.cinik.c with VERSION 27092002 #define BROADCASTS 2 #define LINKS 256 #define CLIENTS 256 #define PORT 1812 #define SCANPORT 80 #define SCANTIMEOUT 15 #define MAXPATH 4096 #define ESCANPORT 1813 #define VERSION 27092002 Anyone can change the PORT to any number, upgrade your OpenSSL as soon as possible! ----- Original Message ----- From: "Marcelo Bartsch" <mbartschat_private> To: "fingers" <fingersat_private> Cc: <incidentsat_private> Sent: Wednesday, October 02, 2002 3:35 AM Subject: Re: slapper changed to udp 1812? > On Tue, 2002-10-01 at 11:43, fingers wrote: > i also see this behavior on a customer compromised machine. 1812 udp > trafic. i had to filter that on a border router :( > > > . > > > hi > > > > I might be totally off the mark here, but has slapper now changed to port > > 1812? > > > > I'm seing huge volumes of traffic, to what seem to be slapper infected > > hosts. > > > > I see 2 infected hosts, with 2343 and 2384 unique source addresses > > speaking to each of them respectively. I'm unable to do actual dumps of > > the data at this stage, so if anyone could either confirm, or tell me I'm > > off my rocker, would appreciate it. > > > > I've checked a few source and destination ip's, and they all seem to be > > *nix, with outdated ssl, for example: > > > > Date: Tue, 01 Oct 2002 21:46:02 GMT > > Server: Apache/1.3.23 (Unix) (Red-Hat/Linux) mod_ssl/2.8.7 OpenSSL/0.9.6b > > DAV/1.0.3 PHP/4.1.2 mod_perl/1.26 > > > > Regards > > > > --Rob > > > > > > -------------------------------------------------------------------------- -- > > This list is provided by the SecurityFocus ARIS analyzer service. > > For more information on this free incident handling, management > > and tracking system please see: http://aris.securityfocus.com > > > -- > Marcelo Bartsch > mbartschat_private > www.netglobalis.net > > PGP Fingerprint : > 877E 3A56 F523 B44A 3260 8F83 8916 E158 6100 F721 > > > -------------------------------------------------------------------------- -- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Oct 01 2002 - 20:26:44 PDT