Re: Strange back-orifice looking scan...

From: Neil Dickey (neilat_private)
Date: Thu Sep 05 2002 - 10:59:36 PDT

Next message: Etaoin Shrdlu: "Odd sendmail behavior"

Previous message: sunzi: "Re: new type of formmail probes"
Maybe in reply to: Jeff Kell: "Strange back-orifice looking scan..."
Next in thread: Scott Nursten: "Re: Strange back-orifice looking scan..."
Reply: Scott Nursten: "Re: Strange back-orifice looking scan..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Jeff Kell <jeff-kellat_private> wrote in part:

>> Port 1214 used by Kazaa aka Morpheus, this is obviously the remote port that
>> the "scanner" is using. Port 31336 IS used by Back Orifice 2000 aka BO2k aka
>> DeepBO (this is a special release of BO btw).
>
>But this is UDP, not TCP.

My source ( IANA ) shows this for Kazaa:

kazaa           1214/tcp   KAZAA
kazaa           1214/udp   KAZAA

Best regards,

Neil Dickey, Ph.D.
Research Associate/Sysop
Geology Department
Northern Illinois University
DeKalb, Illinois
60115

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Etaoin Shrdlu: "Odd sendmail behavior"
Previous message: sunzi: "Re: new type of formmail probes"
Maybe in reply to: Jeff Kell: "Strange back-orifice looking scan..."
Next in thread: Scott Nursten: "Re: Strange back-orifice looking scan..."
Reply: Scott Nursten: "Re: Strange back-orifice looking scan..."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Sep 05 2002 - 11:10:32 PDT