incidents 2002/12
By Thread

Starting: Sun Dec 01 2002 - 20:07:09 PST
Ending: Fri Jan 31 2003 - 12:02:34 PST

• RE: Bad protocol version identification '^V^C^A' Bojan Zdrnja (Sun Dec 01 2002 - 01:15:49 PST)
  • Re: Bad protocol version identification '^V^C^A' Matt Harris (Mon Dec 02 2002 - 06:51:34 PST)
• Re: Bad protocol version identification '^V^C^A' D.C. van Moolenbroek (Sun Dec 01 2002 - 12:03:25 PST)
• [Full-Disclosure] [VU#317417] Denial of Service condition in vxworks ftpd/3com nbx Michael S. Scheidell (Mon Dec 02 2002 - 10:04:31 PST)
• RE: New scanner? Rob Shein (Sun Dec 01 2002 - 21:09:42 PST)
• Re: TCP:80, TCP:1433 squelda 1.0 probe Joe Stewart (Mon Dec 02 2002 - 05:53:24 PST)
  • Re: TCP:80, TCP:1433 squelda 1.0 probe John Sage (Mon Dec 02 2002 - 16:29:30 PST)
• [Fwd: XSS on ICQ leading to password compromise] Rafael Coninck Teigao (Mon Dec 02 2002 - 08:29:37 PST)
• Incident tracking database Danny (Tue Dec 03 2002 - 08:05:51 PST)
  • Re: Incident tracking database Chip Mefford (Wed Dec 04 2002 - 04:41:34 PST)
    • what else you can do with worm networks...fun, profit, etc Anton A. Chuvakin (Mon Dec 09 2002 - 10:27:24 PST)
  • Re: Incident tracking database Steven Hong (Wed Dec 04 2002 - 06:03:28 PST)
  • Re: Incident tracking database james (Tue Dec 03 2002 - 23:55:15 PST)
  • Re: Incident tracking database Holger Kipp (Wed Dec 04 2002 - 00:13:37 PST)
    • Re: Incident tracking database Russell Fulton (Wed Dec 04 2002 - 18:15:41 PST)
      • Re: Incident tracking database Chris Adams (Thu Dec 05 2002 - 22:24:25 PST)
  • Re: Incident tracking database Paul Gillingwater (Wed Dec 04 2002 - 00:33:42 PST)
• recent rds vuln Study List (Wed Dec 04 2002 - 07:42:59 PST)
• A small quandary Mahoney, Paul (Wed Dec 04 2002 - 20:30:08 PST)
  • RE: A small quandary Jerry Shenk (Fri Dec 06 2002 - 05:35:36 PST)
  • RE: A small quandary Rob Shein (Fri Dec 06 2002 - 07:57:06 PST)
  • Re: A small quandary H C (Fri Dec 06 2002 - 05:49:11 PST)
    • RE: A small quandary Bojan Zdrnja (Mon Dec 09 2002 - 03:02:48 PST)
  • Re: A small quandary Mike Katz (Fri Dec 06 2002 - 10:41:35 PST)
  • Re: A small quandary gminick (Sat Dec 07 2002 - 10:27:40 PST)
  • Odd entries in my Security Router logs Julian Young (Mon Dec 09 2002 - 01:37:47 PST)
    • RE: Odd entries in my Security Router logs Jim Terry (Tue Dec 10 2002 - 02:22:37 PST)
      • RE: Odd entries in my Security Router logs Julian Young (Tue Dec 10 2002 - 03:28:45 PST)
    • RE: Odd entries in my Security Router logs Andrews, Jonathan (US - Hermitage) (Tue Dec 10 2002 - 09:17:54 PST)
      • RE: Odd entries in my Security Router logs Julian Young (Wed Dec 11 2002 - 00:53:54 PST)
      • Re: Odd entries in my Security Router logs Michael Sierchio (Wed Dec 11 2002 - 10:08:49 PST)
      • RE: Odd entries in my Security Router logs David Gillett (Wed Dec 11 2002 - 12:59:12 PST)
      • Re: Odd entries in my Security Router logs Valdis.Kletnieksat_private (Thu Dec 12 2002 - 09:09:38 PST)
      • Re: Odd entries in my Security Router logs Valdis.Kletnieksat_private (Thu Dec 12 2002 - 10:01:33 PST)
      • Re: Odd entries in my Security Router logs James C. Slora Jr. (Wed Dec 11 2002 - 10:44:47 PST)
      • Re: Odd entries in my Security Router logs HggdH (Wed Dec 11 2002 - 14:11:55 PST)
• Black Ice small segment size FTP attack caused by FX-scanner Curt Wilson (Thu Dec 05 2002 - 15:02:15 PST)
• netbios vuln ohnononoat_private (Fri Dec 06 2002 - 06:50:02 PST)
  • Re: netbios vuln KoRe MeLtDoWn (Sun Dec 08 2002 - 20:25:03 PST)
  • Re: netbios vuln H C (Mon Dec 09 2002 - 06:12:47 PST)
  • Re: netbios vuln Valdis.Kletnieksat_private (Sun Dec 08 2002 - 22:58:48 PST)
  • Re: netbios vuln Nick FitzGerald (Mon Dec 09 2002 - 01:36:51 PST)
• high activity on port 3061 udp/tcp Marcelo Bartsch (Fri Dec 06 2002 - 13:25:49 PST)
• Does W2k issue an NBNS query automatically following each unsuccessful reverse DNS query? Jack Arenberg (Sat Dec 07 2002 - 08:51:10 PST)
• Spam via proxy listuser (Sat Dec 07 2002 - 09:52:37 PST)
  • Re: Spam via proxy Christopher X. Candreva (Sun Dec 08 2002 - 19:50:04 PST)
  • Re: Spam via proxy Jefferson Ogata (Mon Dec 09 2002 - 08:04:34 PST)
  • Re: Spam via proxy Volker Tanger (Mon Dec 09 2002 - 02:10:46 PST)
  • Re: Spam via proxy jlewisat_private (Sun Dec 08 2002 - 20:22:25 PST)
  • Re: Spam via proxy Joe Stewart (Mon Dec 09 2002 - 05:31:59 PST)
• EBay Fraud Attempt Logan F.D. Greenlee (Sat Dec 07 2002 - 07:25:29 PST)
  • Re: EBay Fraud Attempt Stephen Friedl (Sun Dec 08 2002 - 20:15:40 PST)
    • Re: EBay Fraud Attempt Stephen J. Friedl (Tue Dec 10 2002 - 09:18:43 PST)
  • Re: EBay Fraud Attempt jlewisat_private (Sun Dec 08 2002 - 20:45:22 PST)
    • Re: EBay Fraud Attempt Chris A. Mattingly (Mon Dec 09 2002 - 22:01:52 PST)
    • Re: EBay Fraud Attempt Kee Hinckley (Mon Dec 09 2002 - 22:17:28 PST)
  • Re: EBay Fraud Attempt Waitman C. Gobble, II (Sun Dec 08 2002 - 22:34:21 PST)
  • RE: EBay Fraud Attempt george.wasgattat_private (Tue Dec 10 2002 - 05:40:15 PST)
  • RE: EBay Fraud Attempt OBrien, Brennan (Tue Dec 10 2002 - 07:43:13 PST)
  • RE: EBay Fraud Attempt Chris Gordon (Wed Dec 11 2002 - 09:46:03 PST)
• Fwd: EBay Fraud Attempt Dave Laird (Mon Dec 09 2002 - 00:30:17 PST)
  • RE: EBay Fraud Attempt Carlo Costanzo (Mon Dec 09 2002 - 22:13:33 PST)
    • Re: EBay Fraud Attempt Dave Laird (Mon Dec 09 2002 - 23:58:05 PST)
    • Re: EBay Fraud Attempt Mark (Wed Dec 11 2002 - 10:19:47 PST)
• strange attractors or weaknesses in Nimda's prng Russell Fulton (Wed Dec 11 2002 - 01:46:34 PST)
• DNS help larosa, vjay (Wed Dec 11 2002 - 13:09:49 PST)
  • RE: DNS help larosa, vjay (Thu Dec 12 2002 - 11:54:29 PST)
    • Re: DNS help Valdis.Kletnieksat_private (Thu Dec 12 2002 - 12:05:03 PST)
    • Re: DNS help Matt Zimmerman (Sun Dec 15 2002 - 14:47:52 PST)
  • RE: DNS help Tom Arseneault (Thu Dec 12 2002 - 13:24:40 PST)
  • RE: DNS help Faron.Goldenat_private (Thu Dec 12 2002 - 13:58:41 PST)
  • Re: DNS help Valdis.Kletnieksat_private (Thu Dec 12 2002 - 09:17:35 PST)
• Rooted, .haos on system Damian Gerow (Thu Dec 12 2002 - 15:50:22 PST)
  • Re: Rooted, .haos on system Julian Young (Tue Dec 17 2002 - 00:14:00 PST)
  • Re: Rooted, .haos on system Mattias Hedenskog (Mon Dec 16 2002 - 12:51:17 PST)
    • Re: Rooted, .haos on system zeno (Mon Dec 16 2002 - 13:27:10 PST)
  • Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 09:38:33 PST)
    • Re[2]: Rooted, .haos on system Oliver.C.Rochford CFH (Tue Dec 17 2002 - 00:36:28 PST)
    • Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 10:47:28 PST)
      • Re: Rooted, .haos on system Mike Katz (Mon Dec 16 2002 - 11:31:23 PST)
      • Re: Rooted, .haos on system zeno (Mon Dec 16 2002 - 12:54:02 PST)
      • Re: Rooted, .haos on system Carlos Eduardo Pedroza Santiviago (Mon Dec 16 2002 - 12:31:03 PST)
      • Re: Rooted, .haos on system Damian Gerow (Mon Dec 16 2002 - 13:36:46 PST)
      • New CIFS (port 445) worm? David Gillett (Tue Dec 17 2002 - 08:30:13 PST)
      • Re: New CIFS (port 445) worm? Zen (Tue Dec 17 2002 - 10:03:38 PST)
• Logs: Many hits with source port of 80 Byrne Ghavalas (Fri Dec 13 2002 - 02:05:56 PST)
  • Re: Logs: Many hits with source port of 80 Joe Stewart (Mon Dec 16 2002 - 07:27:32 PST)
  • Re: Logs: Many hits with source port of 80 Valdis.Kletnieksat_private (Mon Dec 16 2002 - 08:01:45 PST)
  • Re: Logs: Many hits with source port of 80 Russell Fulton (Sun Dec 15 2002 - 18:13:53 PST)
  • Re: Many hits with source port of 80 Maxime Ducharme (Mon Dec 16 2002 - 09:01:57 PST)
  • RE: Logs: Many hits with source port of 80 James C Slora Jr (Mon Dec 16 2002 - 05:37:20 PST)
    • Re: Logs: Many hits with source port of 80 Byrne Ghavalas (Mon Dec 16 2002 - 06:21:14 PST)
      • Re: Logs: Many hits with source port of 80 Kevin Bowman (Mon Dec 16 2002 - 10:54:03 PST)
      • RE: Logs: Many hits with source port of 80 James C Slora Jr (Mon Dec 16 2002 - 12:29:52 PST)
• Terminal Services / TsInternetUser [RMC-RUFLVP4] Romulo M. Cholewa (Sat Dec 14 2002 - 14:37:03 PST)
• abuse of open transparent proxies horapeat_private (Tue Dec 17 2002 - 18:58:29 PST)
• IRC -> smtp worm? Joao Gouveia (Tue Dec 17 2002 - 18:37:08 PST)
  • Re: IRC -> smtp worm? H C (Wed Dec 18 2002 - 08:00:37 PST)
  • Re: IRC -> smtp worm? Ţórhallur Hálfdánarson (Wed Dec 18 2002 - 08:45:51 PST)
  • Re: IRC -> smtp worm? Eric Chien (Wed Dec 18 2002 - 10:53:31 PST)
• FW: Lioten Worm 135-139 and 445 Pricher Jeffrey Contr AFCA/GCF (Tue Dec 17 2002 - 09:43:33 PST)
• Iraq Oil worm Stephen Friedl (Mon Dec 16 2002 - 16:04:57 PST)
• Worm on 445/tcp? Scott A.McIntyre (Mon Dec 16 2002 - 23:56:02 PST)
  • Re: Worm on 445/tcp? Stephen Friedl (Tue Dec 17 2002 - 17:46:55 PST)
  • Re: Worm on 445/tcp? Stephen J. Friedl (Tue Dec 17 2002 - 12:34:35 PST)
    • Re: Worm on 445/tcp? Ryan Yagatich (Tue Dec 17 2002 - 17:41:58 PST)
  • Re: Worm on 445/tcp? Joe Blatz (Tue Dec 17 2002 - 11:50:10 PST)
    • Re: Worm on 445/tcp? james (Tue Dec 17 2002 - 12:54:45 PST)
  • Re: Worm on 445/tcp? Tom.Gastat_private (Tue Dec 17 2002 - 11:52:55 PST)
  • Re: Worm on 445/tcp? Scott Fendley (Tue Dec 17 2002 - 09:24:42 PST)
  • RE: Worm on 445/tcp? OBrien, Brennan (Tue Dec 17 2002 - 09:31:42 PST)
  • Re: Worm on 445/tcp? Kyle Lai (Thu Dec 19 2002 - 13:06:28 PST)
• fswserv.html ???? James-lists (Mon Dec 16 2002 - 14:49:03 PST)
  • Re: fswserv.html ???? james (Tue Dec 17 2002 - 09:36:38 PST)
  • Re: fswserv.html ???? dev (Mon Dec 16 2002 - 15:40:32 PST)
    • Re: fswserv.html ???? Adam Bultman (Tue Dec 17 2002 - 10:25:05 PST)
      • Re: fswserv.html ???? james (Tue Dec 17 2002 - 11:17:31 PST)
• Win2k Audit Logs - What happened here? Johnny Walker (Sun Dec 15 2002 - 18:50:57 PST)
  • Re: Win2k Audit Logs - What happened here? H C (Mon Dec 16 2002 - 13:41:32 PST)
  • RE: Win2k Audit Logs - What happened here? george.wasgattat_private (Mon Dec 16 2002 - 11:19:17 PST)
• hpd, afb, sc, and sn Gordon Chamberlin (Fri Dec 20 2002 - 13:11:31 PST)
  • RE: hpd, afb, sc, and sn Bojan Zdrnja (Sat Dec 21 2002 - 07:16:27 PST)
  • Re: hpd, afb, sc, and sn deadcalmat_private (Sun Dec 22 2002 - 19:49:33 PST)
  • Re: hpd, afb, sc, and sn gminick (Sat Dec 21 2002 - 02:53:33 PST)
  • Re: hpd, afb, sc, and sn Brad Arlt (Fri Dec 20 2002 - 14:28:48 PST)
  • Re: hpd, afb, sc, and sn Greg Barnes (Fri Dec 20 2002 - 14:19:04 PST)
• port 3717/udp? Jacek Lipkowski (Fri Dec 20 2002 - 10:23:08 PST)
• Compromised System RH7.3-ICMP-STP-DoS Ron Gedye (Fri Dec 20 2002 - 13:38:20 PST)
• RPAT - Realtime Proxy Abuse Triangulation Stephen Friedl (Fri Dec 20 2002 - 08:17:15 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation Kurt Seifried (Tue Dec 24 2002 - 09:58:05 PST)
    • Re: RPAT - Realtime Proxy Abuse Triangulation Mathias Wegner (Tue Dec 24 2002 - 09:21:31 PST)
      • Re: RPAT - Realtime Proxy Abuse Triangulation Gary Flynn (Sat Dec 28 2002 - 06:46:55 PST)
      • RE: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Mon Dec 30 2002 - 09:45:20 PST)
      • Re: RPAT - Realtime Proxy Abuse Triangulation Syzop (Mon Dec 30 2002 - 13:12:59 PST)
      • What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation Gary Flynn (Tue Dec 31 2002 - 05:20:58 PST)
      • RE: What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Tue Dec 31 2002 - 07:45:18 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation Stephen Friedl (Tue Dec 24 2002 - 10:33:19 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation Kevin Reardon (Fri Dec 27 2002 - 10:55:29 PST)
    • RE: RPAT - Realtime Proxy Abuse Triangulation Rob Shein (Fri Dec 27 2002 - 17:00:16 PST)
      • Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 11:25:07 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 11:06:35 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation Greg Barnes (Mon Dec 30 2002 - 12:05:54 PST)
    • Virus? Trojan? David Gillett (Mon Dec 30 2002 - 14:03:18 PST)
      • Re: Virus? Trojan? Peter Kruse (Mon Dec 30 2002 - 15:42:42 PST)
      • Re: Virus? Trojan? Nick FitzGerald (Mon Dec 30 2002 - 18:00:15 PST)
      • Abnormally high Sub-Seven attack rate increase Eric Kimminau (Mon Dec 30 2002 - 21:09:40 PST)
      • Re: Virus? Trojan? Jonathan Rickman (Mon Dec 30 2002 - 17:15:42 PST)
  • Re: RPAT - Realtime Proxy Abuse Triangulation tcleary2at_private (Mon Dec 30 2002 - 17:59:17 PST)
• strange traffic securitynoticeat_private (Sun Dec 22 2002 - 20:30:31 PST)
  • RE: strange traffic Rob Shein (Tue Dec 24 2002 - 12:07:16 PST)
• TsInternetUser priv. escalation; blank passwords; service passwords Curt Wilson (Mon Dec 23 2002 - 00:05:32 PST)
• Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Mon Dec 23 2002 - 21:33:59 PST)
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Charles.Faschingat_private (Thu Dec 26 2002 - 14:47:37 PST)
    • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 00:44:19 PST)
    • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second H C (Fri Dec 27 2002 - 11:35:16 PST)
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 00:36:29 PST)
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Pavel Kankovsky (Thu Dec 26 2002 - 07:50:51 PST)
    • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 00:52:26 PST)
  • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Fyodor (Tue Dec 24 2002 - 11:18:16 PST)
    • Re: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second alfaentomega (Fri Dec 27 2002 - 00:27:47 PST)
  • RE: Random unprivileged TCP ports below 5000 kind-of open for a fraction of a second Hornat, Charles (Fri Dec 27 2002 - 08:57:50 PST)
• NIMDA - ceased ? - Tomo (Wed Dec 25 2002 - 09:00:00 PST)
  • Re: NIMDA - ceased ? - Neil Dickey (Fri Dec 27 2002 - 09:25:35 PST)
    • Re: NIMDA - ceased ? - James C. Slora Jr. (Fri Dec 27 2002 - 10:36:51 PST)
  • Re: NIMDA - ceased ? - Skip Carter (Fri Dec 27 2002 - 09:58:02 PST)
  • Re: NIMDA - ceased ? - Johannes Ullrich (Fri Dec 27 2002 - 09:12:12 PST)
  • Re: NIMDA - ceased ? - Roger Thompson (Fri Dec 27 2002 - 15:47:47 PST)
• PDL anti-spam blacklist John Paul (Tue Dec 31 2002 - 11:08:02 PST)
• MS IIS 5 server is hacked leaving undeletable folders and files Don Phillipe (Tue Dec 31 2002 - 09:05:27 PST)
• Re: Packets from 255.255.255.255(80) (was: Packet from port 80 with spoofed microsoft.com ip) Chris (Fri Dec 20 2002 - 12:53:16 PST)

Last message date: Fri Jan 31 2003 - 12:02:34 PST
Archived on: Fri Jan 31 2003 - 12:02:35 PST

This archive was generated by hypermail 2b30 : Fri Jan 31 2003 - 12:02:35 PST