incidents 2002/05
By Date

Starting: Wed May 01 2002 - 08:28:09 PDT
Ending: Fri May 31 2002 - 16:04:47 PDT

• New nimda variant? Russell Fulton (Tue Apr 30 2002 - 17:58:31 PDT)
• A friend's cable modem Linux machine just got compromised Sam Trenholme (Wed May 01 2002 - 01:18:57 PDT)
• New nimda variant? Russell Fulton (Tue Apr 30 2002 - 17:07:14 PDT)
• Re: A friend's cable modem Linux machine just got compromised Jason Robertson (Wed May 01 2002 - 09:11:21 PDT)
• Re: A friend's cable modem Linux machine just got compromised Sam Trenholme (Wed May 01 2002 - 13:39:26 PDT)
• Tuxkit (Optic Kit?) -cracked (/dev/tux) Mark Newby (Thu May 02 2002 - 03:54:25 PDT)
• Re: A friend's cable modem Linux machine just got compromised William N. Zanatta (Thu May 02 2002 - 06:12:45 PDT)
• Honeynet Project -> The Reverse Challenge Lance Spitzner (Wed May 01 2002 - 13:11:14 PDT)
• ssh scans using username 'test' or 'oracle'? Matt Zimmerman (Thu May 02 2002 - 08:14:01 PDT)
• Re: ssh scans using username 'test' or 'oracle'? Will Aoki (Thu May 02 2002 - 10:55:09 PDT)
• 'rooted' NT/2K boxen? H C (Thu May 02 2002 - 10:31:04 PDT)
• Windows Systems Defaced Steve Zenone (Thu May 02 2002 - 13:23:03 PDT)
• Re: 'rooted' NT/2K boxen? H C (Thu May 02 2002 - 13:26:18 PDT)
• Re: 'rooted' NT/2K boxen? zeno (Thu May 02 2002 - 13:06:30 PDT)
• Re: 'rooted' NT/2K boxen? William N. Zanatta (Thu May 02 2002 - 13:57:23 PDT)
• Re: ssh scans using username 'test' or 'oracle'? Matt Zimmerman (Thu May 02 2002 - 13:39:54 PDT)
• Re: 'rooted' NT/2K boxen? Cody Hatch (Thu May 02 2002 - 14:46:41 PDT)
• Re: 'rooted' NT/2K boxen? H C (Thu May 02 2002 - 15:42:39 PDT)
• Re: 'rooted' NT/2K boxen? Cody Hatch (Thu May 02 2002 - 19:30:16 PDT)
• Re: Windows Systems Defaced Stephen W. Thompson (Thu May 02 2002 - 20:00:01 PDT)
• RE: Windows Systems Defaced Steve Zenone (Thu May 02 2002 - 20:23:56 PDT)
• RE: Windows Systems Defaced David Ashwood (Fri May 03 2002 - 04:42:36 PDT)
• RE: Windows Systems Defaced H C (Fri May 03 2002 - 05:28:29 PDT)
• Re: 'rooted' NT/2K boxen? H C (Fri May 03 2002 - 06:54:15 PDT)
• RE: Windows Systems Defaced Brenna Primrose (Fri May 03 2002 - 10:17:47 PDT)
• RE: Windows Systems Defaced Johannes B. Ullrich (Fri May 03 2002 - 11:43:56 PDT)
• World-wide distributed DoS and "warez" bot networks (fwd) Dave Dittrich (Fri May 03 2002 - 10:27:08 PDT)
• info Joe T. (Fri May 03 2002 - 15:26:49 PDT)
• RE: info Loki (Fri May 03 2002 - 15:41:17 PDT)
• Unusual Message log contents Gregory Kane (Mon May 06 2002 - 07:33:49 PDT)
• Re: info W.G. Iyer (Fri May 03 2002 - 17:27:17 PDT)
• Re: info Michel Arboi (Sat May 04 2002 - 01:56:56 PDT)
• Re: 'rooted' NT/2K boxen? KJK::Hyperion (Fri May 03 2002 - 17:24:59 PDT)
• Reverse Challenge - Binary released Lance Spitzner (Sun May 05 2002 - 19:05:46 PDT)
• Re: info Joe T. (Fri May 03 2002 - 18:05:19 PDT)
• RE: info Joe T. (Fri May 03 2002 - 15:59:30 PDT)
• Re: info Jose Nazario (Mon May 06 2002 - 11:25:27 PDT)
• RE: info dlaumannat_private (Mon May 06 2002 - 14:12:00 PDT)
• netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (Mon May 06 2002 - 17:40:06 PDT)
• RE: info Head of the Councel of Wizards (Tue May 07 2002 - 07:05:13 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Rainer Duffner (Tue May 07 2002 - 09:12:09 PDT)
• Publishing Nimda Logs Deus, Attonbitus (Tue May 07 2002 - 09:56:28 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com H C (Tue May 07 2002 - 10:25:35 PDT)
• RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (Tue May 07 2002 - 19:50:01 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Nick FitzGerald (Tue May 07 2002 - 18:19:27 PDT)
• Re: Publishing Nimda Logs Hugo van der Kooij (Tue May 07 2002 - 23:01:41 PDT)
• Publishing Nimda Logs - Summary Deus, Attonbitus (Wed May 08 2002 - 07:35:12 PDT)
• Re: Publishing Nimda Logs Glenn Forbes Fleming Larratt (Wed May 08 2002 - 08:01:11 PDT)
• Re: Publishing Nimda Logs Rainer Duffner (Wed May 08 2002 - 01:28:40 PDT)
• Re: Publishing Nimda Logs E (Wed May 08 2002 - 04:50:01 PDT)
• Re: Publishing Nimda Logs John Kristoff (Wed May 08 2002 - 03:45:03 PDT)
• Re: Publishing Nimda Logs jlewisat_private (Tue May 07 2002 - 22:56:58 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Rainer Duffner (Wed May 08 2002 - 01:39:13 PDT)
• AW: Publishing Nimda Logs vogtat_private (Wed May 08 2002 - 01:26:27 PDT)
• RE: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Edwards, David (JTS) (Tue May 07 2002 - 22:55:32 PDT)
• Re: Unusual Message log contents Mark Newby (Wed May 08 2002 - 05:13:40 PDT)
• Re: Publishing Nimda Logs Mally Mclane (Wed May 08 2002 - 08:47:05 PDT)
• RE: Publishing Nimda Logs Steve Zenone (Wed May 08 2002 - 11:48:27 PDT)
• Re: Publishing Nimda Logs Richard.Smithat_private (Wed May 08 2002 - 09:38:49 PDT)
• RE: Publishing Nimda Logs Benjamin Tomhave (Wed May 08 2002 - 09:15:18 PDT)
• Re: Publishing Nimda Logs Thomas Frerichs (Wed May 08 2002 - 10:40:24 PDT)
• Re: Publishing Nimda Logs Mally Mclane (Wed May 08 2002 - 11:48:53 PDT)
• Re: Nimda Infections and code red resurgence Dug Song (Wed May 08 2002 - 14:33:17 PDT)
• Re: Publishing Nimda Logs Justin Shore (Wed May 08 2002 - 11:31:23 PDT)
• RE: Publishing Nimda Logs - Summary Jim Harrison (SPG) (Wed May 08 2002 - 11:39:05 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com Brian McWilliams (Wed May 08 2002 - 19:25:03 PDT)
• Re: netbuie.exe, scorpionsearch.com and fastcounter.bcentral.com - Wrap up Edwards, David (JTS) (Wed May 08 2002 - 20:15:25 PDT)
• Dead Thread - Publishing Nimda Logs Jensenne Roculan (Thu May 09 2002 - 09:01:00 PDT)
• Strange "shotgun" scan Ken Hodges (Thu May 09 2002 - 10:30:09 PDT)
• RE: Strange "shotgun" scan McCammon, Keith (Thu May 09 2002 - 11:21:19 PDT)
• RE: Strange "shotgun" scan Larry Thompson (Thu May 09 2002 - 14:40:05 PDT)
• Strange TCP headers pbsarnacat_private (Fri May 10 2002 - 08:40:19 PDT)
• Re: Strange TCP headers Matt Zimmerman (Fri May 10 2002 - 09:17:38 PDT)
• RE: Strange TCP headers Robert Buckley (Fri May 10 2002 - 09:00:32 PDT)
• RE: Strange TCP headers pbsarnacat_private (Fri May 10 2002 - 09:38:14 PDT)
• RE: Strange TCP headers Robert Buckley (Fri May 10 2002 - 10:40:04 PDT)
• RE: Strange TCP headers Dano (Fri May 10 2002 - 23:35:12 PDT)
• Re: Strange TCP headers Michel Arboi (Sat May 11 2002 - 00:32:54 PDT)
• RE: Strange TCP headers Benjamin Tomhave (Sat May 11 2002 - 10:30:13 PDT)
• Windows Systems Defaced/destroyed, plus Port 3389 attacks Bukys, Liudvikas (Mon May 13 2002 - 09:00:25 PDT)
• Re: [unisog] Windows Systems Defaced/destroyed, plus Port 3389 attacks Chris Wilson (Mon May 13 2002 - 13:33:36 PDT)
• gw.ocg-corp.com netscienceat_private (Mon May 13 2002 - 14:43:28 PDT)
• Re: gw.ocg-corp.com Chip McClure (Mon May 13 2002 - 14:56:00 PDT)
• Re: gw.ocg-corp.com Jordan K Wiens (Mon May 13 2002 - 14:54:58 PDT)
• Re: gw.ocg-corp.com Christian Vogel (Mon May 13 2002 - 15:18:52 PDT)
• Re: gw.ocg-corp.com Will Aoki (Mon May 13 2002 - 15:19:45 PDT)
• Re: Got 'em. (was "Re: gw.ocg-corp.com") Chip McClure (Mon May 13 2002 - 15:53:39 PDT)
• Re: Got 'em. (was "Re: gw.ocg-corp.com") Hugo van der Kooij (Mon May 13 2002 - 15:57:47 PDT)
• Nimda type attacks with broken GETs Stephen Samuel (Mon May 13 2002 - 22:38:02 PDT)
• Re: Windows Systems Defaced Alphonse MacDonald (Tue May 14 2002 - 13:44:18 PDT)
• explanation of port 1433 scans... Benjamin Tomhave (Thu May 16 2002 - 09:04:07 PDT)
• Re: explanation of port 1433 scans... Matt.Carpenterat_private (Thu May 16 2002 - 11:17:36 PDT)
• RE: Windows Systems Defaced/destroyed, plus Port 3389 attacks Skinner, Kit (Fri May 17 2002 - 13:14:04 PDT)
• RE: Windows Systems Defaced/destroyed, plus Port 3389 attacks Deus, Attonbitus (Fri May 17 2002 - 14:31:25 PDT)
• exploited win2k box, not quite sure how: John Jasen (Fri May 17 2002 - 18:05:29 PDT)
• Re: exploited win2k box, not quite sure how: Mike Lewinski (Mon May 20 2002 - 12:13:32 PDT)
• RE: exploited win2k box, not quite sure how: McCammon, Keith (Mon May 20 2002 - 11:39:24 PDT)
• RE: exploited win2k box, not quite sure how: Ron Yount (Mon May 20 2002 - 11:44:54 PDT)
• RE: exploited win2k box, not quite sure how: Butler, Brandon (Mon May 20 2002 - 11:36:52 PDT)
• Re: exploited win2k box, not quite sure how: John Jasen (Mon May 20 2002 - 13:44:00 PDT)
• Re: exploited win2k box, not quite sure how: Scott Fendley (Mon May 20 2002 - 11:47:50 PDT)
• FW: exploited win2k box, not quite sure how: Blake Frantz (Mon May 20 2002 - 12:24:29 PDT)
• Re: exploited win2k box, not quite sure how: rulerpen (Mon May 20 2002 - 11:58:35 PDT)
• Strange scan on 1433 Pavel Lozhkin (Tue May 21 2002 - 06:38:03 PDT)
• Increased connects to Port 1433 Darrin Powell (Tue May 21 2002 - 07:33:07 PDT)
• RE: Increased connects to Port 1433 Lee_Fisherat_private (Tue May 21 2002 - 08:25:37 PDT)
• RE: Strange scan on 1433 Quarantine (Tue May 21 2002 - 08:22:42 PDT)
• Re: Increased connects to Port 1433 Tracey Losco (Tue May 21 2002 - 08:30:48 PDT)
• RE: Increased connects to Port 1433 Pour, Matthew (Tue May 21 2002 - 08:21:26 PDT)
• Re: Strange scan on 1433 dr john halewood (Tue May 21 2002 - 08:30:01 PDT)
• RE: Increased connects to Port 1433 Tom Pope (Tue May 21 2002 - 08:42:05 PDT)
• RE: Strange scan on 1433 Dias Sgt Kristin F (Tue May 21 2002 - 08:23:03 PDT)
• RE: Increased connects to Port 1433 Keith T. Morgan (Tue May 21 2002 - 08:30:09 PDT)
• RE: Strange scan on 1433 David LaPorte (Tue May 21 2002 - 08:23:13 PDT)
• RE: Strange scan on 1433 Ken Pfeil (Tue May 21 2002 - 08:19:00 PDT)
• RE: Strange scan on 1433 Deus, Attonbitus (Tue May 21 2002 - 10:01:48 PDT)
• RE: Strange scan on 1433 James (Tue May 21 2002 - 12:06:51 PDT)
• Re: Strange scan on 1433 Jason Robertson (Tue May 21 2002 - 09:25:04 PDT)
• RE: Strange scan on 1433 Blake Frantz (Tue May 21 2002 - 09:46:49 PDT)
• Re: Strange scan on 1433 Johannes Ullrich (Tue May 21 2002 - 12:26:37 PDT)
• Re: Increased connects to Port 1433 Travis Pugh (Tue May 21 2002 - 11:09:58 PDT)
• Re: Strange scan on 1433 George Bakos (Tue May 21 2002 - 14:45:29 PDT)
• Worms and CScript/WScript Blake Frantz (Tue May 21 2002 - 14:44:34 PDT)
• Re: Worms and CScript/WScript Ryan Russell (Tue May 21 2002 - 15:07:20 PDT)
• RE: Worms and CScript/WScript verbalat_private (Tue May 21 2002 - 15:17:37 PDT)
• RE: Worms and CScript/WScript Michael Wright (Tue May 21 2002 - 16:25:47 PDT)
• RE: Worms and CScript/WScript Nick FitzGerald (Tue May 21 2002 - 22:04:30 PDT)
• 1999-2000 oops wirepair (Thu May 23 2002 - 03:52:30 PDT)
• Interesting scan to ports 1999-2000 wirepair (Thu May 23 2002 - 03:46:33 PDT)
• Decrease in 1433 Scans? Matt Barton (Thu May 23 2002 - 09:38:13 PDT)
• Re: Decrease in 1433 Scans? loon (Thu May 23 2002 - 09:59:40 PDT)
• Re: Decrease in 1433 Scans? MIS Department (Thu May 23 2002 - 10:22:24 PDT)
• RE: Decrease in 1433 Scans? Salisko, Rick (Thu May 23 2002 - 10:26:04 PDT)
• RE: Decrease in 1433 Scans? John Campbell (Thu May 23 2002 - 10:30:38 PDT)
• odd scans? Scott, Michael R. (Fri May 24 2002 - 10:16:20 PDT)
• Re: odd scans? Kyle R. Hofmann (Fri May 24 2002 - 11:21:24 PDT)
• Re: odd scans? Matt Zimmerman (Fri May 24 2002 - 12:13:02 PDT)
• continues SCAN Proxy attempt Hugo van der Kooij (Fri May 24 2002 - 13:18:12 PDT)
• Re: odd scans? Bamm (Robert) Visscher (Fri May 24 2002 - 13:34:47 PDT)
• Re: continues SCAN Proxy attempt Christian Vogel (Fri May 24 2002 - 13:47:02 PDT)
• strange .ch scan by 195.141.86.145 Andreas Wiesmann (Sat May 25 2002 - 07:36:29 PDT)
• Re: Strange scans Allen Smith (Sat May 25 2002 - 20:03:43 PDT)
• RE: Worms and CScript/WScript Richard H. Cotterell (Sun May 26 2002 - 07:57:20 PDT)
• GET /proxy-test.php Joe Blatz (Sun May 26 2002 - 10:14:12 PDT)
• RE: odd scans? Smith, Donald  (Sun May 26 2002 - 08:23:51 PDT)
• Re: continues SCAN Proxy attempt Russell Fulton (Sun May 26 2002 - 17:32:12 PDT)
• RE: Strange scans Bill Royds (Sun May 26 2002 - 19:25:06 PDT)
• RE: Worms and CScript/WScript Nick FitzGerald (Sun May 26 2002 - 20:07:00 PDT)
• RE: strange .ch scan by 195.141.86.145 List-Collector (Mon May 27 2002 - 04:42:07 PDT)
• AW: strange .ch scan by 195.141.86.145 Pascal C. Kocher (Tue May 28 2002 - 00:03:32 PDT)
• Re: GET /proxy-test.php Keyser Soze (Tue May 28 2002 - 08:06:59 PDT)
• RE: Worms and CScript/WScript Richard H. Cotterell (Mon May 27 2002 - 18:38:47 PDT)
• strange account in Win2k Mark Fagan (Tue May 28 2002 - 08:29:37 PDT)
• SQLSnake email account shutdown? Javier Sanchez (Information Systems) (Tue May 28 2002 - 08:34:32 PDT)
• RE: Worms and CScript/WScript Dubber, Drew B (Tue May 28 2002 - 09:13:23 PDT)
• Security contacts for cnn,time.com,usatoday,and boston globe needed zeno (Tue May 28 2002 - 09:15:19 PDT)
• RE: strange account in Win2k AJ Decker (Tue May 28 2002 - 10:56:31 PDT)
• RE: strange account in Win2k Rick Darsey (Tue May 28 2002 - 10:34:24 PDT)
• Re: strange account in Win2k Dan Cuthbert (Tue May 28 2002 - 09:59:25 PDT)
• RE: strange account in Win2k Admiraal, J.E. (CDIV) (Tue May 28 2002 - 10:02:41 PDT)
• Re: strange account in Win2k Maxime Ducharme (Tue May 28 2002 - 13:01:15 PDT)
• Compromised Win2000 machine. Daniel Hay (Tue May 28 2002 - 13:15:25 PDT)
• Re: strange account in Win2k Kevin (Tue May 28 2002 - 14:20:13 PDT)
• Re: Compromised Win2000 machine. H C (Tue May 28 2002 - 14:35:00 PDT)
• RE: Security contacts for cnn,time.com,usatoday,and boston globe needed McCammon, Keith (Tue May 28 2002 - 10:44:21 PDT)
• RE: Compromised Win2000 machine. Kit (Tue May 28 2002 - 14:48:27 PDT)
• Re: Security contacts for cnn,time.com,usatoday,and boston globe needed batz (Tue May 28 2002 - 14:56:54 PDT)
• RE: strange account in Win2k Kit (Tue May 28 2002 - 15:08:16 PDT)
• RE: strange account in Win2k dlaumannat_private (Tue May 28 2002 - 15:36:52 PDT)
• New Stacheldraht? Robert Buckley (Wed May 29 2002 - 08:14:48 PDT)
• RE: Compromised Win2000 machine. Don Weber (Tue May 28 2002 - 15:56:46 PDT)
• parsing output from tools H C (Tue May 28 2002 - 18:35:05 PDT)
• Re: Compromised Win2000 machine. ghb the irrepressible (Tue May 28 2002 - 20:42:17 PDT)
• RE: strange account in Win2k Mark Fagan (Wed May 29 2002 - 02:23:25 PDT)
• RE: Compromised Win2000 machine. H C (Wed May 29 2002 - 10:11:17 PDT)
• RE: New Stacheldraht? Liston, Kevin C, SOLCM (Wed May 29 2002 - 12:44:31 PDT)
• Re: Compromised Win2000 machine. Daniel Hay (Wed May 29 2002 - 11:05:55 PDT)
• Re: Compromised Win2000 machine. H C (Wed May 29 2002 - 13:37:47 PDT)
• Re: odd scans? Brett Glass (Wed May 29 2002 - 13:47:56 PDT)
• Re: Compromised Win2000 machine. Mark Newby (Wed May 29 2002 - 13:38:00 PDT)
• Re: Compromised Win2000 machine. Patrick Andry (Wed May 29 2002 - 14:05:26 PDT)
• Re: Compromised Win2000 machine. H C (Wed May 29 2002 - 19:09:32 PDT)
• Re: AW: strange .ch scan by 195.141.86.145 Rainer Duffner (Thu May 30 2002 - 11:02:51 PDT)
• Re: Compromised Win2000 machine. - Follow UP Daniel Hay (Thu May 30 2002 - 14:27:41 PDT)
• Re: Re[2]: Compromised Win2000 machine. H C (Fri May 31 2002 - 07:22:42 PDT)
• Re[2]: Compromised Win2000 machine. Joris De Donder (Fri May 31 2002 - 06:55:17 PDT)
• Application Scanning 1033/tcp? Crist J. Clark (Fri May 31 2002 - 14:46:05 PDT)
• Re: Application Scanning 1033/tcp? Ned Lowe (Fri May 31 2002 - 15:54:37 PDT)
• Re: Application Scanning 1033/tcp? Muhammad Faisal Rauf Danka (Fri May 31 2002 - 15:16:04 PDT)

Last message date: Fri May 31 2002 - 16:04:47 PDT
Archived on: Fri May 31 2002 - 16:04:49 PDT

This archive was generated by hypermail 2b30 : Fri May 31 2002 - 16:04:49 PDT