RE: Abnormally high Sub-Seven attack rate increase

From: James C Slora Jr (Jim.Sloraat_private)
Date: Thu Jan 02 2003 - 10:38:32 PST

  • Next message: Christopher X. Candreva: "RE: What constitutes authorized server access? - was Re: RPAT - Realtime Proxy Abuse Triangulation"

    Eric Kimminau wrote Tuesday, December 31, 2002 12:10 AM
    
    > Is it just me or has the number of Sub-Seven probes grown
    > astronomically in the last 7 days? I am seeing on average 25-30
    > clients per day, each scanning 3 or 4 times each up from only 1 or 2
    > per day at most for the last several months.
    
    DShield does not show an overall increase, but a fair number of people have
    experienced a huge growth in probes over the past few days. I've gotten
    several off-list correlations of individual sub7 scan increases from my post
    on the incidents.org intrusions list.
    
    It seems to be a network-specific phenomenon.
    
    See the "27374 SubSeven Explosion" thread
    http://cert.uni-stuttgart.de/archive/intrusions/2002/12/msg00256.html
    
    - Jim
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Jan 02 2003 - 18:49:15 PST