Re: New CodeRed strain?

From: Frank Knobbe (fknobbeat_private)
Date: Fri Apr 25 2003 - 12:23:57 PDT

Next message: SB CH: "lots of port 0 scannings"

Previous message: Michael Lau: "Re: Anyone seen this UDP source port 7001 traffic?"
In reply to: Frank Knobbe: "New CodeRed strain?"
Next in thread: Frank Knobbe: "Re: New CodeRed strain? -- UPDATE"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Fri, 2003-04-25 at 13:55, Frank Knobbe wrote:
> we've been picking up some oddities since yesterday which look like a
> new CodeRed variant. Traditional signatures didn't identify it as such,
> but looking at the payload, it appears to be a CodeRed'ish type of bug.
> We're starting a trap for a complete session now. (So far have only
> isolated packets).


List admin. Please don't send the email to the list. It appears that we
need more info. This could be classic CodeRed. Please hold for now.

Thanks,
Frank (Sorry to have jumped the gun)

application/pgp-signature attachment: This is a digitally signed message part

Next message: SB CH: "lots of port 0 scannings"
Previous message: Michael Lau: "Re: Anyone seen this UDP source port 7001 traffic?"
In reply to: Frank Knobbe: "New CodeRed strain?"
Next in thread: Frank Knobbe: "Re: New CodeRed strain? -- UPDATE"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Apr 28 2003 - 10:12:09 PDT