incidents 2003/04
By Thread

Starting: Mon Mar 31 2003 - 16:19:07 PST
Ending: Wed Apr 30 2003 - 14:37:36 PDT

• Why alerts on ports 1025-1029, 1036 Tomas Carlsson (Mon Mar 31 2003 - 14:04:23 PST)
  • RE: Why alerts on ports 1025-1029, 1036 Stuart Wallace (Tue Apr 01 2003 - 00:14:12 PST)
  • RE: Why alerts on ports 1025-1029, 1036 Leo, Joel (Tue Apr 01 2003 - 16:54:23 PST)
• Re: POP3 logon attempts Bojan Zdrnja (Mon Mar 31 2003 - 16:14:13 PST)
  • Re: POP3 logon attempts Torsten Mueller (Mon Mar 31 2003 - 14:16:52 PST)
  • Re: POP3 logon attempts Tom Fischer (Tue Apr 01 2003 - 00:49:34 PST)
  • Re: POP3 logon attempts dreamwvrat_private (Tue Apr 01 2003 - 07:33:56 PST)
  • Re: POP3 logon attempts Mike (Tue Apr 01 2003 - 19:40:07 PST)
  • Re: POP3 logon attempts Steve Cody (Tue Apr 22 2003 - 14:44:06 PDT)
• New Article: U.S. Information Security Law, Part 2 Dan Hanson (Tue Apr 01 2003 - 10:25:24 PST)
• Educational Incident Data Comparison Pilot (X-Post) Alfred Huger (Tue Apr 01 2003 - 15:50:44 PST)
• Re: SQL Slammer Variant? crucible (Tue Apr 01 2003 - 04:53:20 PST)
• RE: WebDAV Exploit Lab Jeremy Junginger (Tue Apr 01 2003 - 07:28:01 PST)
• RE: SQL Slammer Variant? Wilson, Aaron J. (Tue Apr 01 2003 - 13:17:06 PST)
  • RE: SQL Slammer Variant? Rob Shein (Wed Apr 02 2003 - 07:24:13 PST)
• RE: Logon/Logoff Failure Events Robert Wagner (Tue Apr 01 2003 - 07:16:28 PST)
  • RE: Logon/Logoff Failure Events John Ives (Thu Apr 03 2003 - 10:04:15 PST)
  • RE: Logon/Logoff Failure Events Russell Morrison (Thu Apr 03 2003 - 08:17:50 PST)
• Increase in Source to Port 445 Rob Keown (Tue Apr 01 2003 - 18:54:58 PST)
  • RE: Increase in Source to Port 445 James C Slora Jr (Thu Apr 03 2003 - 07:07:01 PST)
  • Re: Increase in Source to Port 445 aladin168 (Thu Apr 03 2003 - 11:45:07 PST)
• UDP traffic to net and broadcast addresses Zen (Wed Apr 02 2003 - 02:12:14 PST)
  • RE: UDP traffic to net and broadcast addresses Joshua Wright (Thu Apr 03 2003 - 11:53:11 PST)
• Logon.dll? Possible root-kit? Nick Jacobsen (Wed Apr 02 2003 - 18:09:47 PST)
  • Re: Logon.dll? Possible root-kit? Nick Jacobsen (Wed Apr 02 2003 - 20:29:21 PST)
  • RE: Logon.dll? Possible root-kit? Amarante, Rodrigo P. (Thu Apr 03 2003 - 07:13:59 PST)
  • RE: Logon.dll? Possible root-kit? Rob Shein (Thu Apr 03 2003 - 07:34:45 PST)
  • Re: Logon.dll? Possible root-kit? Harlan Carvey (Thu Apr 03 2003 - 05:20:10 PST)
  • Re: Logon.dll? Possible root-kit? Nick Jacobsen (Thu Apr 03 2003 - 12:43:05 PST)
    • Re: Logon.dll? Possible root-kit? Harlan Carvey (Thu Apr 03 2003 - 17:14:08 PST)
      • Re: Logon.dll? Possible root-kit? Nick Jacobsen (Thu Apr 03 2003 - 17:23:24 PST)
    • RE: Logon.dll? Possible root-kit? Rob Shein (Fri Apr 04 2003 - 09:02:03 PST)
  • RE: Logon.dll? Possible root-kit? Jason Pagano (Fri Apr 04 2003 - 05:40:32 PST)
• Increase of attempts on port 635 in last couple days Jeff Lane (Wed Apr 02 2003 - 07:45:14 PST)
• possible rootkit, maybe partial? Benjamin Tomhave (Wed Apr 02 2003 - 19:47:05 PST)
  • Re: [CERT] possible rootkit, maybe partial? ePAc (Wed Apr 02 2003 - 20:27:17 PST)
  • Re: possible rootkit, maybe partial? Richard Rager (Wed Apr 02 2003 - 20:29:03 PST)
  • Re: possible rootkit, maybe partial? D.C. van Moolenbroek (Thu Apr 03 2003 - 04:59:03 PST)
  • Re: [0.5OT answer]possible rootkit, maybe partial? nobody (Thu Apr 03 2003 - 04:55:14 PST)
• Field Report: New Worm falconat_private (Thu Apr 03 2003 - 05:01:22 PST)
• UDP scans from AOL NS boxes? Mike Mills (Thu Apr 03 2003 - 09:27:07 PST)
• RECAP: possible rootkit, maybe partial? Benjamin Tomhave (Thu Apr 03 2003 - 13:45:17 PST)
• SMTP probes Rich Puhek (Fri Apr 04 2003 - 11:22:23 PST)
  • Re: SMTP probes Neil Dickey (Fri Apr 04 2003 - 21:09:04 PST)
  • Re: SMTP probes Bojan Zdrnja (Sat Apr 05 2003 - 02:23:22 PST)
  • Re: SMTP probes Christine Kronberg (Mon Apr 07 2003 - 02:28:04 PDT)
• Does anyone recognize the scanner that causes this pattern ? deanat_private (Sun Apr 06 2003 - 12:24:23 PDT)
  • Re: Does anyone recognize the scanner that causes this pattern ? Laurent Luyckx (Sun Apr 06 2003 - 23:58:58 PDT)
  • RE: Does anyone recognize the scanner that causes this pattern ? Jerry Shenk (Mon Apr 07 2003 - 08:34:02 PDT)
  • RE: Does anyone recognize the scanner that causes this pattern ? Justin Coffi (Mon Apr 07 2003 - 01:50:58 PDT)
  • Re: Does anyone recognize the scanner that causes this pattern ? deanat_private (Mon Apr 07 2003 - 13:00:36 PDT)
  • Re: Does anyone recognize the scanner that causes this pattern ? Gene (Sun Apr 06 2003 - 16:00:55 PDT)
• unknown rootkit found in the wild Jerome (Mon Apr 07 2003 - 11:40:07 PDT)
• ATD OpenSSL Mass Exploiter Analysis (another "/sumthin" scan tool) Joe Stewart (Mon Apr 07 2003 - 14:54:54 PDT)
• New SecurityFocus article: Specter: A Commercial Honeypot Solution for Windows Dan Hanson (Wed Apr 09 2003 - 09:37:17 PDT)
• New SecurityFocus article: Steganography Revealed Dan Hanson (Wed Apr 09 2003 - 09:38:50 PDT)
• New trojan? Old trojan with new characteristics? Anyone seen this? Mike Parkin (Wed Apr 09 2003 - 15:51:11 PDT)
  • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Alex Lambert (Thu Apr 10 2003 - 17:55:08 PDT)
    • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? vex86at_private (Mon Apr 14 2003 - 16:57:00 PDT)
      • Re: New trojan? Old trojan with new characteristics? Anyone seenthis? Mike Parkin (Tue Apr 15 2003 - 08:37:48 PDT)
• Port 17300 probes? incidentsat_private (Sun Apr 13 2003 - 23:50:45 PDT)
  • Re: Port 17300 probes? Gerd Feiner (Mon Apr 14 2003 - 09:37:54 PDT)
  • Re: Port 17300 probes? Kevin Patz (Mon Apr 14 2003 - 12:12:02 PDT)
    • Re: Port 17300 probes? Joe Stewart (Tue Apr 15 2003 - 14:18:38 PDT)
  • Re: Port 17300 probes? MARLON BORBA (Mon Apr 14 2003 - 09:38:56 PDT)
  • Re: Port 17300 probes? Joris De Donder (Tue Apr 15 2003 - 11:38:55 PDT)
• Logging of connects to port 6346 kbergenat_private (Mon Apr 14 2003 - 15:58:03 PDT)
  • RE: Logging of connects to port 6346 LordInfidel (Tue Apr 15 2003 - 14:30:38 PDT)
  • Re: Logging of connects to port 6346 Nicolas Couture (Tue Apr 15 2003 - 10:16:38 PDT)
• Port 3366 activity defaillanceat_private (Tue Apr 15 2003 - 08:35:28 PDT)
• Intresting problem concerning libresolv.so.2 Sam Evans (Tue Apr 15 2003 - 12:00:19 PDT)
  • Re: Intresting problem concerning libresolv.so.2 Kevin Reardon (Thu Apr 17 2003 - 17:05:22 PDT)
    • Re: Intresting problem concerning libresolv.so.2 Paul Gear (Sat Apr 19 2003 - 23:00:29 PDT)
  • Re: Intresting problem concerning libresolv.so.2 Paul Gear (Fri Apr 18 2003 - 20:53:21 PDT)
• Port 6666 Scans Thomas Vincent (Wed Apr 16 2003 - 06:51:26 PDT)
• port 5168 Molony, Duncan (Thu Apr 17 2003 - 11:03:42 PDT)
  • re: port 5168 Harlan Carvey (Fri Apr 18 2003 - 03:54:04 PDT)
• Anyone seen this UDP source port 7001 traffic? Faron.Goldenat_private (Thu Apr 17 2003 - 14:53:07 PDT)
  • Re: Anyone seen this UDP source port 7001 traffic? Michael Lau (Sat Apr 26 2003 - 17:34:29 PDT)
    • RE: Anyone seen this UDP source port 7001 traffic? Taz (Mon Apr 28 2003 - 10:14:53 PDT)
    • Re: Anyone seen this UDP source port 7001 traffic? Tina Bird (Mon Apr 28 2003 - 12:30:52 PDT)
    • Re: Anyone seen this UDP source port 7001 traffic? Jose Nazario (Mon Apr 28 2003 - 10:12:44 PDT)
• Company being War Dialed Fred Kreitzberg (Thu Apr 17 2003 - 16:13:03 PDT)
  • Re: Company being War Dialed Brett Glass (Sat Apr 19 2003 - 21:45:26 PDT)
  • Re: Company being War Dialed Kurt Seifried (Sun Apr 20 2003 - 00:02:44 PDT)
  • RE: Company being War Dialed Curt Purdy (Sun Apr 20 2003 - 07:41:57 PDT)
  • Re: Company being War Dialed public list (Sun Apr 20 2003 - 23:06:03 PDT)
  • Re: Company being War Dialed James.Phillipsat_private (Mon Apr 21 2003 - 10:15:40 PDT)
  • RE: Company being War Dialed James.Jacksonat_private (Mon Apr 21 2003 - 12:07:02 PDT)
    • RE: Company being War Dialed nospamat_private (Tue Apr 22 2003 - 09:33:23 PDT)
• Strange, scary, subtle trojan Jeff Kell (Thu Apr 17 2003 - 22:01:15 PDT)
  • RE: Strange, scary, subtle trojan Dowling, Gabrielle (Sun Apr 20 2003 - 11:35:35 PDT)
• port 139 syn-fin scans Skip Carter (Fri Apr 18 2003 - 11:51:32 PDT)
  • Re: port 139 syn-fin scans Scott A. McIntyre (Sun Apr 20 2003 - 02:11:21 PDT)
  • RE: port 139 syn-fin scans Kevin Hodle (Sun Apr 20 2003 - 22:51:33 PDT)
  • Re: port 139 syn-fin scans Muchacki Robert (Sun Apr 20 2003 - 13:02:52 PDT)
  • RE: port 139 syn-fin scans Toby Miller (Sun Apr 20 2003 - 18:08:45 PDT)
• Mo'Logs sfat_private (Sat Apr 19 2003 - 19:50:04 PDT)
• Re: SMTP Scans Hoof Hearted (Sun Apr 20 2003 - 04:07:04 PDT)
  • RE: SMTP Scans Rob Shein (Mon Apr 21 2003 - 15:50:33 PDT)
    • RE: SMTP Scans Mally Mclane (Tue Apr 22 2003 - 07:40:28 PDT)
      • RE: SMTP Scans Jimi Thompson (Wed Apr 23 2003 - 20:15:57 PDT)
      • Re: SMTP Scans Kurt Seifried (Thu Apr 24 2003 - 12:43:20 PDT)
    • RE: SMTP Scans Luc Somers (Tue Apr 22 2003 - 08:42:36 PDT)
    • RE: SMTP Scans paulat_private (Sat Apr 26 2003 - 00:09:35 PDT)
  • Re: SMTP Scans Hoof Hearted (Fri Apr 25 2003 - 17:21:57 PDT)
    • Re: SMTP Scans Chris Boyd (Mon Apr 28 2003 - 10:25:15 PDT)
• msamba Steve Bromwich (Mon Apr 21 2003 - 08:41:27 PDT)
  • Re: msamba Paulo Abrantes (Mon Apr 21 2003 - 11:00:54 PDT)
  • Re: msamba William Salusky (Mon Apr 21 2003 - 22:20:00 PDT)
    • Re: msamba noconflic (Tue Apr 22 2003 - 07:48:34 PDT)
  • Re: msamba Nikola Pepelishev (Tue Apr 22 2003 - 01:12:00 PDT)
  • Re: msamba Steve Bromwich (Tue Apr 22 2003 - 07:08:18 PDT)
    • Re: msamba noconflic (Tue Apr 22 2003 - 08:14:48 PDT)
      • Re: msamba Tobias Klein (Fri Apr 25 2003 - 03:06:02 PDT)
• Tracking proxies on port 1180/1182 Joe Stewart (Mon Apr 21 2003 - 11:54:48 PDT)
  • Re: Tracking proxies on port 1180/1182 George Bakos (Mon Apr 21 2003 - 12:55:45 PDT)
  • Re: Tracking proxies on port 1180/1182 Michael Scheidell (Mon Apr 21 2003 - 12:56:46 PDT)
• protocol watcher Justin Pryzby (Tue Apr 22 2003 - 08:03:06 PDT)
  • Re: protocol watcher Jose Nazario (Wed Apr 23 2003 - 07:22:29 PDT)
• Re: IP Spoofs in the log - not sure what to do next aladin168 (Thu Apr 24 2003 - 07:12:04 PDT)
• Re: Trojan found... aladin168 (Thu Apr 24 2003 - 07:22:50 PDT)
  • Re: Trojan found... Patrick Nolan (Thu Apr 24 2003 - 13:58:18 PDT)
• New attack or old Vulnerability Scanner? Mark Embrich (Thu Apr 24 2003 - 16:43:43 PDT)
  • RE: New attack or old Vulnerability Scanner? James C. Slora, Jr. (Fri Apr 25 2003 - 12:00:56 PDT)
  • Re: New attack or old Vulnerability Scanner? Jason Falciola (Sat Apr 26 2003 - 04:56:17 PDT)
  • RE: New attack or old Vulnerability Scanner? Keith (Fri Apr 25 2003 - 14:40:40 PDT)
  • Re: New attack or old Vulnerability Scanner? rhandwerkerat_private (Mon Apr 28 2003 - 09:45:20 PDT)
  • Re: New attack or old Vulnerability Scanner? jac (Tue Apr 29 2003 - 13:21:49 PDT)
  • Re: New attack or old Vulnerability Scanner? Mark Embrich (Tue Apr 29 2003 - 11:34:03 PDT)
  • Re: New attack or old Vulnerability Scanner? Jason Falciola (Tue Apr 29 2003 - 17:37:19 PDT)
  • Re: New attack or old Vulnerability Scanner? Jason Falciola (Wed Apr 30 2003 - 10:41:05 PDT)
• Scans on TCP port 9631 + other unknown ports Kevin Patz (Fri Apr 25 2003 - 05:10:30 PDT)
• New CodeRed strain? Frank Knobbe (Fri Apr 25 2003 - 11:55:13 PDT)
  • Re: New CodeRed strain? Frank Knobbe (Fri Apr 25 2003 - 12:23:57 PDT)
  • Re: New CodeRed strain? -- UPDATE Frank Knobbe (Mon Apr 28 2003 - 10:13:11 PDT)
    • Re: New CodeRed strain? -- UPDATE Justin Pryzby (Tue Apr 29 2003 - 15:13:53 PDT)
• lots of port 0 scannings SB CH (Sun Apr 27 2003 - 17:51:58 PDT)
  • Re: lots of port 0 scannings Brad Doctor (Mon Apr 28 2003 - 10:19:09 PDT)
  • Re: lots of port 0 scannings Neil Dickey (Mon Apr 28 2003 - 12:28:36 PDT)
• Odd IIS log entries Hahn, Jacob (Mon Apr 28 2003 - 10:27:11 PDT)
  • RE: Odd IIS log entries James C. Slora, Jr. (Wed Apr 30 2003 - 06:28:08 PDT)
• undetected DDOS Chris Cahill (Mon Apr 28 2003 - 12:30:55 PDT)
• UDP packets towards port 38293 (NAV) Alan B. Clegg (Tue Apr 29 2003 - 17:51:54 PDT)
  • Re: UDP packets towards port 38293 (NAV) Nexus (Wed Apr 30 2003 - 14:37:36 PDT)
• RE: New CodeRed strain? -- UPDATE larosa, vjay (Tue Apr 29 2003 - 19:38:03 PDT)
• Logs showing GET /.hash=... Keith Bergen (Wed Apr 30 2003 - 06:54:30 PDT)
  • Re: Logs showing GET /.hash=... Chris Mann (Wed Apr 30 2003 - 10:30:31 PDT)
• Administrivia: SPAM control, vacation messages, and the like. Dan Hanson (Wed Apr 30 2003 - 09:09:24 PDT)

Last message date: Wed Apr 30 2003 - 14:37:36 PDT
Archived on: Wed Apr 30 2003 - 15:28:44 PDT

This archive was generated by hypermail 2b30 : Wed Apr 30 2003 - 15:28:44 PDT