On Sat, 2002-10-26 at 05:47, opus wrote: > Beginning on October 10th at 1:42am CDT what was considered a pretty > significant attack took place. These attack attempts were all web based. > What is curious about these attacks is the number of unique strings used > in the attacks. In all there were 149 unique Snort rules triggered, from > 5 attacks in 14 days. I see these from time to time, looks like someone using nessus of whisker... I am also seeing more clusters of similar attacks from various DSL and Cable networks. It is likely that these are the work of the same group, probably using compromised machines. -- Russell Fulton, Computer and Network Security Officer The University of Auckland, New Zealand "It aint necessarily so" - Gershwin ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon Oct 28 2002 - 19:04:21 PST