Trojan attacking our switches

From: Charles Polisher (cpolishat_private)
Date: Thu Mar 20 2003 - 17:50:34 PST

  • Next message: dreamwvrat_private: "Re: Trojan attacking our switches"

    Search of CVE and securityfocus and googling
    did not turn up adequate information. Anyone 
    seen this beast? 
    
    Our campus network has a couple of thousand hosts, 
    and 93 switches. 
    
    Telnetting into our HP Procurve 2524 switch 
    shows an ongoing attempt to brute-force the 
    SNMP community (public, of course). HP apparently
    does not provide a method for disbling SNMP, and
    we're going to have to visit all 93 switches
    in person to set a strong password -- yes, it had
    been left blank!
    
    PCdoorguard 3 virus scanner identified a
    virus, "f*ck door server", but provides little
    useful information other than pointing to 
    \windows\system\setdefed.exe which is 24,576 bytes.
    
    Thanks,
    Charles Polisher
    
    ----------------------------------------------------------------------------
    
    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>
    



    This archive was generated by hypermail 2b30 : Fri Mar 21 2003 - 08:59:19 PST