Re: Increase in squid scanning... Baribault, Gary (Tue Mar 05 2002 - 10:08:15 PST)
  • Re: Increase in squid scanning... David Jacoby (Mon Mar 11 2002 - 02:00:36 PST)
• Compromised - Port 1524 Hines, Eric (Wed Mar 06 2002 - 11:48:10 PST)
  • Re: Compromised - Port 1524 Jose Miguel Varet (Wed Mar 06 2002 - 14:53:36 PST)
  • Re: Compromised - Port 1524 switched (Wed Mar 06 2002 - 14:19:52 PST)
  • Re: Compromised - Port 1524 blazin w (Wed Mar 06 2002 - 18:46:54 PST)
• Probes to strange ports Kenneth Wilson (Wed Mar 06 2002 - 15:34:07 PST)
  • RE: Probes to strange ports Kinsey, Robert (Wed Mar 06 2002 - 16:24:09 PST)
    • RE: Probes to strange ports H C (Wed Mar 06 2002 - 18:42:46 PST)
• Re: ncacn_http/1.0 cw (Thu Mar 07 2002 - 13:00:14 PST)
• New Nimda? Bradley, Tony (Thu Mar 07 2002 - 11:47:38 PST)
  • RE: New Nimda? Steve (Thu Mar 07 2002 - 18:45:15 PST)
• Stray UDP activity? sheib (Fri Mar 08 2002 - 05:31:00 PST)
  • Re: Stray UDP activity? Jim Watt (Fri Mar 08 2002 - 14:59:26 PST)
• increase in smb scans Nathan W. Labadie (Fri Mar 08 2002 - 06:06:37 PST)
  • increase in smb scans Lee Ayres (Fri Mar 08 2002 - 15:13:05 PST)
  • Re: increase in smb scans Hugo van der Kooij (Fri Mar 08 2002 - 14:41:59 PST)
  • Re: increase in smb scans Nathan W. Labadie (Fri Mar 15 2002 - 06:39:27 PST)
• sshd: PAM pam_set_item: NULL pam handle passed Matt Zimmerman (Thu Mar 07 2002 - 19:29:32 PST)
  • Re: sshd: PAM pam_set_item: NULL pam handle passed Tina Bird (Fri Mar 08 2002 - 16:16:23 PST)
    • Re: sshd: PAM pam_set_item: NULL pam handle passed Matt Zimmerman (Sat Mar 09 2002 - 09:06:46 PST)
      • Bug#137492: PAM pam_set_item: NULL pam handle passed Matt Zimmerman (Sat Mar 09 2002 - 09:21:24 PST)
  • Re: sshd: PAM pam_set_item: NULL pam handle passed Chris Faulhaber (Fri Mar 08 2002 - 15:30:46 PST)
    • Re: sshd: PAM pam_set_item: NULL pam handle passed Matt Zimmerman (Fri Mar 08 2002 - 16:04:15 PST)
• We have lots of users with SonicWalls for VPN connectivity in to FW-1, possible major security hole Mark J. DeFilippis (Fri Mar 08 2002 - 10:14:10 PST)
• Response from Activision re: RTCW? Mark Spencer (Sun Mar 10 2002 - 08:14:38 PST)
• Port UDP 3049 Ryan Russell (Sat Mar 09 2002 - 15:40:37 PST)
  • RE: Port UDP 3049 Paulo.Sedrezat_private (Mon Mar 11 2002 - 04:17:42 PST)
    • RE: Port UDP 3049 Ryan Russell (Mon Mar 11 2002 - 08:39:19 PST)
  • Re: Port UDP 3049 Thomas Akin (Wed Mar 13 2002 - 21:58:54 PST)
• AW: Response from Activision re: RTCW? vogtat_private (Mon Mar 11 2002 - 03:30:41 PST)
• HTTPS scans Keith T. Morgan (Mon Mar 11 2002 - 09:53:49 PST)
  • Re: HTTPS scans Kurt Seifried (Mon Mar 11 2002 - 11:20:45 PST)
  • Re: HTTPS scans H C (Mon Mar 11 2002 - 10:57:11 PST)
• Re: SMTP Probe/Attack? Patrick Andry (Mon Mar 11 2002 - 08:32:13 PST)
• Re: nouser - rootkit ? Eric Brandwine (Mon Mar 11 2002 - 09:57:38 PST)
  • Re: nouser - rootkit ? Ryan Russell (Mon Mar 11 2002 - 12:41:07 PST)
  • Re: nouser - rootkit ? Konrad Rieck (Mon Mar 11 2002 - 14:59:59 PST)
    • Re: nouser - rootkit ? Bruce Ediger (Mon Mar 11 2002 - 19:26:00 PST)
      • Re: nouser - rootkit ? Kyle R Maxwell (Tue Mar 12 2002 - 11:08:06 PST)
      • Re: nouser - rootkit ? Jose Nazario (Tue Mar 12 2002 - 13:54:55 PST)
      • Re: nouser - rootkit ? [:multiple root kit thread:] Dan Rohan (Tue Mar 12 2002 - 09:26:59 PST)
    • Re: nouser - rootkit ? Dave Dittrich (Mon Mar 11 2002 - 23:33:39 PST)
    • Re: nouser - rootkit ? Brian Hatch (Mon Mar 11 2002 - 19:45:50 PST)
  • Re: nouser - rootkit ? Eric Brandwine (Mon Mar 11 2002 - 17:08:14 PST)
  • Re: nouser - rootkit ? Bill_Roydsat_private (Tue Mar 12 2002 - 09:10:02 PST)
  • Re: nouser - rootkit ? Eric Brandwine (Tue Mar 12 2002 - 08:32:51 PST)
• Keylogger Needed Quick! Tom Kapanka (Mon Mar 11 2002 - 16:00:38 PST)
  • Re: Keylogger Needed Quick! Luis Bruno (Tue Mar 12 2002 - 05:02:56 PST)
  • Re: Keylogger Needed Quick! Seth Arnold (Tue Mar 12 2002 - 11:43:18 PST)
  • RE: Keylogger Needed Quick! Tom Kapanka (Thu Mar 14 2002 - 15:06:54 PST)
• AW: nouser - rootkit ? vogtat_private (Tue Mar 12 2002 - 01:21:27 PST)
  • Re: AW: nouser - rootkit ? Rob McCauley (Tue Mar 12 2002 - 08:55:59 PST)
• Analysis of litmus backdoor trojan John C. Hennessy (Tue Mar 12 2002 - 06:37:10 PST)
• very interesting 0day tool... http honeypot in action Michal Zalewski (Tue Mar 12 2002 - 08:17:26 PST)
  • Re: very interesting 0day tool... http honeypot in action zeno (Tue Mar 12 2002 - 10:23:59 PST)
  • Re: very interesting 0day tool... http honeypot in action Michal Zalewski (Wed Mar 13 2002 - 06:54:53 PST)
• Sloppy compromise switched (Wed Mar 13 2002 - 09:23:47 PST)
• RemoteNC backdoors, attacks via ports 1433, 524, 139, 445, 21, destroyed files bukysat_private (Wed Mar 13 2002 - 10:07:29 PST)
  • Re: RemoteNC backdoors, attacks via ports 1433, 524, 139, 445, 21, destroyed files switched (Wed Mar 13 2002 - 11:59:29 PST)
  • RE: RemoteNC backdoors, attacks via ports 1433, 524, 139, 445, 21, destroyed files James McGee (Wed Mar 13 2002 - 16:28:52 PST)
• FTP back in Vogue? leon (Wed Mar 13 2002 - 11:59:29 PST)
  • Re: FTP back in Vogue? Nathan W. Labadie (Wed Mar 13 2002 - 12:44:13 PST)
  • Re: FTP back in Vogue? switched (Wed Mar 13 2002 - 12:49:00 PST)
    • RE: FTP back in Vogue? John Rodley (Wed Mar 13 2002 - 18:49:52 PST)
• ssh exploit Lee Evans (Thu Mar 14 2002 - 11:12:47 PST)
  • Re: ssh exploit Lee Evans (Thu Mar 14 2002 - 15:10:04 PST)
• A new hack tool - tcp port 3139 ? METE.EMINAGAOGLUat_private (Fri Mar 15 2002 - 11:24:32 PST)
  • RE: A new hack tool - tcp port 3139 ? METE.EMINAGAOGLUat_private (Fri Mar 15 2002 - 14:49:42 PST)
• Question about HTTP DDOS attacks. eaxat_private (Fri Mar 15 2002 - 20:13:27 PST)
  • Re: Question about HTTP DDOS attacks. Hugo van der Kooij (Sun Mar 17 2002 - 22:42:47 PST)
    • Re: Question about HTTP DDOS attacks. Kyle R. Hofmann (Mon Mar 18 2002 - 10:26:35 PST)
• Major DNS cache poisoning at Verisign/WorldNIC Matthew F. Caldwell (Tue Mar 19 2002 - 11:18:56 PST)
  • Re: Major DNS cache poisoning at Verisign/WorldNIC Brian McWilliams (Wed Mar 20 2002 - 10:17:54 PST)
• increase in scans for RPC Todd Suiter (Tue Mar 19 2002 - 16:11:32 PST)
  • RE: increase in scans for RPC Dan Irwin (Wed Mar 20 2002 - 16:28:31 PST)
• ORBZ shut down David Ulevitch (Tue Mar 19 2002 - 23:25:25 PST)
  • Re: ORBZ shut down jlewisat_private (Wed Mar 20 2002 - 09:19:04 PST)
    • Re: ORBZ shut down Brad Arlt (Wed Mar 20 2002 - 15:53:06 PST)
• Sub7 (SubSeven), Win2k, and IE 5.5 Kirk Schafer (Wed Mar 20 2002 - 11:39:53 PST)
  • Re: Sub7 (SubSeven), Win2k, and IE 5.5 H C (Wed Mar 20 2002 - 13:27:39 PST)
• Port 1900/5000 connection attempts cambriaat_private (Thu Mar 21 2002 - 20:28:50 PST)
• different, nimda like, probes Russell Fulton (Thu Mar 21 2002 - 16:07:24 PST)
• {MERIT-INP} 7.0.1.0 -> 14.0.2.13 seren geti (Fri Mar 22 2002 - 10:29:56 PST)
  • Re: {MERIT-INP} 7.0.1.0 -> 14.0.2.13 Valdis.Kletnieksat_private (Fri Mar 22 2002 - 12:46:13 PST)
• Logon Banners leon (Fri Mar 22 2002 - 21:17:53 PST)
  • Re: Logon Banners Chris Ricker (Fri Mar 22 2002 - 23:04:08 PST)
  • Re: Logon Banners Led Slinger (Fri Mar 22 2002 - 23:42:05 PST)
  • Re: Logon Banners Hugo van der Kooij (Sat Mar 23 2002 - 01:12:44 PST)
  • Re: Logon Banners Chris Wilson (Sat Mar 23 2002 - 05:38:51 PST)
  • RE: Logon Banners Rohrer, Mark E (Sat Mar 23 2002 - 09:20:38 PST)
• watching them -after the fact Alvin Oga (Sun Mar 24 2002 - 23:11:37 PST)
  • Re: watching them -after the fact zeno (Tue Mar 26 2002 - 06:23:01 PST)
• fun with posiden rootkit Olaf Schreck (Mon Mar 25 2002 - 11:01:35 PST)
  • Re: fun with posiden rootkit Alvin Oga (Mon Mar 25 2002 - 13:44:56 PST)
  • Re: fun with posiden rootkit Skip Carter (Mon Mar 25 2002 - 14:48:10 PST)
    • Re: fun with posiden rootkit Dave Dittrich (Mon Mar 25 2002 - 23:36:33 PST)
• DoS yesterday Dmitri Smirnov (Tue Mar 26 2002 - 13:24:00 PST)
• network mystery network-questionsat_private (Tue Mar 26 2002 - 16:24:38 PST)
• Excess SMTP traffic to non-mail host Basil Hussain (Wed Mar 27 2002 - 04:10:39 PST)
  • Re: Excess SMTP traffic to non-mail host dr john halewood (Wed Mar 27 2002 - 08:41:06 PST)
  • Re: Excess SMTP traffic to non-mail host Chris Wilkes (Wed Mar 27 2002 - 08:56:37 PST)
  • RE: Excess SMTP traffic to non-mail host NESTING, DAVID M (SBCSI) (Wed Mar 27 2002 - 08:51:11 PST)
• Sendmail DOS ? Fragga (Wed Mar 27 2002 - 02:30:37 PST)
  • Re: Sendmail DOS ? Ken Lyon (Wed Mar 27 2002 - 09:15:13 PST)
  • Re: Sendmail DOS ? Micheal Patterson (Wed Mar 27 2002 - 09:06:24 PST)
  • RE: Sendmail DOS ? Steve Halligan (Wed Mar 27 2002 - 13:12:49 PST)
    • RE: Sendmail DOS ? Hugo van der Kooij (Wed Mar 27 2002 - 13:43:27 PST)
• Weird log entries... Josh Diakun (Thu Mar 28 2002 - 02:06:33 PST)
  • Re: Weird log entries... zeno (Thu Mar 28 2002 - 05:21:51 PST)
  • Re: Weird log entries... Kelly Martin (Thu Mar 28 2002 - 05:47:07 PST)
  • Re: Weird log entries... Florian Weimer (Thu Mar 28 2002 - 06:22:20 PST)
  • RE: Weird log entries... Cushing, David (Thu Mar 28 2002 - 06:25:13 PST)
  • RE: Weird log entries... Michael Ward (Thu Mar 28 2002 - 06:55:18 PST)
  • RE: Weird log entries... John Hartley (Thu Mar 28 2002 - 06:13:00 PST)
• strange UDP 5400 traffic Maarten (Fri Mar 29 2002 - 10:15:41 PST)
  • Re: strange UDP 5400 traffic ipfwat_private (Sat Mar 30 2002 - 05:32:56 PST)
• Email Relay Searches Pat Moffitt (Fri Mar 29 2002 - 08:15:03 PST)
  • Re: Email Relay Searches Allen Smith (Fri Mar 29 2002 - 21:21:58 PST)
• Odd activity Kelly Martin (Sat Mar 30 2002 - 16:30:19 PST)
• I think I've been hacked...please help! Joe Warner (Sat Mar 30 2002 - 07:51:27 PST)
  • Re: I think I've been hacked...please help! Ryan Russell (Sun Mar 31 2002 - 22:05:52 PST)

Last message date: Mon Apr 01 2002 - 16:43:04 PST
Archived on: Mon Apr 01 2002 - 16:43:13 PST

This archive was generated by hypermail 2b30 : Mon Apr 01 2002 - 16:43:13 PST